Crypto glossary
Governance attack
A governance attack is a takeover of a DAO or protocol in which an attacker gathers enough votes, bought, borrowed or tricked, to pass a harmful proposal.
Many DeFi protocols let token holders vote on proposals that execute code directly, such as moving treasury funds or changing contract settings. If the attacker can gather more votes than the defenders for long enough, governance itself becomes the exploit. Voting power can be bought on the market, borrowed through flash loans or lending markets, or accumulated quietly over weeks when turnout is low.
The best-known case is Beanstalk in April 2022, where an attacker used a flash loan to obtain a supermajority, passed an emergency proposal within one transaction and drained around 180 million dollars. In May 2023, Tornado Cash governance was hijacked through a proposal containing hidden code that granted the attacker fake votes. Smaller DAOs with thin participation and large treasuries are frequent targets of hostile proposals.
Defences include snapshotting voting power before a proposal is created, which defeats flash loans, timelocks that give holders time to react, quorum and veto mechanisms, guardian roles and careful review of proposal code. Each adds friction or some centralization, and none helps if a legitimate majority votes for something destructive.
Example
An attacker quietly borrows a DAO's governance token across several lending markets, submits a proposal to send the treasury to an address it controls and passes it during a holiday weekend with low turnout.