A co-founder of Helius publicly flagged an active governance attack on Tuesday, urging protocols across the ecosystem to tighten quorum settings on their DAO contracts without delay.

The alert, first reported by Crypto Briefing, frames the call to action as prevention rather than postmortem. The specific protocol under attack was not disclosed in the headline-level notification, but the recommendation centers on a vulnerability class that has drained protocol treasuries in multiple prior cycles.

What the advisory is targeting

The Helius co-founder's message centers on quorum — the minimum share of token holders or delegates that must participate before a proposal becomes actionable on-chain. Lower quorum thresholds reduce the capital an attacker needs to acquire enough voting power to push through malicious parameter changes.

The most common outcomes in this attack class include treasury diversions that re-route reserves to attacker-controlled wallets, contract upgrades that introduce backdoor minting or admin-key transfers, and fee-parameter changes that redirect protocol revenue.

These attacks rarely break cryptography. They execute by following a protocol's own rules in a sequence the original authors did not anticipate.

Why defaults create exposure

Governance defaults on DAO contracts are written for normal participation conditions. The same defaults become attack surfaces when an adversary acquires voting power through OTC desks, lending markets, or dormant delegations from prior token distributions.

The Helius warning lands against a backdrop in which governance exploits have become a recurring category of treasury loss. The playbook is consistent: acquire voting power below market, wait for quorum to be reachable, pass the malicious proposal, and execute the drain within the same transaction or the next block. Timelocks and higher quorum thresholds interrupt that sequence at the protocol-config level rather than at the attacker level.

What protocols are being told to do

The recommendation focuses on configurable governance parameters:

• Audit quorum denominators to confirm they reference circulating supply rather than total supply
• Layer timelocks on executable proposals so token holders retain a response window after a vote passes
• Increase quorum for high-impact proposal categories, including treasury changes and upgrade-key authorizations
• Monitor delegate composition and concentration for rapid shifts that suggest voting-power acquisition

The advisory does not name a specific contract standard. It frames the response as a checklist each protocol team can run without external help.

How operators should prioritize

Protocols that have not reviewed governance parameters since launch face the highest exposure, because their settings were configured for participation patterns typical of the launch environment, not adversarial ones.

Action items include identifying the smallest quorum path to an executable action, confirming delegation contracts cannot be acquired in bulk from a single counterparty without cooldown, and verifying vote-escrow contracts cannot be redeemed through paths that bypass the governance queue.

What comes next

The Helius alert implies more governance attack vectors may surface in the near term, particularly on smaller protocols that inherited permissive defaults and have not revised them. The window for preventive action is the days before the next acquisition-then-execution sequence, matching the cadence of prior exploits in which initial purchase and treasury drain compressed into a single block.