{
 "tag": "bonk-fun",
 "name": "Bonk Fun",
 "group": "Other",
 "incidents": [
  {
   "slug": "bonk-fun-domain-hijack-drainer-mar-2026",
   "title": "Bonk.fun domain hijacked to serve wallet drainer behind fake terms-of-service prompt",
   "url": "https://drains.watch/i/bonk-fun-domain-hijack-drainer-mar-2026",
   "json": "https://drains.watch/i/bonk-fun-domain-hijack-drainer-mar-2026.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "chains": [
    "solana"
   ],
   "method": "front-end-hijack",
   "product": "Bonk.fun launchpad users",
   "tags": [
    "solana",
    "front-end-hijack",
    "bonk-fun",
    "launchpad",
    "domain-hijack",
    "fake-tos",
    "signature-phishing",
    "bonk"
   ],
   "amountUsd": 30000,
   "victims": null,
   "startedAt": "2026-03-11",
   "closedAt": "2026-03-12",
   "updatedAt": "2026-03-12T12:00:00Z",
   "summary": "On Mar 11, 2026, attackers who had hijacked a Bonk.fun team account put a wallet drainer on the Solana launchpad's official domain. Visitors were asked to sign a fake terms-of-service message, and those who signed had their wallets drained. The team called losses minimal; SlowMist's database puts them at about $30,000. Only people who signed the fake message on the domain after the hijack were affected. If you signed it, move remaining funds to a new wallet."
  }
 ],
 "changes": [
  {
   "incident": "bonk-fun-domain-hijack-drainer-mar-2026",
   "incidentTitle": "Bonk.fun domain hijacked to serve wallet drainer behind fake terms-of-service prompt",
   "severity": "high",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-03-12",
   "title": "The Block reported the team told users not to interact with the website until it was secured; the operator said losses were minimal.",
   "sourceUrl": "https://www.theblock.co/post/393345/bonk-fun-hijacked",
   "url": "https://drains.watch/i/bonk-fun-domain-hijack-drainer-mar-2026"
  },
  {
   "incident": "bonk-fun-domain-hijack-drainer-mar-2026",
   "incidentTitle": "Bonk.fun domain hijacked to serve wallet drainer behind fake terms-of-service prompt",
   "severity": "high",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-03-11",
   "title": "Bonk.fun's official domain began serving a drainer behind a fake terms-of-service signature after a team account was hijacked.",
   "sourceUrl": "https://www.theblock.co/post/393345/bonk-fun-hijacked",
   "url": "https://drains.watch/i/bonk-fun-domain-hijack-drainer-mar-2026"
  }
 ]
}