Bonk.fun Hack Exposes Solana Users to Wallet Drainer Attack

TheNewsCryptoPublicado a 2026-03-12Actualizado a 2026-03-12

Resumen

A security vulnerability on the Bonk.fun platform exposed Solana users to wallet drainer attacks. Malicious scripts were injected into the site, redirecting users to phishing pages that prompted them to approve transactions. These approvals allowed attackers to automatically drain tokens from users' wallets. The platform, which is used for meme token trading, was compromised, and users were deceived through fake reward claims and interface changes. Bonk.fun issued a warning on X, advising users not to interact with the site until it was secured. The developer team acted quickly to remove the malicious scripts and urged users to revoke any suspicious approvals. The incident raised concerns in the crypto community, though the prompt response helped mitigate potential damage.

The security vulnerability on Bonk.fun allowed malicious wallet drainer links to affect users who were not aware of the danger. Additionally, security experts detected the vulnerability after users encountered suspicious approval prompts while interacting with the Bonk.fun platform. The attacker injected malicious scripts to redirect users to phishing sites that demanded approvals from their connected wallets. These approvals allowed the malicious programs to drain the users’ tokens automatically from their wallets to the attacker’s addresses.

The exploit raised several concerns in the Solana ecosystem. The Bonk.fun is a site that interacts with the trading of meme tokens and the Decentralized Finance community. The attackers tried to deceive users by mimicking reward claims and token distribution through malicious interface changes. After the users accepted the request, the drainer would drain the assets from the users’ wallets within a matter of seconds.

The official X post of Bonk.fun said, “A malicious actor has compromised the BONKfun domain. Do not interact with the website until we have secured everything.”

Platform Response and Community Warnings

The developer community reacted quickly after the news became public. And immediately removed the malicious scripts that affected the Bonk.fun interface. The developer team immediately reviewed all integrations and external scripts associated with the interface that attackers might have exploited. The platform operators immediately alerted users to revoke any approvals made by malicious tokens. And to avoid clicking on unknown links shared in crypto-related groups. Blockchain investigators are closely monitoring the attacker’s wallets and all transactions associated with the exploit campaign.

Tom, the operator of Bonk.fun explained the issue on his X post. He expressed his answers saying, “We understand a lot of people are scared and rightly so, but we’re doing everything in our power to fix the situation.”

The crypto market took the incident seriously, as security vulnerabilities are a major concern for investors and affect the overall market sentiment. Meanwhile, market sentiment toward new meme token markets remained cautious. However, analysts argued that the quick response from the developer community could help limit potential damage. The potential damage that might be caused by a security incident involving a decentralized interface. The users of the Bonk interface alerted each other through social media networks, warning them of the phishing approvals that are being made by malicious tokens associated with the interface.

Highlighted Crypto News:

Metaplanet Launches Venture Arm to Expand Bitcoin Ecosystem Amid Market Volatility

TagsBlockchainBONKsecuritySolanaSolana (SOL)

Preguntas relacionadas

QWhat was the security vulnerability on Bonk.fun that affected Solana users?

AThe security vulnerability on Bonk.fun allowed malicious wallet drainer links to be injected, which redirected users to phishing sites. These sites then prompted users for approvals from their connected wallets, enabling malicious programs to automatically drain tokens from their wallets to the attacker's addresses.

QHow did the attackers deceive users on the Bonk.fun platform?

AThe attackers deceived users by mimicking reward claims and token distribution through malicious interface changes. After users accepted the approval requests, the drainer would drain the assets from their wallets within seconds.

QWhat was the official response from Bonk.fun regarding the domain compromise?

AThe official X post of Bonk.fun warned users, stating: 'A malicious actor has compromised the BONKfun domain. Do not interact with the website until we have secured everything.'

QWhat actions did the developer community take after the Bonk.fun exploit was discovered?

AThe developer community quickly removed the malicious scripts affecting the Bonk.fun interface, reviewed all integrations and external scripts for potential exploits, and alerted users to revoke any approvals made by malicious tokens and avoid clicking on unknown links.

QHow did the crypto market and community react to the Bonk.fun security incident?

AThe crypto market took the incident seriously as security vulnerabilities are a major concern for investors, affecting overall market sentiment. Users alerted each other through social media networks about phishing approvals, while analysts noted that the quick response from developers helped limit potential damage.

