What happened
BONK.fun's domain was taken over on March 11, 2026 after a social-engineering attack against its domain service provider. A malicious terms-of-service prompt on the Solana launchpad drained approximately $30K from users; the team's codebase and internal accounts were not compromised.
The failure was a domain-control and web-supply-chain compromise at the registrar/service-provider layer, allowing the attacker to serve wallet-draining frontend content from the legitimate domain without compromising the launchpad codebase.
How it happened
The attacker used social engineering to obtain an unauthorized domain transfer, replaced the legitimate BONK.fun content with a fake terms-of-service prompt, and used that page to induce connected wallets to sign a drainer transaction. BONK.fun later restored domain control and pledged 110% compensation.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
