Bonk.fun Hack Exposes Solana Users to Wallet Drainer Attack

TheNewsCryptoPublished on 2026-03-12Last updated on 2026-03-12

Abstract

A security vulnerability on the Bonk.fun platform exposed Solana users to wallet drainer attacks. Malicious scripts were injected into the site, redirecting users to phishing pages that prompted them to approve transactions. These approvals allowed attackers to automatically drain tokens from users' wallets. The platform, which is used for meme token trading, was compromised, and users were deceived through fake reward claims and interface changes. Bonk.fun issued a warning on X, advising users not to interact with the site until it was secured. The developer team acted quickly to remove the malicious scripts and urged users to revoke any suspicious approvals. The incident raised concerns in the crypto community, though the prompt response helped mitigate potential damage.

The security vulnerability on Bonk.fun allowed malicious wallet drainer links to affect users who were not aware of the danger. Additionally, security experts detected the vulnerability after users encountered suspicious approval prompts while interacting with the Bonk.fun platform. The attacker injected malicious scripts to redirect users to phishing sites that demanded approvals from their connected wallets. These approvals allowed the malicious programs to drain the users’ tokens automatically from their wallets to the attacker’s addresses.

The exploit raised several concerns in the Solana ecosystem. The Bonk.fun is a site that interacts with the trading of meme tokens and the Decentralized Finance community. The attackers tried to deceive users by mimicking reward claims and token distribution through malicious interface changes. After the users accepted the request, the drainer would drain the assets from the users’ wallets within a matter of seconds.

The official X post of Bonk.fun said, “A malicious actor has compromised the BONKfun domain. Do not interact with the website until we have secured everything.”

Platform Response and Community Warnings

The developer community reacted quickly after the news became public. And immediately removed the malicious scripts that affected the Bonk.fun interface. The developer team immediately reviewed all integrations and external scripts associated with the interface that attackers might have exploited. The platform operators immediately alerted users to revoke any approvals made by malicious tokens. And to avoid clicking on unknown links shared in crypto-related groups. Blockchain investigators are closely monitoring the attacker’s wallets and all transactions associated with the exploit campaign.

Tom, the operator of Bonk.fun explained the issue on his X post. He expressed his answers saying, “We understand a lot of people are scared and rightly so, but we’re doing everything in our power to fix the situation.”

The crypto market took the incident seriously, as security vulnerabilities are a major concern for investors and affect the overall market sentiment. Meanwhile, market sentiment toward new meme token markets remained cautious. However, analysts argued that the quick response from the developer community could help limit potential damage. The potential damage that might be caused by a security incident involving a decentralized interface. The users of the Bonk interface alerted each other through social media networks, warning them of the phishing approvals that are being made by malicious tokens associated with the interface.

Highlighted Crypto News:

Metaplanet Launches Venture Arm to Expand Bitcoin Ecosystem Amid Market Volatility

TagsBlockchainBONKsecuritySolanaSolana (SOL)

Related Questions

QWhat was the security vulnerability on Bonk.fun that affected Solana users?

AThe security vulnerability on Bonk.fun allowed malicious wallet drainer links to be injected, which redirected users to phishing sites. These sites then prompted users for approvals from their connected wallets, enabling malicious programs to automatically drain tokens from their wallets to the attacker's addresses.

QHow did the attackers deceive users on the Bonk.fun platform?

AThe attackers deceived users by mimicking reward claims and token distribution through malicious interface changes. After users accepted the approval requests, the drainer would drain the assets from their wallets within seconds.

QWhat was the official response from Bonk.fun regarding the domain compromise?

AThe official X post of Bonk.fun warned users, stating: 'A malicious actor has compromised the BONKfun domain. Do not interact with the website until we have secured everything.'

QWhat actions did the developer community take after the Bonk.fun exploit was discovered?

AThe developer community quickly removed the malicious scripts affecting the Bonk.fun interface, reviewed all integrations and external scripts for potential exploits, and alerted users to revoke any approvals made by malicious tokens and avoid clicking on unknown links.

QHow did the crypto market and community react to the Bonk.fun security incident?

AThe crypto market took the incident seriously as security vulnerabilities are a major concern for investors, affecting overall market sentiment. Users alerted each other through social media networks about phishing approvals, while analysts noted that the quick response from developers helped limit potential damage.