Lecturas Relacionadas

Agent Race Ends, Super Workbench Takes Over

The era of fragmented AI agents is ending. Over the past month, China's tech giants—Tencent, Alibaba, and ByteDance—have simultaneously shifted strategy: instead of launching new, standalone AI agents, they are consolidating their various agent projects into unified "super workbenches." Tencent integrated its QClaw teams into WorkBuddy, a strategic product hailed as a potential third flagship after QQ and WeChat. Alibaba is merging its QoderWork, Wukong, and MuleRun agents into a new "Qianwen Office" platform under DingTalk's leadership. ByteDance rebranded its TRAE SOLO coding agent to TRAE Work, signaling a broader focus on workflow collaboration. This convergence marks a pivotal industry consensus. The initial exploration phase, where companies rapidly built numerous overlapping agents for different scenarios, proved costly and inefficient. With open-source tools eroding technical barriers, competition has shifted from agent creation to resource consolidation and cost control. Historically, platform wars are won not by creating more products, but by simplifying them—as seen with browsers unifying web access and super-apps consolidating services. Now, the "super workbench" aims to become the unified AI entry point for work. This reflects a deeper market realization: the primary audience for AI is no longer just programmers (a market in the tens of millions) but all knowledge workers (a market of billions). The real opportunity lies in augmenting everyday tasks—managing emails, documents, data, and meetings—across the entire workday. The core battleground is becoming control over the primary AI entry point that employees use daily. Tencent's WorkBuddy leverages WeChat and Tencent Docs; Alibaba's Qianwen Office taps into DingTalk's organizational data; ByteDance's TRAE Work integrates with Feishu's workflows. Whoever owns this "super workbench" gains strategic control over orchestrating enterprise data and APIs. This shift is redefining enterprise software. Traditional SaaS applications, valued for their user interfaces, will recede into the background. Their core functionalities will be exposed as standardized "Skills" or APIs for the super workbench's agents to invoke. Software value will shift from selling user seats to charging based on API calls and outcomes delivered. The evolution of agents is moving through clear stages: first as novel standalone products, then as consolidated primary work entry points, and finally as pervasive, invisible capabilities embedded into the digital fabric. The recent moves by major tech firms signal the transition from the first stage into the second, accelerating toward the third. In the end, the most successful agent technology may become invisible—like electricity or the HTTP protocol—a fundamental, unnamed infrastructure powering work itself.

marsbitHace 9 min(s)

Agent Race Ends, Super Workbench Takes Over

marsbitHace 9 min(s)

Michael Saylor: 110 Reasons to Oppose BIP-110

Michael Saylor presents 110 arguments against Bitcoin Improvement Proposal (BIP) 110, a soft fork aimed at restricting certain non-monetary data storage uses (like inscriptions) on the Bitcoin blockchain. He acknowledges the proponents' valid concerns—such as node costs, fee pressure, and preserving Bitcoin's monetary focus—but fundamentally disagrees with the proposed solution. Saylor argues that BIP 110 represents a dangerous precedent of using consensus rules to enforce value judgments on transaction validity, moving away from Bitcoin's core principles of neutrality and permissionless innovation. His key objections are organized into eleven categories: 1) It violates neutrality and hard consensus by banning currently valid transactions. 2) It fails to meet the high burden of proof required for a consensus change, lacking concrete data on the alleged crisis. 3) Its seven bundled technical restrictions are overly broad, targeting generic script functionalities and blocking future upgrade paths. 4) It sacrifices compatibility and future optionality by closing off designed upgrade hooks. 5) Its temporary rules add significant complexity (grandfathering, expiry states) without sufficient justification. 6) The economic and security impacts, particularly on miner revenue and fee markets, are uncertain and unmodeled. 7) Superior, market-based tools (fee markets, relay/mining policies) already exist to manage blockchain load. 8) It stifles innovation by creating a chilling effect for developers. 9) Its modified activation mechanism (55% threshold, forced signaling) is aggressive and risks network splits. 10) The precedent it sets—using consensus to suppress disliked but legal uses—is more dangerous than the problem it aims to solve. 11) A better path exists: improving measurements, refining resource-based policies, and allowing market forces to work. Saylor concludes that Bitcoin's strength lies in its neutral rules, open markets, and hard consensus. Changing these foundational elements to target specific use cases is an unnecessary and risky "iatrogenic" intervention. He advocates for guarding Bitcoin's neutrality rather than acting as its redeemer.

marsbitHace 25 min(s)

Michael Saylor: 110 Reasons to Oppose BIP-110

marsbitHace 25 min(s)

Trading

Spot
活动图片