anticapture

Accelerating governance capture resistance | By @blockful_io

[anticapture @anticapture]

Connect your agent to the Anticapture MCP and find governance data on the market's leading protocols, including @Uniswap, @Compound_xyz, @ENS_DAO and others listed on @anticapture.

Information on delegates, voting power, the share of tokens held by specific addresses and much more is available through the Anticapture MCP.

Thanks to @Uniswap for sponsoring this feature🦄

Watch this demo mande by our founder, @alextnetto 👇

[anticapture @anticapture]

Analyzing the flow of tokens deposited on CEXs, we noticed that some governance tokens tracked on Anticapture are behaving differently.

Holders of $OBOL, $FLUID and $UNI are sending their tokens to exchanges, increasing the share of supply held on exchanges.

This could mean their holders are simply selling. Or perhaps it reflects concern about self-custody after the vulnerabilities in the last weeks.

Other tokens, however, show the opposite behavior.

$GTC and $COMP saw a drop in balances on exchange addresses, meaning more holders are withdrawing tokens than sending them to exchanges.

It's a peculiar pattern, which may mainly reflect governance token holders who want to use them for voting or other strictly on-chain actions.

With the return of the Governor at @gitcoin and the political conflicts at @Compound_xyz , the data fits the current context.

All data was sourced using the @anticapture MCP.

[anticapture @anticapture]

Over the last 90 days, 76% of proposals submitted to @nounsdao failed to reach quorum - and therefore didn't pass. Only 4 proposals reached quorum in the past 3 months, and all of them passed.

Of those 4 approved proposals, 3 needed the vote of 5gram.eth, the largest individual holder in Nouns DAO, with 177 votes. Without his vote, and those of other holders with more than 40 NFTs (votes), reaching quorum becomes mathematically much harder, creating a dependence on them.

Since April 24, 2026, when the Noun/NFT reserve price was set at 2.8 ETH, the number of new buyers has plummeted. As a result, power is becoming concentrated among those who already hold the tokens, like 5gram.eth.

Data from @anticapture MCP

[anticapture @anticapture]

Although @Uniswap's Delegated Cap keeps rising, reaching $1.67B on September 22, the number of delegated tokens has dropped nearly 30% since May 2026.

This means Uniswap is more secure, since the cost of capturing it keeps getting higher, thanks to $UNI's price appreciation since August.

However, the number of delegated tokens continues to fall, which means fewer $UNI holders are delegating their tokens.

This sharp drop of nearly 30%, ~58M $UNI, may have been caused by old addresses holding $UNI moving or selling their tokens.

[anticapture @anticapture]

With market optimism over the past few weeks, governance token prices have risen, increasing the cost to attack DAOs.

On @Uniswap, for example, $UNI doubled in price: it went from $3.29 on August 18 to $7.37 on September 5. Even with the drop in the DAO's Delegated Supply, the cost to overtake it jumped from $534M to $1.2B.

So, in a bull market, @Uniswap and other DAOs end up becoming more expensive to attack. On the other hand, their treasuries, which are based on governance tokens, also become more valuable.

[anticapture @anticapture]

@gitcoin has just upgraded its governance contract.

After moving its treasury to a multisig because of the risk of governance capture, the project worked with ScopeLift to design a more secure governance system.

The key change, which now lets it block attack attempts, is a Proposal Guardian: a Security Council able to prevent the DAO from being captured.

Congratulations to @gitcoin for keeping its governance on-chain, and to @ScopeLift for helping protocols become more secure.

[anticapture @anticapture]

@ImmutableLawyer @greenfield_cap It's interesting to us because this kind of accountability for Foundations in DAOs isn't common.

That's why it sounds so different and unusual, but we agree, it should be standard practice across projects.

[anticapture @anticapture]

At Anticapture, we analyze capture and on-chain governance problems, but what happens when there are disagreements over off-chain governance?

Today, @greenfield_cap announced that it has filed a request for Swiss regulators to investigate the governance of the Safe Foundation (not the DAO) and determine whether there are issues that need to be corrected.

Greenfield Capital claims there is a disagreement between investors and the way the Foundation has been run, harming the project and, by extension, those who invested in it.

It's interesting to see VCs using traditional mechanisms to resolve governance problems at a Foundation where the token has no power, but regulators still might.

[Jascha @JaschaSamadi]

1/
Today @greenfield_cap published an open letter on the @safe Community Forum explaining why we have filed a supervisory complaint with the Swiss Federal Supervisory Authority for Foundations (ESA) concerning the Safe Ecosystem Foundation. Here is why, and what we are asking for.