Related Reads

TechFlow Intelligence Bureau: Chip Stocks Lose Trillions in a Single Day, Bitcoin Falls Below $60,000, US-Iran Conflict Escalates

**Daily Tech & Markets Roundup: AI Advances, Market Turmoil, and Geopolitical Tensions** **AI / LLMs**: Anthropic's internal report on AI self-improvement sparked serious discussions about Recursive Self-Improvement (RSI). Meanwhile, debate continues on AI coding tools after Claude was accused of introducing bugs into the rsync codebase. In positive news, DeepSeek V4 Flash impressed in local deployment tests, and GitHub Copilot now supports custom endpoints for local models. A surprising research turn suggests removing chain-of-thought prompting can sometimes improve LLM performance. **Crypto / Web3**: Bitcoin plunged below $60,000, with its RSI hitting levels last seen during the COVID-19 crash, driven by strong U.S. jobs data reviving interest rate hike fears. Discussions highlight Ethereum DeFi's continued lack of a smooth consumer payment layer. **Chips / Hardware**: Chip stocks suffered a massive sell-off, with the Philadelphia Semiconductor Index posting its worst single-day drop in six years, erasing over a trillion dollars in value. Marvell, Micron, AMD, and Intel were among the biggest losers. **Tech Companies**: A leaked Microsoft document revealing goals to make Copilot "addictive" drew criticism. LinkedIn founder Reid Hoffman left Microsoft's board to focus full-time on his AI agent startup, Manus. Google was revealed to be paying SpaceX $920 million monthly for AI training compute. **Markets & Macro**: A blowout U.S. jobs report (172k vs. 80k expected) crushed hopes for near-term rate cuts, sending Treasury yields soaring and triggering a broad market sell-off. CEOs from Kraft, McDonald's, and Whirlpool simultaneously warned U.S. consumers are exhausting their savings. **Geopolitics**: U.S.-Iran tensions escalated with missile/drone interceptions and U.S. strikes on Iranian radar sites, keeping the critical Strait of Hormuz largely closed since late February and posing ongoing oil supply risks. **The Bottom Line**: The strong jobs data acted as a single trigger for correlated sell-offs across equities, crypto, and chips. Underlying the volatility is a stark contradiction between robust employment data and warnings of consumer weakness, alongside geopolitical risks that could reignite inflation, leaving markets to price in a fraught macro outlook with no clear "soft landing" path.

marsbit19m ago

TechFlow Intelligence Bureau: Chip Stocks Lose Trillions in a Single Day, Bitcoin Falls Below $60,000, US-Iran Conflict Escalates

marsbit19m ago

It Took Me a Year to See the Bitter Truth About Agent Payments

After a year building infrastructure for the Agent economy, engaging with major players like Stripe, Visa, and Coinbase, the author shares a sobering analysis of the current state of Agent payments. The core finding is a stark lack of genuine, immediate demand across most envisioned use cases. The article breaks down four key market segments: 1. **Agent-to-Merchant (Consumer Shopping):** For most product categories (e.g., clothing, electronics), conversational AI shopping is a step backwards from visual e-commerce interfaces. While agents excel at understanding needs, they can't replace side-by-side product comparison. Real merchant interest is defensive "Agent Engine Optimization," not driven by current customer demand. Potential exists for high-frequency, low-decision purchases (like food delivery) or navigating complex store UIs, but these require massive B2C distribution channels dominated by giants like Amazon. 2. **Agent-to-API (Developer Services):** Developers already have subscriptions and billing relationships for APIs (compute, data). Prepaid balances solve micro-payment issues for low transaction volumes. A deeper structural problem is that major SaaS vendors' business models rely on enterprise contracts, resisting granular pay-per-call pricing. While protocols like MPP and x402 serve the long tail of niche services, this market is small and developers are historically low-willingness-to-pay. 3. **Agent-to-Agent:** This remains largely theoretical with minimal transaction volume. While it represents a long-term bet on a fundamentally new transaction infrastructure (sub-second, micro-penny to million-dollar, multi-party settlements), it does not constitute a present market. 4. **Agent-to-Finance:** This is the only category with existing, paying demand. Integrating AI into financial workflows (trading, portfolio management) is a natural evolution and enables new capabilities like autonomous rebalancing. However, competition favors established, regulated institutions. The "real problem" is not moving money between agents, but the broader challenge of **coordination**—orchestrating work between agents and humans, verifying outcomes, and settling results. Payment is just one component of settlement, which is itself part of coordination. Companies that solve the coordination layer will subsume payment, not the other way around. While well-funded incumbents build defensively for a long-term future, startups must find where the market is today—which, for the author's team, lies outside these four categories in an area of real, growing, and underserved activity.

