Bonk.fun domain hijacked to serve wallet drainer behind fake terms-of-service prompt
Bonk.fun launchpad users
On Mar 11, 2026, attackers who had hijacked a Bonk.fun team account put a wallet drainer on the Solana launchpad's official domain. Visitors were asked to sign a fake terms-of-service message, and those who signed had their wallets drained. The team called losses minimal; SlowMist's database puts them at about $30,000. Only people who signed the fake message on the domain after the hijack were affected. If you signed it, move remaining funds to a new wallet.
Why this severity: $30K reported stolen, only partly contained.
- Started
- Mar 11, 2026
- Closed
- Mar 12, 2026
- Chains
- Solana
- Reported stolen
- $30K
At risk
- Bonk.fun launchpad users
- Solana wallets
What to do now
- If you signed the message, move remaining assets to a new wallet now.
- Check the old wallet in an explorer for outgoing transfers, delegates or owner changes you did not make.
- Wait for the team's official all-clear before using the site again.
Stay safe
Am I affected?
You are affected only if you visited the Bonk.fun domain on or after Mar 11, 2026 and signed a 'terms of service' message. Connecting earlier, or trading Bonk tokens on other terminals, was reported as safe.
What to do now
- If you signed the message, move remaining assets to a new wallet now.
- Check the old wallet in an explorer for outgoing transfers, delegates or owner changes you did not make.
- Wait for the team's official all-clear before using the site again.
How to avoid this
- A real site never needs you to sign a 'terms of service' message to move funds. Read every wallet prompt. If it shows transfers or permission changes, cancel.
- Use a low-balance hot wallet for launchpads and keep savings elsewhere.
- Keep a wallet with a transaction-preview warning feature turned on. A hijacked official domain looks exactly like the real thing.
Timeline 2
Alerts & on-chain evidence 1
News & write-ups ›1
How this method works
The real website of a dapp you trust is taken over (DNS, hosting or a script it loads) and starts serving a drainer. Read about front-end and dns hijacks →
Follow new drains and updates in your feed reader or Telegram RSS bot.