[anticapture @anticapture]

@marcxvlad @randgroup @walletbeat @defiscan_info 🤝

[anticapture @anticapture]

@Uniswap Hooks adoption has surged over the past two months: roughly 40% of all volume on Uniswap v4 was executed through Hooks. In absolute terms, Hooks processed $14.1B in volume in September alone.

Uniswap v4 launched in January 2025, but even with incentives, it was slow to gain traction. It wasn't until August 2026 that Hooks usage took off, driven by v4 adoption among protocols on Robinhood Chain, most notably Pons.

In July 2026, a proposal activated the fee switch on Uniswap v4. One month later, Hooks' share of volume jumped from 2% to 32%.

[Uniswap Developers @UniswapBuilders]

The world is waking up to hooks

Hooked vs non-hooked volume on Uniswap v4, since the start of summer

Data via @Blockworks

[anticapture @anticapture]

@Uniswap approved a proposal to turn on the fee switch on @arc - one more network feeding the $UNI buy-and-burn machine.

Its governance has approved a series of proposals, the latest on Robinhood Chain, to enable the fee switch and keep benefiting holders of its governance token.

Although Arc moved $410M on its launch day, network volume has dropped 87% over the past 7 days. Still, that's $53M in a single day - with Uniswap being the main avenue for this trading to happen.

[anticapture @anticapture]

Another day, another attempt to capture an abandoned governance.

Rarible is part of a series of attacks carried out on abandoned DAOs that either (1) hold a treasury or (2) control ways to extract money in some form.

Option 2 has been becoming increasingly popular. A DAO may not have money, but it can mint new tokens or drain funds from users who granted infinite approvals 5 years ago.

We're preparing a deeper analysis of this risk currently circling the market.

Keep an eye on @anticapture 👀

[blockful.eth @blockful_io]

Another abandoned governance is under attack - this time it's Rarible's.

@rarible was a well-known NFT marketplace between 2020 and 2022. It moved millions of dollars during the NFT frenzy. The protocol and its treasury are governed by $veRARI holders - locked $RARI - using veNomics to set voting power in the DAO, just like Curve does.

On September 20, a wallet bought 3.5 ETH worth of $RARI and locked it in Rarible's contracts, receiving 132,576 veRARI in voting power.

Moments later, the same wallet submitted a proposal from a supposed activist investor called Falcon. According to the proposal text, they would "unlock veRARI's value for its holders."

In practice, if approved, the proposal transfers ownership of all contracts to "Falcon." The voting period ends on September 25 at 08:53 UTC.

Rarible DAO has a Security Council, so it is able to block the attack, if it manages to get the multisig signers who control the Council to act in time.

The strangest part of this attack is that Rarible has only $368 in its treasury, yet the attackers spent $9,311 to capture its governance.

Like other attacks, they don't want money - they want control over what Rarible can do, such as:

- The ability to mint unlimited $RARI tokens on the market and sell them on the secondary market (while shorting it on an exchange)
- Stealing users' funds via $WETH, $USDC, and other token approvals (including NFTs) granted to Rarible's marketplace
- Draining all the tokens locked in the veRARI contract

These are just simple possibilities that let attackers extract profit without needing a treasury to steal from.

Over time, these attacks are getting more sophisticated, and the pool of potential victims keeps growing - even projects with no money worth stealing.

We recommend that anyone holding an address with approvals granted to Rarible revoke them, to avoid any trouble in case governance is indeed captured.

[anticapture @anticapture]

@jerrythekid @DefimonAlerts @rarible

[anticapture @anticapture]

After receiving a 3M $ENS delegation and voting on 2 proposals with that voting power, nick.eth withdrew the delegation and now has only 151K $ENS delegated to his address.

The tokens are still held in wallets he controls, but they are not currently being used to vote in ENS DAO governance.

[anticapture @anticapture]

New major governance change detected:

nick.eth received a 3M ENS delegation. To put in perspective, the quorum is 1M ENS and average turnout ~1.4M ENS.

[anticapture @anticapture]

Attack attempts continue to happen in DAOs with abandoned multi-million dollar treasuries.

The capture of decentralized organizations and protocols is a reality - and it will continue to happen if projects don't prioritize the security of their treasuries and contracts.

That's why we built @anticapture

[blockful.eth @blockful_io]

@AmpleforthOrg was the target of a governance attack attempt this past weekend.

An address submitted a proposal requesting a supposed DAO payment of $2.5M to a grantee, the project's entire USDC treasury. The project exists and is discussed on the forum, so it could slip by at first glance.

However, in the last few hours, the proposal that would have executed the attack was canceled.

The address that submitted the proposal was receiving a delegation from another wallet. That wallet held 87K $FORTH, with 70K $FORTH being the minimum required to submit a proposal. Today, the owner of those $FORTH decided to sell their entire position in the governance token.

