Bonk.fun Domain Hack Sparks Phishing Scam and Major Losses

High attention and emotional sentiment detected.

What Led To Bonk.fun Hack

Hackers gained access to a team-associated account and then injected malicious code into the bonk.fun frontend. Instead of executing a traditional domain registration hijack or exploiting smart contracts, attackers relied on social engineering or credential theft. As a result, they deployed a fake Terms of Service signature prompt. Once users signed it, they unknowingly authorized transactions that instantly drained their connected Solana wallets.

The team detected the compromise quickly. Operator Tom stated that hackers had hijacked a team account and forced a drainer onto the domain. Notably, the platform launched in April 2025 under the name LetsBonk.fun and had operated without major security incidents until this front-end breach.

This marks the first publicly reported domain compromise and wallet-draining incident for Bonk.fun hack since its inception. No earlier hacks targeting the platform or its predecessor appear in official records. Nevertheless, similar attacks have frequently affected Solana memecoin launchpads and DeFi platforms. 

In comparable past incidents, including the Pump.fun-related theft that resulted in about two million dollars in losses, token prices typically experienced short-term volatility. Traders often reacted with panic selling, which temporarily reduced liquidity and trading activity. However, recovery usually followed once platforms contained the breach and reassured users that core infrastructure remained secure. 

Immediate Impact of Bonk.fun Hack

Loading chart...

Early on-chain analysis and user reports indicate that at least one victim lost around 273,000 dollars. Additionally, multiple wallets collectively lost more than 114 SOL shortly after the breach. The attack targeted only those who interacted with the compromised site after the hijack. Therefore, users who previously connected wallets or traded through third-party interfaces such as Jupiter or Raydium have remained unaffected.

Meanwhile, Bonk.fun’s market share, which had already declined from its 2025 peak, now faces renewed scrutiny. Despite the incident, the BONK token has shown limited immediate price movement. It has traded near 0.0000071 dollars with minimal slippage so far. At the same time, speculative activity across the Solana memecoin ecosystem continues. However, community trust in centralized front-ends has weakened again.

Team Response

Bonk.fun’s team has begun an internal investigation and is working to regain full control of the domain and remove malicious code. Users who visited the site since the breach should avoid bonk.fun until the team issues an official all-clear through verified X channels. They should also revoke recent approvals or signatures using Solana wallet tools such as Revoke.cash. In addition, users should monitor wallet activity closely and consider using hardware wallets or fresh addresses for future transactions.

Update: 13th March

Furthermore, the BONKfun team has identified the attack vector and is actively working to regain control of the compromised domain. The incident was a Web2 front end attack, and Solana smart contracts and tokens remain unaffected.

Importantly, users who connected to BONKfun before the breach remain safe. Similarly, traders who interact with BONKfun tokens through trading terminals also face no risk from this incident.

However, only users who signed a fake Terms of Service prompt on the website during the breach window may have been affected. Therefore, impacted users should immediately remove token approvals from connected applications in their wallets as a precautionary measure.

The team will share a complete update once they fully secure the website. In the meantime, they have thanked the community for its patience and continued support.