Home/Blockchain/Governance Attack Scenario/Whale Manipulation

🐳 Whale Manipulation: Buy, Vote, Dump

Learn how large holders force through self-serving proposals

Defend against hostile takeovers and manipulation

Your Progress

0 / 5 completed
1
2
3
4
5

🐋 Whale Accumulation & Vote Buying

Flash loans are dramatic, but gradual accumulation is often smarter. Buy 5% per month for 6 months, nobody notices. Reach 30% voting power, take control. No flash loan fees, no time pressure, no rush. Just patience, capital, and a DAO with weak governance. This is how Build Finance lost $470M and Tornado Cash governance fell.

🎮 Interactive: Whale Accumulation Calculator

Model a gradual token accumulation strategy. Adjust purchase size, duration, and token price to see if a stealth attack is economically viable.

5%
Need significant power
30 days
Moderate pace
$10
Market price per governance token
$50M
How much you could steal/extract via malicious proposal
Tokens Needed
5.0M
5% of 100M supply
Total Cost (with impact)
$53.1M
~13% price impact
❌ NOT PROFITABLE
-6%
ROI on attack
Attack Strategy Analysis

⚠️ MODERATE: Medium-speed accumulation. Some price impact, moderate detection risk. Requires patience.

Detection Risk: High
Daily Purchase: $1771K/day

🎯 Real Whale Attacks

🏗️Build Finance (2021) - $470M at Risk

Attacker gradually accumulated 20% of BUILD tokens over several weeks. Submitted proposal to mint 25M new tokens (25% of supply) directly to their address. Passed with purchased votes. Executed before community could respond.

Lesson: 20% ownership + low participation = complete control. No timelock meant instant execution.
🌪️Tornado Cash (2023) - Governance Takeover

Attacker bought 1.2M TORN tokens for ~$500K (prices crashed after sanctions). Gained 30%+ voting power. Passed multiple proposals to drain treasury, change parameters, and install backdoors. Community powerless to stop.

Lesson: Bear markets make governance cheap. Low token price + treasury value = profitable attacks.
🎭Sybil Attacks via Delegation

Don't need to buy tokens—convince holders to delegate to you. Create 100 fake identities, offer "governance services," accumulate delegated power. When ready, vote maliciously. Delegators can't react in time.

Lesson: Delegation = trust. One malicious actor with 1000 delegators = governance weapon.

💰 Vote Buying

Pay holders to vote your way or delegate to you. Offer $5 per vote, buy 20% power for $1M. If treasury has $50M, that's 50x ROI.

Detection: Hard to detect off-chain deals. On-chain vote buying platforms exist (Snapshot bribery).

🤝 Cartel Formation

Coordinate with other whales. Each holds 10%, together 50%+. Split profits from governance attacks. Harder to detect than single whale.

Detection: Look for correlated voting patterns across addresses. Often use multisig for coordination.

💡 Key Insight

Whale attacks trade speed for stealth. Flash loans are fast but obvious. Gradual accumulation is slow but invisible until it's too late. Build Finance attacker spent weeks accumulating 20%, nobody noticed until the malicious proposal. Defense requires monitoring large purchases, delegation patterns, and voting behavior—not just quorum size. If your DAO has $100M treasury and tokens cost $10M for 30% power, you're vulnerable. Price of control must exceed value of treasury.

← Flash Loan Attacks