# Bonk.fun domain hijacked to serve wallet drainer behind fake terms-of-service prompt

- Severity: High · Status: Partly contained (past)
- Chains: Solana · Method: Front-end and DNS hijacks
- Started: Mar 11, 2026 · Last update: Mar 12, 2026 · Reported stolen: $30K
- Who/what: Bonk.fun launchpad users

On Mar 11, 2026, attackers who had hijacked a Bonk.fun team account put a wallet drainer on the Solana launchpad's official domain. Visitors were asked to sign a fake terms-of-service message, and those who signed had their wallets drained. The team called losses minimal; SlowMist's database puts them at about $30,000. Only people who signed the fake message on the domain after the hijack were affected. If you signed it, move remaining funds to a new wallet.

## Am I affected?
You are affected only if you visited the Bonk.fun domain on or after Mar 11, 2026 and signed a 'terms of service' message. Connecting earlier, or trading Bonk tokens on other terminals, was reported as safe.

## What to do now
- If you signed the message, move remaining assets to a new wallet now.
- Check the old wallet in an explorer for outgoing transfers, delegates or owner changes you did not make.
- Wait for the team's official all-clear before using the site again.

## How to avoid this
- A real site never needs you to sign a 'terms of service' message to move funds. Read every wallet prompt. If it shows transfers or permission changes, cancel.
- Use a low-balance hot wallet for launchpads and keep savings elsewhere.
- Keep a wallet with a transaction-preview warning feature turned on. A hijacked official domain looks exactly like the real thing.

## Sources
- Bonk.fun's official website hijacked, draining user funds upon interaction (The Block, 2026-03-12): https://www.theblock.co/post/393345/bonk-fun-hijacked
- SlowMist Hacked: Solana incidents (BONKfun) (SlowMist, 2026-03-11): https://hacked.slowmist.io/?c=Solana

Full record: https://drains.watch/i/bonk-fun-domain-hijack-drainer-mar-2026 · JSON: https://drains.watch/i/bonk-fun-domain-hijack-drainer-mar-2026.json

Rules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support.