Laika AI
Last Updated
March 12, 2026

The Solana-based token launchpad Bonk.fun was hit by a domain hijacking attack this week, with hackers replacing the platform's legitimate interface with a crypto drainer designed to steal funds from connected wallets. The platform's team administrator, identified as Tom, issued an emergency alert urging all users to stop visiting the site immediately.
Attackers gained access by compromising a team member's administrative account. With that foothold, they replaced the real Bonk.fun homepage with a fraudulent version containing a fake "Terms of Service" prompt. Users who signed what appeared to be a routine wallet authorization were actually signing a transaction that handed control of their funds to the attacker.
The attack relied on a JavaScript-based drainer embedded directly into the site's infrastructure. This tactic is more dangerous than conventional phishing because it exploits a legitimate, trusted domain rather than a lookalike site. Standard advice to "check the URL" offers no protection when the real URL has been weaponized.
An operator linked to Bonk.fun, identified as Tom, stated in a post on X that a team account had been compromised, which allowed attackers to distribute a malicious prompt through the bonk.fun domain.
No comments yet. Be the first!
Only users who visited Bonk.fun after the compromise occurred and signed the fake Terms of Service prompt are considered at risk. Users who connected wallets or traded through external terminals before the breach were not affected. Major browsers flagged bonk.fun as a phishing site shortly after the attack was detected, but anyone who visited in the window before those flags went up may have been exposed without any warning.
Revoke all wallet permissions.Use a tool like Revoke.cash or Laika Revoke tool to identify and cancel any permissions your wallet has granted. Active permissions are an ongoing threat even after the initial drain.
Move funds to a fresh wallet. Do not attempt to clean or reuse the compromised wallet. Generate a new address and transfer any remaining assets there immediately.
Monitor connected accounts.Check any exchanges or DeFi platforms linked to the affected wallet for unauthorized activity.
Follow official channels only.Get updates exclusively from verified Bonk social accounts. Attackers frequently target breach victims with fake recovery sites.
The Bonk.fun attack is part of a broader and accelerating pattern. Reports show $127 million was lost to crypto exploits in January 2026 alone, a pace analysts warn could push annual totals to record highs. Wallet drainer attacks cost the industry approximately $494 million in 2024, a 67% increase from the prior year.
Solana-based drainer kits have become widely accessible through drainer-as-a-service (DaaS) networks, often distributed via Telegram and compatible with over 90 wallet types. These operations lower the technical barrier for attackers significantly, which is why incidents like this are becoming more frequent rather than less.
For platforms, the core lesson is that administrative account security is just as critical as smart contract security. Mandatory multi-factor authentication and hardware security keys for anyone with domain-level access should be non-negotiable. The most robust on-chain protections mean nothing if an attacker can simply replace the frontend.
For users, the takeaway is that a correct URL in the address bar no longer guarantees a safe site. Every wallet signature request deserves scrutiny, no matter how familiar the platform or how routine the prompt appears.
The Bonk.fun breach is a precise demonstration of how attackers have evolved to exploit user trust rather than technical vulnerabilities. If you signed anything on bonk.fun recently, treat your wallet as compromised and act accordingly. If you were not affected, use this as a prompt to review your own security practices before the next incident.