The BONK.fun domain was compromised on March 12, 2026, deploying a wallet drainer that put user funds at immediate risk. The attackers used a fake Terms of Service message to trick users into approving malicious transactions. The incident highlights a growing trend of frontend attacks targeting crypto platforms rather than their underlying smart contracts.
The BONK.fun domain suffered a serious security breach after attackers compromised it and deployed a wallet drainer. The team urgently advised users to avoid the site until security could be restored. An operator, Tom, stated that attackers gained control of a team account to add the drainer.
The attackers used a fake Terms of Service prompt on the compromised website. Tom assured users that existing wallet connections and trades on external terminals were unaffected. This frontend attack vector increasingly targets crypto project domains to trick users into approving harmful transactions.
BONK.fun was a major Solana launchpad, capturing 84% market share at its peak after launching in April 2025. Its activity and revenue later declined significantly, falling to a 7% market share by the end of 2025. The platform recently reduced its fees to 0% in an attempt to attract more creators.
This is the latest in a series of frontend attacks within the crypto ecosystem. Aerodrome Finance was a victim of a similar attack in November 2025, where users were redirected to false websites. New scams also involve fake MetaMask security notifications, with one user reportedly losing $50,000.
The BONK.fun team confirmed it is investigating the breach and stated that protecting users is its main focus. Further updates are expected once the domain is fully secured.
