Onyx DAO treasury moves 620M XCN as Blockaid flags governance exploit

A governance vote is supposed to be decentralization at its most civic. On Onyx, it apparently doubled as a withdrawal slip. On October 6, 2026, security firm Blockaid issued a real-time alert flagging an exploit tied to the Onyx DAO treasury contract on Ethereum. The alert centered on a transfer of 620 million XCN, valued at approximately $2.91 million, out of the treasury and into wallets Blockaid linked to the attacker. The exploit ran through Onyx’s own governance machinery. The attacker reportedly got a governance proposal passed, and that proposal authorized the treasury transfer. Onyx’s governance framework includes three main checks: a proposal threshold, a quorum requirement, and a two-day timelock. The attacker is described as having worked through all three. The timelock is a cooling-off period. Once a proposal passes, it sits for a set window before it can execute, giving the community time to spot anything suspicious and react. In this case, the transaction executed after the standard two-day timelock had elapsed. Blockaid’s alert included the specifics of the exploit transaction along with the relevant addresses. The compromised treasury sits at 0x28CA9CaAE31602D0312E...