Attackers seize Bonk.fun domain and team account, push fake TOS that drains connected wallets; users report major losses

Bonk.fun's domain and team account were compromised on March 12, enabling attackers to replace site content with a wallet‑draining phishing prompt and a fraudulent terms‑of‑service message; browser security warnings also flagged the site for suspected phishing after the changes ^[2][4][1].

The platform operator warned users to avoid the website after reports of drained wallets surfaced, and at least one trader publicly claimed a loss of roughly $273,000 after connecting their wallet; the operator (identified as Tom) said only users who approved the fake TOS prompt on the compromised site were affected ^[3][4][2].

Bonk.fun — originally launched as LetsBONK in April 2025 — has already seen a sharp decline in market position, with market share dropping from about 84% to near 7% by late 2025, a backdrop noted as the security breach highlighted vulnerabilities in decentralized launch platforms ^[5][1].

Reports and the operator indicated that previously established connections and transactions through external terminals remained unaffected; users were advised to avoid the compromised domain while investigations and remediation continued ^[4][5].