A governance proposal drained 620 million XCN — roughly $2.91 million — from the Onyx DAO treasury on Ethereum on October 6, 2026, according to a real-time alert from security firm Blockaid. The compromised treasury sits at 0x28CA9CaAE31602D0312Ebf6466c9dD57FCA5da93.

The funds moved to two wallets Blockaid attributed to the attacker: 0xcBbA8B308c29c22158f5602793FE1eA361AfB9e0 and 0xb12aD23d4394A41C859d48c73CEd40Be6BF758c4. The XCN ERC-20 contract on Ethereum is 0xA2cd3D43c775978A96BdBf12d733D5A1ED94fb18.

How did the proposal clear every governance check?

Onyx's framework includes three safeguards: a proposal threshold, a quorum requirement, and a two-day timelock. Blockaid's alert described the attacker as having worked through all three. The timelock is a cooling-off window meant to give the community time to react. In this case, the transaction executed after the standard two-day window had elapsed.

The exploit's structure — weaponizing the protocol's own machinery — is the operational risk researchers have flagged in DAO governance for years. When voting power concentrates in a small number of wallets, threshold and quorum stop functioning as institutional checks and start functioning as checkboxes.

What is Onyx and why does the XCN loss cut deeper than the dollar figure?

Onyx operates its own Layer 1 blockchain, the Goliath mainnet, which launched in March 2026, while maintaining a presence on Ethereum. XCN functions as the gas token, a staked asset with liquid staking offering approximately 30% APR, and the governance token that decides proposals like the one at issue here.

That combination — gas, staking yield, and voting weight in one instrument — concentrates exposure when the governance layer fails. A drain of the Ethereum-side treasury hits holders of the same asset used to secure the Layer 1.

Is this a pattern or a one-off?

The October 6 exploit is not Onyx's first security episode. The ecosystem recorded protocol vulnerabilities in 2023 and 2024, with one incident involving losses exceeding $3.8 million. Community measures followed that earlier episode, including exploit reporting channels and compensation plans for affected parties.

The recurrence shifts the question. It is no longer whether Onyx can be exploited, but whether its governance design can withstand an attacker who legitimately acquires enough XCN to pass a proposal. Researcher findings cited in the Blockaid analysis point to concentrated voting power as the structural risk, and suggest possible responses including multi-signature requirements on treasury movements or enhanced voting protocols that make a single hostile proposal harder to push through.

What changes operationally now?

For now, the treasury transfer sits on-chain as a completed transaction. The recovery path runs through community coordination rather than any code-level reversal mechanism. Onyx's prior incident set the template: reporting, compensation plans, and a long rebuild of holder trust.

The next test is whether the Goliath mainnet's bridge or treasury mirrors the same governance surface area as the Ethereum contract. If it does, the same attack pattern could attempt a cross-chain drain — a market-structure risk that goes beyond this single $2.91 million loss, and that any tightening of Onyx governance will need to address before the next proposal window opens.