Crypto Warning: Bonk.fun Domain Hack Exposes Solana Traders To Wallet Drain

bitcoinist2026-03-14 tarihinde yayınlandı2026-03-14 tarihinde güncellendi

Özet

Crypto platform Bonk.fun suffered a domain hijacking attack on March 12, 2026, exposing users to a wallet-draining exploit. Hackers injected a malicious script on the website, prompting users to sign a fake "Terms of Service" agreement, which, when approved, allowed the attackers to steal funds. The team confirmed that only users who interacted with the fraudulent prompt after the hack were affected, and losses were reported as minimal. The breach was attributed to a Web2 infrastructure failure rather than a smart contract exploit. This incident highlights the growing threat of approval-phishing and domain hijacking attacks in the crypto space, underscoring the need for heightened user caution and improved security practices.

A Crypto platform confirmed that their main domain website had been hacked, which exposed its users to a wallet draining exploit.

A No-Fun Crypto Hijack

It is a truth universally acknowledge that, no matter the size of a global geopolitical crisis, hackers will continue to ravage through the crypto market. This time, the victim was memecoin issuance platform Bonk.fun. In a March 12 post on the social network X, Tom (@SolportTom), one of its operators, warned the users not to interact with the domain “until further notice”, as hackers had injected a crypto wallet drainer on it:

The official X account of the Solana token launchpad, backed by Raydium and the BONK community, also announced the hack and echoed Tom’s striking warning:

Who Is Affected And How

Tom explained that the phishing scam set up a fake “Terms of Services” (TOS) signature prompt which, when signed, allowed the drainer to move the unaware user’s funds. According to Tom, the only users compromised were the ones who interacted with the fake TOS. He clarified that neither previously connected users nor traders of bonk fun tokens on third-party terminals were affected. He also assured that the security breach was spotted early so “the losses are minimal to date”:

This is not a Raydium or BONK smart contract exploit, but the case of a Web2 infrastructure failure that bled directly into Web3. This type of domain hijacking and phishing drainer scripts work by the attackers taking over the frontend and presenting normal-looking prompts that abuse wallet approvals.

A Pattern Of Exploited Vulnerabilities

In recent years, approval-phishing and “fake UI” attacks have stolen billions of dollars: one Chainalysis investigation reported the amount of $14 billion in on-chain scam inflows in 2025, with projections pointing above the $17 billion as more wallets continued to be identified.

As scam revenues grow and AI‐driven impersonation scales, crypto security in 2026 is less about the perfect code and more about defending everything around it: from domains to social accounts, employees and users decision-making. In February last year, attackers hijacked Pump.fun’s X account to push a fake PUMP token, as covered by our sister website NewsBTC. Not too long ago, OG trader Sillytuna was drove out of the crypto market after a multimillion-dollar theft that combined online address poisoning and offline violent actions.

The times are testing traders online and offline, both inside and outside the bloc. As the crypto landscape grows more complex, traders would do well to heighten their caution: prefer direct contract interaction or trusted aggregators, and use tools to monitor and regularly revoke token approvals.

SOL’s price trends to the upside on the daily chart. Source: SOLUSDT on Tradingview

Cover image from Perplexity, SOLUSDT chart from Tradingview

İlgili Sorular

QWhat was the main security incident that occurred with Bonk.fun?

AThe main domain of Bonk.fun was hacked, and a wallet drainer was injected into the website, exposing users to a phishing scam.

QHow did the wallet drainer on Bonk.fun's compromised domain work?

AThe drainer set up a fake 'Terms of Services' (TOS) signature prompt. When users signed this prompt, it allowed the attacker to move their funds.

QAccording to the article, which users were affected by this security breach?

AOnly users who interacted with the fake TOS message on the compromised Bonk.fun domain after the hack were affected. Previously connected users and those trading on third-party terminals were not compromised.

QWhat type of exploit was this incident classified as, and what was its root cause?

AThis was not a smart contract exploit. It was a Web2 infrastructure failure (domain hijacking) that led to a Web3 phishing attack, where the frontend was compromised to present malicious prompts.

QWhat broader trend in crypto scams does the article mention, and what was a key statistic provided?