marsbit1h ago

It Took Me a Year to See the Bitter Truth About Agent Payments

marsbit1h ago

It Took Me a Year to See the Hard Truth About Agent Payments

**Title: It Took Me a Year to See the Hard Truth About Agent Payments** Over the past year, I've worked on infrastructure for the Agent economy, engaging with major players like Stripe, Visa, Coinbase, and numerous startups. The findings reveal a stark reality: genuine, widespread demand for Agent-based payments does not yet exist. **Key Observations:** * **Agent-to-Merchant (Shopping):** The user experience for AI shopping often falls short, especially for visual product discovery. While AI excels at understanding needs, conversational interfaces can't yet replace browsing and comparing multiple products visually. Current merchant interest is largely defensive ("Agent Engine Optimization") for a future that hasn't arrived. High-frequency, low-friction purchases (like food delivery) are potential fits, but lack open APIs and face high AI inference costs. Simpler, more affordable, or cross-language interactions for complex UIs are a niche opportunity but require massive consumer distribution to scale. * **Agent-to-API (Developer Tools):** Developer payment needs for APIs (computing, data, models) are already met through subscriptions and prepaid credits. The core challenge is not payment friction but supplier economics: most large SaaS providers prefer enterprise contracts over micropayments for API calls. Protocols like MPP and x402 suit the long-tail of smaller services but cater to a developer market historically reluctant to pay for these tools. Major infrastructure needs at the top of the stack are already being addressed. * **Agent-to-Agent (Machine Commerce):** This is a long-term vision with almost no current transaction volume. While a future with high-speed, high-frequency, multi-party machine-to-machine transactions would require novel infrastructure, it remains theoretical. The market is not here yet. * **Agent-to-Finance:** This is the only category with clear, present demand. Financial professionals and DeFi users already pay for tools, and AI augmentation is a natural evolution. Autonomous AI agents can enable entirely new financial strategies. However, competition is fierce from established, regulated incumbents who can more easily layer AI onto their existing products. **The Core Insight:** Companies, especially giants with long time horizons, are building defensively for a potential future of mass machine commerce. For them, early investment is a low-cost hedge. For startups, the current market reality is different. The primary challenge isn't just moving money between agents (payments). The larger, unsolved problem is **orchestration** – coordinating work between agents and humans, verifying outcomes, and then settling. Payment is just a part of settlement, which is just a part of orchestration. Companies that solve the orchestration problem will subsume payments, not the other way around. After a year of building, we see the real, growing, and underserved market opportunity lies in this broader domain of orchestration.

链捕手1h ago

It Took Me a Year to See the Hard Truth About Agent Payments

链捕手1h ago

Claude Opus 4.8 Finds a $4.5 Billion Bug: The AI Era is Mass-Producing Hackers

A researcher discovered a critical "infinite mint" vulnerability in the Zcash cryptocurrency's Orchard protocol using Claude Opus 4.8, leading to a swift fix but also a 50% market drop, erasing billions in value. This incident highlights a new era where powerful, accessible AI models are dramatically lowering the barrier to finding software vulnerabilities. Previously, the security community feared specialized models like Claude Mythos Preview, capable of finding decades-old zero-day exploits. The Zcash case, however, involved a publicly available, general-purpose model. This shift makes advanced security auditing—and attack capabilities—accessible to far more people, not just experts. The mass democratization of vulnerability discovery brings a dual challenge: a flood of low-quality, AI-generated false reports that overwhelm maintainers, and the real, rapid uncovering of deep, dangerous bugs. Open-source projects, often understaffed and unfunded, are particularly vulnerable to this "attention DDoS." The article cites examples like curl shutting down its bug bounty program due to the unsustainable workload. Our perceived digital safety has often been luck, relying on the high cost and effort required to find deeply hidden flaws in complex systems, as seen with historical vulnerabilities like Heartbleed or Baron Samedit. AI changes this cost structure, effectively "mass-producing flashlights" to illuminate every corner of our codebase. While large companies operate extensive security chains involving external white-hat hackers and massive defensive operations, the global cybersecurity workforce faces a severe shortage, especially of experienced personnel capable of analyzing complex threats and coordinating fixes. The core dilemma emerges: AI makes *finding* bugs cheap and scalable, but *fixing* them remains a slow, expensive, and human-intensive process. The article concludes that AI won't destroy the internet but acts as a bright light, revealing that our digital existence is not inherently secure but is precariously maintained by ongoing human effort. The true cost in the AI era may not be discovery, but whether there will be enough people left willing and able to do the hard work of repair.

marsbit1h ago

Claude Opus 4.8 Finds a $4.5 Billion Bug: The AI Era is Mass-Producing Hackers

marsbit1h ago

Trading

Spot
Futures
活动图片