Onyx DAO Treasury Drained of 620M XCN via Governance Exploit
An attacker successfully drained $2.91 million in XCN from the Onyx DAO treasury by passing a malicious governance proposal.
The Onyx DAO treasury on Ethereum was hit by an exploit on October 6, 2026, resulting in the loss of 620 million XCN. Security firm Blockaid flagged the incident in real-time, identifying that the stolen tokens, valued at approximately $2.91 million, were moved into wallets linked to the attacker.
The exploit bypassed standard security measures by utilizing the protocol's own governance machinery. The attacker managed to get a proposal passed that authorized the treasury transfer, successfully navigating the project's proposal threshold, quorum requirement, and two-day timelock.
Because the proposal followed the standard two-day cooling-off period, the transaction executed as intended by the protocol's code. Blockaid identified the compromised treasury address as 0x28CA9CaAE31602D0312Ebf6466c9dD57FCA5da93, while the receiving wallets were identified as 0xcBbA8B308c29c22158f5602793FE1eA361AfB9e0 and 0xb12aD23d4394A41C859d48c73CEd40Be6BF758c4.
XCN serves as the governance token for the Onyx ecosystem, which includes both the Ethereum presence and the Goliath mainnet launched in March 2026. The token is also used for gas fees and staking, with liquid staking currently offering an annual percentage rate of approximately 30%.
This incident follows previous security issues for the Onyx ecosystem, which experienced protocol vulnerabilities in 2023 and 2024. One of those prior events resulted in losses exceeding $3.8 million, leading to community-led recovery efforts.
Research into the project's governance structure highlights the risks of concentrated voting power, which can turn security checks into mere formalities. Potential responses to such vulnerabilities include implementing multi-signature requirements for treasury movements or upgrading voting protocols to prevent hostile proposals from passing.