AThe article mentions that approval-phishing and 'fake UI' attacks have become a major trend. A Chainalysis investigation reported $14 billion in on-chain scam inflows in 2025, with projections exceeding $17 billion.

İlgili Okumalar

A 'Overlooked' Market Event: Joint US-Japan-South Korea Intervention, Rare US Treasury Involvement, and Bessent's Quiet 'Market Rescue'?

Summary: The United States, Japan, and South Korea executed their largest coordinated foreign exchange intervention in nearly 30 years. The action targeted depreciation pressure on the Japanese yen and South Korean won. This move is seen as a significant effort by the US to stabilize the financial markets of its key allies and prevent the spillover of risks. Key details: * Japan reportedly intervened on July 30 using approximately 8.45 trillion yen (about $52.8 billion). South Korean authorities also intervened that day, selling dollars to support the won. * Notably, the US Treasury Department intervened directly in yen markets for the first time in roughly 30 years. The New York Fed, reportedly acting on behalf of the Treasury, sold euros to buy yen via Goldman Sachs and Morgan Stanley on July 31. Analysts view the use of the euro-yen pair as a way to alleviate yen pressure without adding selling pressure to the US dollar. * Prior to the action, the New York Fed conducted "rate checks" on both USD/JPY and EUR/JPY, a newer signaling tool that falls between verbal and physical intervention. The intervention is interpreted as going beyond traditional currency stabilization. Analysts, such as Michael Hartnett of Bank of America, suggest it resembles a "Price Keeping Operation" for the AI era. The core US objectives are perceived to be: 1. Preventing rapid yen depreciation from triggering a sharp rise in Japanese government bond yields. 2. Containing financial stress from spreading across Asian markets like South Korea and Japan. 3. Reducing the risk of disorderly capital flows impacting the US bond market. This coordinated action underscores the importance of Japan and South Korea as critical partners in the US semiconductor and AI supply chain. Stabilizing their financial markets is seen as vital to mitigating risks to the broader tech industry and the US market itself. The intervention coincides with market pressures, including the KOSDAQ index hitting a low since October 2022. While seen as a move to control volatility, some analysts caution it may not fundamentally reverse existing market trends.

marsbit2 dk önce

A 'Overlooked' Market Event: Joint US-Japan-South Korea Intervention, Rare US Treasury Involvement, and Bessent's Quiet 'Market Rescue'?

marsbit2 dk önce

Will the Federal Reserve Definitely Raise Interest Rates in September? How Will Cryptocurrencies and US Stocks Bear the Pressure?

In early August 2024, market expectations for a September Federal Reserve rate hike surged dramatically, from below 50% to over 80%, driven by renewed inflation concerns. This shift followed a contentious July FOMC meeting where a 9-3 vote to hold rates revealed a growing hawkish faction advocating for an immediate hike, citing prolonged above-target inflation. The key catalyst is escalating conflict near the Strait of Hormuz, which has pushed oil prices up approximately 20% in July, threatening to reignite inflation. The next critical data point is the July CPI report on August 12th; a hot reading could solidify hike expectations. For crypto assets, particularly Bitcoin, this represents near-term pressure. Bitcoin continues to exhibit high-beta, risk-on characteristics, making it sensitive to tightening liquidity and higher opportunity costs. However, historical precedent suggests that if a hike is perceived as the cycle's end rather than its start, the negative impact may be brief, with markets quickly pivoting to anticipate future rate cuts. U.S. stocks, especially crypto-linked equities like Coinbase and high-valuation tech stocks, face amplified volatility. Higher rates increase discount rates in valuation models, pressuring growth stocks. This coincides with a pivotal tech earnings season where investor focus has shifted from massive AI capital expenditures to demonstrable revenue and cash flow generation. Companies with negative cash flows and weak growth narratives could see severe pressure if a September hike materializes, as financing costs would rise. Key indicators to watch include oil prices, upcoming inflation data, and Fed commentary at events like the Jackson Hole symposium.

Odaily星球日报2 dk önce

Will the Federal Reserve Definitely Raise Interest Rates in September? How Will Cryptocurrencies and US Stocks Bear the Pressure?

Odaily星球日报2 dk önce

How Likely is it for TradeXYZ to Go Solo from Hyperliquid?

