Bonk.fun, a leading Solana-based meme coin aggregation platform, was compromised Wednesday in a sophisticated attack that saw its domain hijacked and a cryptocurrency drainer planted on the site. The attackers redirected Bonk.fun's DNS to a malicious server, enabling them to intercept wallet connections and siphon funds from users who interacted with the compromised platform during the window of vulnerability.
Market Context
The Bonk.fun hack represents one of the most high-profile DeFi exploits in 2026, occurring amid heightened scrutiny of Solana-based platforms following several smaller-scale attacks earlier this year. The broader crypto market saw modest reaction, with SOL trading relatively flat at $142.50, though security-focused tokens like HMT saw slight gains as investors rotated into defensive positions. The incident follows a pattern of DNS-based attacks targeting crypto platforms, with over $380 million lost to such exploits in 2025 according to Chainalysis data.
Analysis
The attack vector involved DNS hijacking rather than a smart contract vulnerability, meaning the platform's underlying code remained intact. Attackers potentially obtained access to Bonk.fun's domain registrar credentials, allowing them to modify DNS records and point traffic to a server hosting the drainer script. Security researchers at Blockaid identified the drainer as a variant of known wallet-draining malware that approves malicious token transfers when users connect wallets. The Solana ecosystem's reliance on browser-based wallet extensions like Phantom and Backpack made users particularly vulnerable to the attack. Community members reported losses ranging from hundreds to tens of thousands of dollars in BONK tokens and other SPL assets before the breach was identified and the domain taken offline.
Key Numbers
- Estimated total value stolen: between $2 million and $5 million in preliminary reports
- DNS hijacking window: approximately 4 hours before domain was taken offline
- BONK token price: down 8.2% to $0.000031 following the news
- Solana network volume at time of attack: 42 million transactions per day
- Security tokens rally: HMT up 5.1%, SOLID up 3.8% on the day
What to Watch
Bonk.fun's official response and potential compensation fund announcements will be critical for user confidence. The team is expected to release a post-mortem detailing how registrar credentials were compromised. Users who connected wallets to the site should immediately revoke permissions using Solana's token approval revocation tools. The SEC's cyber unit may also take interest given the growing frequency of DNS-based DeFi exploits. Key levels to monitor include SOL support at $138 and resistance at $150, with BONK facing immediate support at $0.000028.