The BONK.fun platform has restored its website following a domain hijack last week. The team confirmed the incident resulted from a social engineering attack on its third-party domain provider and caused approximately $30,000 in user losses. No internal systems were compromised. The team stated it will reimburse affected users at 110% of their losses, covering both direct losses and opportunity costs.
The memecoin launchpad BONK.fun is back online after a domain hijack last week. In an update shared on 20 March, the team attributed the breach to a social engineering exploit targeting its domain service provider.
The provider has since accepted responsibility for the incident. The team emphasized there was no compromise of BONK. fun’s internal systems, codebase, or team accounts.
The attackers used their control to deploy a phishing interface that prompted users to sign malicious transactions. Earlier reports linked the attack to a fake terms-of-service signature request enabling unauthorized wallet access.
Losses from the breach have been revised to $30,000. In response, the team said it will reimburse affected users at 110% of their losses.
The unauthorized domain transfer to an external registrar delayed the recovery effort. Full functionality, including wallet integrations, returned by 19 March.
Wallet providers including Phantom, MetaMask, and Solflare helped flag the compromised domain. Some antivirus providers continue to flag the primary domain, so an alternative domain remains available.
Market reaction has been muted with BONK continuing a broader downtrend. The token was trading near $0.0000059, showing limited recovery momentum.
