Onyx DAO Exploit Sees 620M XCN Stolen via Governance Attack

On October 6, 2026, security firm Blockaid flagged an exploit targeting the Onyx DAO treasury contract on Ethereum. The attack resulted in the transfer of 620 million XCN tokens, valued at approximately $2.91 million, from the treasury to wallets linked to the attacker. The exploit was executed through Onyx’s governance framework, where the attacker managed to pass a malicious proposal that authorized the treasury transfer.

The Onyx governance framework includes a proposal threshold, quorum requirement, and a two-day timelock to prevent such exploits. Despite these safeguards, the attacker navigated through all three checks, allowing the transaction to execute after the standard two-day timelock period.

Blockaid’s alert included details of the exploit transaction, along with the compromised treasury address and the receiving wallets attributed to the exploiter. The compromised treasury sits at 0x28CA9CaAE31602D0312Ebf6466c9dD57FCA5da93, while the receiving wallets are 0xcBbA8B308c29c22158f5602793FE1eA361AfB9e0 and 0xb12aD23d4394A41C859d48c73CEd40Be6BF758c4. The XCN token’s ERC-20 contract on Ethereum is 0xA2cd3D43c775978A96BdBf12d733D5A1ED94fb18.

This incident is not the first security problem for Onyx. The ecosystem faced protocol vulnerabilities in both 2023 and 2024, with one incident resulting in losses exceeding $3.8 million. The earlier episode prompted community recovery measures, including exploit reporting and compensation plans for affected parties. The research findings highlight concentrated voting power as a structural risk, suggesting that protocols may need to tighten governance mechanics to prevent future exploits.