Hackers Hijack Bonk.fun Domain, Deploy Wallet-Draining Phishing Prompt

Hackers hijacked the domain of the Solana-based token launch platform Bonk.fun on Wednesday, prompting the team to warn users not to interact with the site after attackers deployed a wallet-draining phishing message.

An operator associated with Bonk.fun, known as Tom, said in a post on X that a team account had been compromised, allowing attackers to push a malicious prompt through the bonk.fun domain. 

The prompt reportedly asked users to sign a fake terms-of-service message designed to authorize transactions that could drain connected crypto wallets.

Phishing attacks remain a persistent threat in crypto, where malicious websites and wallet-signing prompts can give attackers direct access to users’ funds if approved.

“Do not use the bonk.fun domain until further notice,” Tom wrote. “Hackers have hijacked a team account, forcing a drainer on the domain.”

Visitors attempting to access the site late Wednesday were met with browser security warnings flagging the page for suspected phishing, Decrypt confirmed.

The team said the attack targeted only users who interacted with the malicious prompt after the compromise. According to Bonk.fun, users who had previously connected their wallets to the site or who traded tokens launched through the platform on external terminals are not affected.

“The only people affected were people who signed a fake TOS message on the bonkfun domain after the incident,” Tom said in a follow-up post. He added that the issue was detected quickly and that warnings spread across social media soon after the incident, limiting potential losses.

“We understand a lot of people are scared and rightly so,” he wrote. “We’re doing everything in our power to fix the situation.”

Bonk.fun did not immediately disclose how many users may have signed the malicious transaction or the estimated value of funds lost.

The platform has operated for roughly eight months and is part of the broader Bonk ecosystem built on the Solana blockchain.

A representative did not immediately respond to Decrypt’s request for comment.