The article analyzes the possibility of TradeXYZ, a dominant project on Hyperliquid's HIP-3 real-world asset (RWA) perpetual contracts market, splitting off to build its own independent trading platform. With TradeXYZ commanding over 90% of HIP-3 volume and over 35% of Hyperliquid's total open interest, its leverage and influence are significant. The primary motive for a split is seen as capturing the underlying protocol fees, of which TradeXYZ currently receives only half. However, several factors strongly discourage such a move. First, replicating Hyperliquid's high-performance infrastructure would be challenging and could degrade TradeXYZ's product quality. Second, Hyperliquid serves as a crucial distribution channel, with most users accessing TradeXYZ's liquidity through its frontend. Third, the close, trusting relationship between the founders of both projects makes a hostile "betrayal" unlikely. The conclusion is that a split would likely result in a lose-lose scenario. Hyperliquid would lose its main growth narrative and see its valuation impacted, while TradeXYZ would face immense technical hurdles, lose its primary user channel, and damage its reputation. Instead of a full separation, the more probable path is for TradeXYZ to negotiate better terms while deepening integration, focusing on enhancing its own brand and user ownership.

marsbit53 dk önce

How Likely is it for TradeXYZ to Go Solo from Hyperliquid?

marsbit53 dk önce

"Teletubbies" Robot Cleaning Service, $30/Hour, Pure·Manual·Intelligence

Anthropomorphic "Teletubby" robot offers cleaning services in San Francisco at $30/hour, but it's entirely remote-controlled. The robot, created by startup Tau Robotics, can perform household tasks like washing hands, mopping floors, and taking out trash. While the initial demo videos appear impressive and are notably shown at normal speed (unlike many sped-up robot demos), the company reveals the actions are performed via human teleoperation, not autonomous AI. Tau Robotics, founded in 2024, argues this "cheat" is a strategic way to bridge the current capability gap, ensure task completion, and collect real-world home data to eventually train autonomous systems. Their service features three robot models: Chelsea for kitchens/bathrooms, Elon for regular tidying with memory, and Tony for deep cleaning. Priced at $30 per hour, it's cheaper than average human cleaners in the US. The article discusses the broader challenge of deploying humanoid robots in homes, comparing Tau's approach to others like China's Ziliang and the US's 1X Neo, which also use teleoperation. A key reason for choosing a humanoid form is to make remote control more intuitive for human operators. The piece also notes the potential "emotional value" of having a humanoid servant. The service is currently invite-only in San Francisco.

marsbit1 saat önce

"Teletubbies" Robot Cleaning Service, $30/Hour, Pure·Manual·Intelligence

marsbit1 saat önce

From South Korea to the United States: Blue-Collar Jobs Are Becoming Increasingly Popular, Thanks to AI

AI is reshaping the labor market's value proposition. The traditional four-year college degree is losing its appeal as a guaranteed career path, while skilled blue-collar trades like electricians, welders, and plumbers are experiencing historic demand and wage premiums. This shift is driven by dual pressures: AI's displacement of certain white-collar roles and a booming need for physical infrastructure and data center construction. Data confirms the trend. In the U.S., vocational school revenue surged, and a significant portion of recent layoffs are AI-related. Surveys show a majority of Gen Z adults plan to pursue blue-collar work, citing better job security against AI automation. Vocational education interest has exploded recently. Experts cite a psychological shift as younger generations seek tangible, AI-resistant careers and avoid high student debt. In many cases, salaries for skilled trades now match or exceed those requiring a bachelor's degree. In South Korea, semiconductor vocational high schools boast near-total employment, with graduates securing high-paying roles at companies like Samsung. The shortage is structural, exacerbated by a retiring baby boomer workforce and massive infrastructure projects. Companies like JPMorgan Chase, Meta, and Lowe's are investing heavily in training programs. However, overcoming historical stigma and a "perception gap" around trade careers remains a key challenge to closing the talent gap.

marsbit1 saat önce

From South Korea to the United States: Blue-Collar Jobs Are Becoming Increasingly Popular, Thanks to AI

marsbit1 saat önce

İşlemler

Spot
活动图片