Binance said it detected and helped stop a malicious governance proposal targeting roughly $1.2 million in a DAO's treasury, with the attack set to execute in less than 48 hours. The exchange coordinated with other platforms to restrict deposits to the attacker's address, according to an announcement posted August 18.
The unnamed DAO's community voted down the proposal before it could execute. Binance's intervention, closing deposit channels rather than unilaterally blocking the attack, allowed the governance process itself to function. The exchange detected the malicious proposal and identified the imminent timeline, then worked with the project and other exchanges to limit the attacker's ability to move capital while the community decided.
DAO governance attacks have become a recurring vulnerability as treasuries grow. In March 2024, ApeCoin holders rejected a proposal that would have redirected $750 million to a spin-off entity after community pushback. Curve Finance lost over $52 million in June 2023 when an attacker briefly seized control of a governance vote through flash-loan manipulation. Unlike those cases, the unnamed DAO in this incident had institutional support, Binance's infrastructure, to buy time for human judgment.
The mechanism Binance deployed is standard operational practice for major exchanges facing customer-account misuse: deposit restrictions are reversible, targeted, and do not require seizing funds. The exchange did not disclose the DAO's name, the attacker's identity, or whether law enforcement was notified. It also did not specify which other platforms coordinated the response.
DAO governance remains largely uninsured. Most protocols lack on-chain circuit breakers, time-locks, or tiered voting requirements that could slow or reverse malicious proposals. Some, like Aave, use multi-sig safeguards or delegation requirements to raise the bar for sudden treasury moves. Others rely on community vigilance and off-chain coordination, as happened here.
Binance stopped the attack with less than two days remaining, a window that would have been impossible to close through governance process alone had the community not voted in time. The exchange's willingness to intervene operationally sets a precedent for other platforms managing users who participate in DAO voting, though it does not address the underlying governance design gaps that made the attack possible in the first place.
The number that decides whether this becomes a systemic response is whether other DAOs now adopt formal pause mechanisms or time-locks for treasury access proposals, or whether the ecosystem continues to depend on ad-hoc coordination with exchanges when attacks emerge.