@AmpleforthOrg governance has a mechanism that allows anyone to cancel a proposal when the submitter holds less than 75K $FORTH. Seventy blocks after the $FORTH sale, an address canceled the proposal that would have stolen the $2.5M in USDC.

In parallel, a proposal to move treasury administration to the Ampleforth team's multisig entered voting. It was submitted one day after the attacker's proposal and will begin being voted on tomorrow.

If approved, Ampleforth would move administration of its treasury (via Timelock) to a 2-of-5 multisig, thereby preventing any $FORTH holder from moving the funds currently held in treasury.

That would prevent further attacks, but it would also end the utility of $FORTH - using the DAO's money.

[blockful.eth @blockful_io]

With @anticapture we can assess ENS DAO's revenue and identify the main activities that generated income for the protocol.

The main revenue sources are (1) new registrations, (2) renewals, and (3) premium sales.

Revenue from new registrations has currently been declining, but revenue from premium sales has increased over the past 3 months - in August alone, it reached $113K.

Premium sales are ENS domains that have already expired and passed the 90-day grace period. After that period, the domain goes into a 21-day descending auction. Its price starts at $100M and drops to 0 by day 21.

The DAO charges a premium in this auction for whoever wants to claim the domain.

The difference between the premium paid in the auction and the cost of registering the ENS name is an additional revenue source for the DAO - today, just as important as renewals or new registrations.

[anticapture @anticapture]

the fly is preventing governance attacks

[anticapture @anticapture]

With market optimism over the past few weeks, governance token prices have risen, increasing the cost to attack DAOs.

On @Uniswap, for example, $UNI doubled in price: it went from $3.29 on August 18 to $7.37 on September 5. Even with the drop in the DAO's Delegated Supply, the cost to overtake it jumped from $534M to $1.2B.

So, in a bull market, @Uniswap and other DAOs end up becoming more expensive to attack. On the other hand, their treasuries, which are based on governance tokens, also become more valuable.

[anticapture @anticapture]

$COMP, from @Compound_xyz , saw a spike in on-chain transfers on September 2, six days ago.

At first, the movement seemed strange, but there is a justification.

The proposal to move funds from the old Franchiser contracts, which delegate $COMP from the treasury to delegates, to a new contract (FranchiserPool) was approved. As a result, delegation was rebalanced, including a delegation of 33K $COMP to blockful.

It's interesting to be able to find, on a platform like @anticapture , on-chain events that stand out - and, on the same platform, locate the answer to their cause.

[anticapture @anticapture]

On July 27, Uniswap approved a proposal enabling the fee switch across multiple networks, including Robinhood Chain. The fee switch uses fees charged to LPs to buy and burn $UNI.

Since the proposal passed, Uniswap has burned $6.4M worth of $UNI driven by volume on Robinhood Chain alone.

That already makes it the third-largest network for $UNI burns, accounting for 70% of all fees accumulated toward the burn, and it's closing in on Base. All of that in just a month and a half.

The DAO's timing on this proposal let Uniswap tie the fee switch activation directly to Robinhood Chain's traction, turning the network's early success into a burn number $UNI holders can see.

[anticapture @anticapture]

DAOs continue to be targeted by attackers seeking dormant treasuries.

These attacks affect not only the idle assets of these projects but, as in the case of @YamFinance, everything under the governance system's control: from users' staked tokens to the issuance of new coins.

Governance is still the weakest layer in most decentralized protocols, and the industry keeps treating it as an afterthought.

[blockful.eth @blockful_io]

A wallet funded by an address Blockscout flags as a scam bought roughly 504,000 YAM this week, about 3.3% of supply, enough to clear @YamFinance 200k-vote governance quorum by itself. It's now sitting behind proposal #45.

The setup ran in six moves:

- fund the wallet
- buy the YAM through an on-chain aggregator
- self-delegate
- submit a proposal on YamGovernorAlpha V3 with an empty description
- then vote FOR in the very next block so the snapshot locks in before anyone can react.
- the attacker then sold most of the position, keeping back roughly 80k votes worth of YAM, just above the 50k threshold that lets anyone call a public cancel().

Proposal #45 does one thing: setPendingAdmin on Timelock V3, naming the attacker's address. Pass it, and that address controls the Reserves treasury, the YAM V3 token's gov and mint functions, and the Incentivizer and Migrator contracts, all without a second vote.

The same play failed in July 2022 on the same Governor V3 because the attacker sold below threshold and anyone could cancel. This time the position was sized to stay above it, and the Guardian multisig, which can still cancel(45) with 3 of 8 signers, hasn't signed anything since November 2022. Flash loans don't help either way, since voting power is checkpointed at the proposal's start block.

If you hold delegated YAM, vote against #45 before block 25,897,343.