{
 "slug": "bonk-fun-domain-hijack-drainer-mar-2026",
 "title": "Bonk.fun domain hijacked to serve wallet drainer behind fake terms-of-service prompt",
 "url": "https://drains.watch/i/bonk-fun-domain-hijack-drainer-mar-2026",
 "json": "https://drains.watch/i/bonk-fun-domain-hijack-drainer-mar-2026.json",
 "status": "closed",
 "severity": "high",
 "threatStatus": "partly-contained",
 "verification": "verified",
 "chains": [
  "solana"
 ],
 "method": "front-end-hijack",
 "product": "Bonk.fun launchpad users",
 "tags": [
  "solana",
  "front-end-hijack",
  "bonk-fun",
  "launchpad",
  "domain-hijack",
  "fake-tos",
  "signature-phishing",
  "bonk"
 ],
 "amountUsd": 30000,
 "victims": null,
 "startedAt": "2026-03-11",
 "closedAt": "2026-03-12",
 "updatedAt": "2026-03-12T12:00:00Z",
 "summary": "On Mar 11, 2026, attackers who had hijacked a Bonk.fun team account put a wallet drainer on the Solana launchpad's official domain. Visitors were asked to sign a fake terms-of-service message, and those who signed had their wallets drained. The team called losses minimal; SlowMist's database puts them at about $30,000. Only people who signed the fake message on the domain after the hijack were affected. If you signed it, move remaining funds to a new wallet.",
 "timeline": [
  {
   "date": "2026-03-11",
   "title": "Bonk.fun's official domain began serving a drainer behind a fake terms-of-service signature after a team account was hijacked.",
   "sourceUrl": "https://www.theblock.co/post/393345/bonk-fun-hijacked"
  },
  {
   "date": "2026-03-12",
   "title": "The Block reported the team told users not to interact with the website until it was secured; the operator said losses were minimal.",
   "sourceUrl": "https://www.theblock.co/post/393345/bonk-fun-hijacked"
  }
 ],
 "sources": [
  {
   "kind": "news",
   "title": "Bonk.fun's official website hijacked, draining user funds upon interaction",
   "url": "https://www.theblock.co/post/393345/bonk-fun-hijacked",
   "publisher": "The Block",
   "date": "2026-03-12"
  },
  {
   "kind": "advisory",
   "title": "SlowMist Hacked: Solana incidents (BONKfun)",
   "url": "https://hacked.slowmist.io/?c=Solana",
   "publisher": "SlowMist",
   "date": "2026-03-11"
  }
 ],
 "indicators": {
  "domains": [],
  "addresses": []
 },
 "brief": "## Am I affected?\nYou are affected only if you visited the Bonk.fun domain on or after Mar 11, 2026 and signed a 'terms of service' message. Connecting earlier, or trading Bonk tokens on other terminals, was reported as safe.\n\n## What to do now\n- If you signed the message, move remaining assets to a new wallet now.\n- Check the old wallet in an explorer for outgoing transfers, delegates or owner changes you did not make.\n- Wait for the team's official all-clear before using the site again.\n\n## How to avoid this\n- A real site never needs you to sign a 'terms of service' message to move funds. Read every wallet prompt. If it shows transfers or permission changes, cancel.\n- Use a low-balance hot wallet for launchpads and keep savings elsewhere.\n- Keep a wallet with a transaction-preview warning feature turned on. A hijacked official domain looks exactly like the real thing.",
 "notes": null,
 "agentBrief": "# Bonk.fun domain hijacked to serve wallet drainer behind fake terms-of-service prompt\n\n- Severity: High · Status: Partly contained (past)\n- Chains: Solana · Method: Front-end and DNS hijacks\n- Started: Mar 11, 2026 · Last update: Mar 12, 2026 · Reported stolen: $30K\n- Who/what: Bonk.fun launchpad users\n\nOn Mar 11, 2026, attackers who had hijacked a Bonk.fun team account put a wallet drainer on the Solana launchpad's official domain. Visitors were asked to sign a fake terms-of-service message, and those who signed had their wallets drained. The team called losses minimal; SlowMist's database puts them at about $30,000. Only people who signed the fake message on the domain after the hijack were affected. If you signed it, move remaining funds to a new wallet.\n\n## Am I affected?\nYou are affected only if you visited the Bonk.fun domain on or after Mar 11, 2026 and signed a 'terms of service' message. Connecting earlier, or trading Bonk tokens on other terminals, was reported as safe.\n\n## What to do now\n- If you signed the message, move remaining assets to a new wallet now.\n- Check the old wallet in an explorer for outgoing transfers, delegates or owner changes you did not make.\n- Wait for the team's official all-clear before using the site again.\n\n## How to avoid this\n- A real site never needs you to sign a 'terms of service' message to move funds. Read every wallet prompt. If it shows transfers or permission changes, cancel.\n- Use a low-balance hot wallet for launchpads and keep savings elsewhere.\n- Keep a wallet with a transaction-preview warning feature turned on. A hijacked official domain looks exactly like the real thing.\n\n## Sources\n- Bonk.fun's official website hijacked, draining user funds upon interaction (The Block, 2026-03-12): https://www.theblock.co/post/393345/bonk-fun-hijacked\n- SlowMist Hacked: Solana incidents (BONKfun) (SlowMist, 2026-03-11): https://hacked.slowmist.io/?c=Solana\n\nFull record: https://drains.watch/i/bonk-fun-domain-hijack-drainer-mar-2026 · JSON: https://drains.watch/i/bonk-fun-domain-hijack-drainer-mar-2026.json\n\nRules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support."
}