Fake governance proposal stealing funds through a malicious vote

13 November 2026

A fake governance proposal is a scam that abuses the voting mechanism of a decentralized autonomous organization (DAO) to trick token holders into sending funds or approving a malicious transaction, all while appearing to be a legitimate ballot. The scam works because governance votes often ask users to sign or broadcast transactions, and a well-disguised proposal can make a harmful action look like a routine decision.

How a Legitimate Governance Vote Is Supposed to Work

In a genuine DAO, token holders vote on proposals that change how the organization operates. These votes can decide anything from treasury spending to protocol upgrades. When a proposal passes, the underlying smart contract executes the agreed-upon action automatically. For example, a vote might release funds to a developer, change a fee structure, or upgrade a contract.

The key detail is that voting usually happens through a web interface connected to your wallet. You sign a message or submit a transaction that records your vote on the blockchain. In most cases, voting itself costs only a small network fee. The proposal contract then counts the votes, and if the outcome reaches a quorum, the action is executed.

Where the scam gets in

The scammer's goal is to make you think you are voting on a routine proposal when you are actually approving something else entirely. The deception works in a few overlapping ways, but the core mechanics stay the same.

Step 1: Creating a Fake Proposal

The attacker creates a proposal that looks legitimate. They copy the title, description, and formatting of an existing proposal from a well-known project. They might use the project's official logo, link to the real documentation, and write in the same tone as the actual team. The proposal might claim to be about a routine treasury payment, a token swap, or a minor parameter change.

The fake proposal is then submitted to a governance forum or voting platform. It may appear alongside real proposals, especially if the attacker has found a way to get it listed. In some cases, the attacker will use a phishing link to send you directly to the fake voting page, bypassing the project's official interface altogether.

Step 2: the malicious vote transaction

When you click "vote" on the fake proposal, your wallet will ask you to confirm a transaction. This is the critical moment. A legitimate vote transaction simply records your choice on-chain. A malicious vote transaction, however, does something else entirely.

The most common trick is to have the "vote" actually call a delegatecall to a contract that transfers your tokens, or to have it approve a spending limit for the attacker's address. Instead of just casting a vote, you are approving the attacker to spend your entire token balance. In other cases, the proposal may be designed to execute a function that sends tokens from any wallet that has approved it.

Some scammers go further. They create a proposal that, if passed, will execute code that drains the DAO's treasury. The vote is rigged because the attacker controls a large number of voting tokens, or because they have convinced enough holders to vote yes without reading the underlying code. The proposal passes, and the funds are gone.

Step 3: the aftermath

Once the malicious transaction is confirmed, the damage is done. The attacker now has the authority to move your tokens, or they have already done so. You may not notice immediately, especially if the vote appears to have succeeded and the interface shows a confirmation screen. By the time you check your balance, the tokens are gone.

If the attack drains a treasury, the effect is worse. The project loses its funds, the token price may collapse, and all holders suffer. The scammer will typically move the stolen assets through a mixer or a chain-hopping service to obscure the trail.

How to Spot a Fake Governance Proposal

You can reduce your risk by checking a few things before you cast any vote.

Check the contract address

Every proposal should reference the smart contract it affects. Compare that address against the official contract address listed on the project's website, not the one in the proposal. A single character difference means the proposal is fake.

Read the Code

You do not need to be a developer, but you should look at the actual transaction payload. Most wallet interfaces let you expand the details and see what function is being called. If it says approve or transferFrom, it is not a simple vote. A legitimate vote typically calls a function named castVote or propose on the governance contract. If you see anything else, cancel.

Verify the proposal ID

Governance platforms assign unique IDs to proposals. Check the project's official forum or Discord to see if the proposal you are looking at actually exists. Attackers often create proposals with names that sound similar to real ones, so verify the ID and the exact wording.

Be wary of urgency

Scammers often add a time limit. They claim the vote expires in a few hours or that you must act immediately to secure a reward. This pressure is designed to stop you from thinking. Legitimate governance votes run for days, and there is no rush.

Look for the Spender

If you are using a hardware wallet, the device will show you what you are approving. It should list the spender address and the amount. If the spender address is not the governance contract, stop. If the amount is unlimited or much larger than the vote should require, stop.

What to Do If You Have Already Voted on a Fake Proposal

If you suspect you have interacted with a fake proposal, act quickly.

1. Revoke any token approvals. Use a block explorer or a token approval checker to find which contracts have spending limits on your tokens. Revoke any that you do not recognize. See the site's guide on revoking smart contract permissions for details.
2. Move your remaining funds. If you still hold the tokens, transfer them to a fresh wallet that has never interacted with the malicious proposal.
3. Report the proposal. Most governance platforms have a way to flag or report malicious activity. Do so, and warn the project's official channels.
4. Do not chase a recovery. If someone contacts you claiming they can get your stolen tokens back, it is likely a recovery scam, which is covered elsewhere on this site.

The Bottom Line

Fake governance proposals are effective because they exploit trust in a system designed to be democratic. The vote itself is the bait. The real damage happens when you approve a transaction you do not understand. If a proposal asks for anything beyond recording your choice, it is not a vote - it is a theft. Treat every governance interaction with the same caution you would a wire transfer, because that is effectively what it is.

Back to crypto scams