In brief
- The Bonk.fun team is urging users not to visit the site after hackers compromised a team account and pushed a wallet-draining phishing prompt through the domain.
- The attack has targeted users who signed a fake terms-of-service message after the breach, according to the platform’s operator.
- Browser security systems later flagged the site for suspected phishing, while the team said losses appear limited because the issue was detected quickly.
Hackers hijacked the domain of the Solana-based token launch platform Bonk.fun on Wednesday, prompting the team to warn users not to interact with the site after attackers deployed a wallet-draining phishing message.
An operator associated with Bonk.fun, known as Tom, said in a post on X that a team account had been compromised, allowing attackers to push a malicious prompt through the bonk.fun domain.
The prompt reportedly asked users to sign a fake terms-of-service message designed to authorize transactions that could drain connected crypto wallets.
Phishing attacks remain a persistent threat in crypto, where malicious websites and wallet-signing prompts can give attackers direct access to users’ funds if approved.
“Do not use the bonk.fun domain until further notice,” Tom wrote. “Hackers have hijacked a team account, forcing a drainer on the domain.”
Visitors attempting to access the site late Wednesday were met with browser security warnings flagging the page for suspected phishing, Decrypt confirmed.
The team said the attack targeted only users who interacted with the malicious prompt after the compromise. According to Bonk.fun, users who had previously connected their wallets to the site or who traded tokens launched through the platform on external terminals are not affected.
“The only people affected were people who signed a fake TOS message on the bonkfun domain after the incident,” Tom said in a follow-up post. He added that the issue was detected quickly and that warnings spread across social media soon after the incident, limiting potential losses.
“We understand a lot of people are scared and rightly so,” he wrote. “We’re doing everything in our power to fix the situation.”
Bonk.fun did not immediately disclose how many users may have signed the malicious transaction or the estimated value of funds lost.
The platform has operated for roughly eight months and is part of the broader Bonk ecosystem built on the Solana blockchain.
A representative did not immediately respond to Decrypt’s request for comment.
Disclaimer: The information on this page may come from third parties and does not represent the views or opinions of Gate. The content displayed on this page is for reference only and does not constitute any financial, investment, or legal advice. Gate does not guarantee the accuracy or completeness of the information and shall not be liable for any losses arising from the use of this information. Virtual asset investments carry high risks and are subject to significant price volatility. You may lose all of your invested principal. Please fully understand the relevant risks and make prudent decisions based on your own financial situation and risk tolerance. For details, please refer to
Disclaimer.
Related Articles
Crypto Hacks Fuel Wall Street Tokenization Debate
High-profile crypto exploits test DeFi risk yet unlikely derail tokenization; institutions favor permissioned chains, while broader tokenization must interoperate with DeFi; stablecoins face scrutiny and possible regulatory backlash.
CryptoFrontier3h ago
Volo Protocol Loses $3.5M in Sui Hack, Commits to Absorb Losses and Freeze Hacker Funds
Gate News message, April 22 — Volo Protocol, a yield vault operator on Sui, announced yesterday (April 21) that it has begun freezing stolen assets following a $3.5 million exploit. Hackers looted WBTC, XAUm, and USDG from Volo Vaults, marking the latest major DeFi security breach in a
GateNews6h ago
French Family Forced to Transfer $820K in Crypto After Armed Home Invasion
Gate News message, April 22 — A family in Ploudalmézeau, a small town in Brittany, France, was invaded by two armed masked men on Monday (April 20), according to reporting by The Block. Three adults were bound for over three hours and forced to transfer approximately 700,000 euros (about $820,000) i
GateNews7h ago
DOJ Launches Compensation Process for OneCoin Fraud Victims, $40M+ in Recovered Assets Available
Gate News message, April 22 — The U.S. Department of Justice has announced the launch of a compensation process for victims of the OneCoin cryptocurrency fraud scheme, with more than $40 million in recovered assets now available for distribution.
The scheme, operated between 2014 and 2019 by Ruja
GateNews9h ago
AI16Z, ELIZAOS Creators Sued Over $2.6B Fraud Allegations; Token Crashes 99.9% From Peak
Federal class action accuses AI16Z/ELIZAOS of a $2.6B crypto fraud via fake AI claims and deceptive marketing, alleging insider favoritism and a staged autonomous system; seeks damages under consumer protection laws.
Abstract: This report covers a SDNY federal class-action filed April 21 accusing AI16Z and its rebrand ELIZAOS of a $2.6 billion crypto fraud involving fake AI claims and deceptive marketing. The suit alleges a manufactured link with Andreessen Horowitz and a non-autonomous system. It details a peak valuation in early 2025, a 99.9% crash, and about 4,000 losing wallets, with insiders receiving ~40% of new tokens. Plaintiffs seek damages and equitable relief under New York and California consumer-protection laws. Regulators in Korea and major exchanges have warned or suspended related trading.
GateNews10h ago
SlowMist Alerts: Active MacSync Stealer macOS Malware Targeting Crypto Users
SlowMist warns of MacSync Stealer (v1.1.2) for macOS that steals wallets, credentials, keychains, and infra keys, using spoofed AppleScript prompts and fake 'unsupported' errors; urges caution and awareness of IOCs.
Abstract: This report summarizes SlowMist's alert about MacSync Stealer (v1.1.2), a macOS information stealer targeting cryptocurrency wallets, browser credentials, system keychains, and infrastructure keys (SSH, AWS, Kubernetes). It deceives users with spoofed AppleScript dialogs prompting for passwords and visible fake 'unsupported' messages. SlowMist provides IOCs to customers and advises avoiding unverified macOS scripts and remaining vigilant for unusual password prompts.
GateNews11h ago
