If you have interacted with the Bonk.fun website in the last 24 hours, disconnect your wallets immediately and revoke any suspicious token approvals. The platform’s domain has been hijacked by malicious actors who are currently deploying a sophisticated wallet-draining phishing prompt, putting user assets at significant risk of theft.

What Exactly Happened to Bonk.fun?

The incident, which was first reported by Decrypt, involves a classic DNS compromise. Attackers gained control over the domain’s routing, allowing them to intercept traffic intended for the legitimate Bonk.fun interface. Instead of the intended dashboard, users are greeted by a fraudulent pop-up designed to deceive them into signing malicious transactions.

These prompts often appear as standard "Connect Wallet" or "Claim Rewards" requests. However, once signed, they grant the attacker full permission to drain your $BONK holdings and other SPL tokens from your Solana wallet. Multiple outlets including CoinDesk have flagged similar on-chain signals, confirming that wallets interacting with the site are seeing immediate unauthorized outflows.

Why Your Wallet Security Matters Right Now

This attack serves as a brutal reminder that even established front-ends are vulnerable to infrastructure-level exploits. We’ve seen this pattern before, where attackers pivot from simple social engineering to sophisticated, site-wide compromises. If you are concerned about your own device security, it is worth reviewing how MediaTek chip vulnerabilities can expose Android crypto wallets to 45-second thefts, as these combined risks make it critical to utilize hardware-based signing for any high-value transactions.

Furthermore, as institutional interest grows, so does the sophistication of these phishing campaigns. For those tracking broader market movements, it is essential to stay updated on how Binance.US’s recent leadership changes might impact platform-wide security and regulatory compliance in the coming months.

How to Protect Your Assets

If you believe you have been compromised, do not wait for the market to stabilize. Take the following steps immediately:

  • Revoke Permissions: Use a tool like Revoke.cash or the Solana-specific equivalent to check for and cancel any unauthorized contract approvals.
  • Move Assets: If your primary wallet is compromised, transfer remaining funds to a fresh, air-gapped hardware wallet immediately.
  • Avoid the Domain: Do not visit Bonk.fun until the project team confirms they have regained full control and the site has been scrubbed of malicious scripts.

FAQ

Is the BONK token itself compromised? No. The attack is limited to the Bonk.fun domain interface. The underlying Solana program and the token contract remain secure, but the front-end used to interact with them is currently dangerous.

What should I do if I already signed a transaction? Assume your private keys or seed phrase may be compromised. Move your remaining assets to a new wallet address that has never interacted with the hijacked site.

How can I tell if a site is legitimate during an outage? Always cross-reference domain URLs with official project social media channels (X/Twitter) and check community sentiment on reliable block explorers or CoinGecko.

Market Signal

The hijacking of a high-traffic domain like Bonk.fun adds downward pressure on retail sentiment for Solana-based memecoins. Investors should remain cautious of volatility in $BONK and similar assets, as panic-selling often follows high-profile security incidents. Ensure you are monitoring on-chain volume via Dune Analytics to distinguish between genuine sell-offs and malicious draining activity.