{"id":274758,"date":"2024-03-31T03:56:13","date_gmt":"2024-03-30T22:26:13","guid":{"rendered":"https:\/\/dripp.zone\/news\/?p=274758"},"modified":"2024-03-31T03:56:13","modified_gmt":"2024-03-30T22:26:13","slug":"solana-user-wallets-drained-of-523k-as-bonkbot-team-denies-link-crypto-news","status":"publish","type":"post","link":"https:\/\/dripp.zone\/news\/solana-user-wallets-drained-of-523k-as-bonkbot-team-denies-link-crypto-news\/","title":{"rendered":"Solana User Wallets Drained of $523K as BONKbot Team Denies Link &#8211; Crypto News"},"content":{"rendered":"<div style=\"position:relative;overflow:visible;font-size:1.2em;line-height:1.58\">\n<p class=\"font-meta-serif-pro scene:font-noto-sans scene:text-base scene:md:text-lg font-normal text-lg md:text-xl md:leading-9 tracking-px text-body gg-dark:text-neutral-100\"><span style=\"font-weight:400\">A string of wallet drainer attacks on <\/span><a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/decrypt.co\/resources\/what-is-solana-a-scalable-decentralized-network-for-dapps\" class=\"sc-adb616fe-0 bJsyml\"><span style=\"font-weight:400\">Solana<\/span><\/a><span style=\"font-weight:400\"> over the last day may be tied to Telegram trading bots, although the team behind the most prominent one\u2014BONKbot\u2014denies that the exploit is tied to their application.<\/span><\/p>\n<p class=\"font-meta-serif-pro scene:font-noto-sans scene:text-base scene:md:text-lg font-normal text-lg md:text-xl md:leading-9 tracking-px text-body gg-dark:text-neutral-100\"><span style=\"font-weight:400\">Numerous reports of Solana wallets being emptied of their SOL popped up over the past several hours on Twitter, with some users pointing the finger at BONKbot, a popular application from the team behind the <\/span><a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/decrypt.co\/209906\/solana-devs-bonk-airdrop-worth-300-last-christmas-now-worth-500000\" class=\"sc-adb616fe-0 bJsyml\"><span style=\"font-weight:400\">Solana meme coin BONK<\/span><\/a><span style=\"font-weight:400\"> that lets buy and sell Solana-based tokens via the messaging app Telegram.<\/span><\/p>\n<p class=\"font-meta-serif-pro scene:font-noto-sans scene:text-base scene:md:text-lg font-normal text-lg md:text-xl md:leading-9 tracking-px text-body gg-dark:text-neutral-100\"><span style=\"font-weight:400\">Early Friday, BONKbot <\/span><a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/twitter.com\/bonkbot_io\/status\/1773655415760588997\" class=\"sc-adb616fe-0 bJsyml\"><span style=\"font-weight:400\">denied the claims<\/span><\/a><span style=\"font-weight:400\">, suggesting that any affected users who had previously used the Telegram bot had more likely exported their private keys and used them in other applications.<\/span><\/p>\n<p class=\"font-meta-serif-pro scene:font-noto-sans scene:text-base scene:md:text-lg font-normal text-lg md:text-xl md:leading-9 tracking-px text-body gg-dark:text-neutral-100\"><span style=\"font-weight:400\">\u201cBONKbot is SAFE\u2014but there are exploits being triggered elsewhere in the ecosystem!\u201d the team wrote on Twitter. \u201cOur logs show that every user account being drained has previously exported their private keys. There are also non-BONKbot wallets being drained. BONKbot users who did not export their keys are SAFE.\u201d<\/span><\/p>\n<div class=\"relative w-full\">\n<blockquote class=\"twitter-tweet mx-auto\">\n<p lang=\"en\" dir=\"ltr\">&lt;0.1% of BONKbot users who&#039;ve exported their PK were affected. Our analysis strongly suggests the exploit occurred from those victims importing PKs into a specific application.<\/p>\n<p>Data so far:<br \/>&#8211; total victims: 302<br \/>&#8211; BONKbot victims: 113<br \/>&#8211; keyExported from BONKbot: 113<br \/>&#8211; total SOL\u2026<\/p>\n<p>\u2014 BONKbot (@bonkbot_io) <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/twitter.com\/bonkbot_io\/status\/1773769576393908252?ref_src=twsrc%5Etfw\" data-wpel-link=\"internal\">March 29, 2024<\/a><\/p>\n<\/blockquote>\n<\/div>\n<p class=\"font-meta-serif-pro scene:font-noto-sans scene:text-base scene:md:text-lg font-normal text-lg md:text-xl md:leading-9 tracking-px text-body gg-dark:text-neutral-100\"><span style=\"font-weight:400\">On Friday afternoon, the team <\/span><a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/twitter.com\/bonkbot_io\/status\/1773769443845574764\" class=\"sc-adb616fe-0 bJsyml\"><span style=\"font-weight:400\">shared an update<\/span><\/a><span style=\"font-weight:400\"> saying that it has tracked 302 total victims of the wallet drainer so far, with about 2,808 SOL swiped\u2014or about $523,000 worth at the current price. BONKbot claims that 113 of those victims had previously used its bot, but that all of them had exported their private keys (PKs) for use elsewhere.<\/span><\/p>\n<p class=\"font-meta-serif-pro scene:font-noto-sans scene:text-base scene:md:text-lg font-normal text-lg md:text-xl md:leading-9 tracking-px text-body gg-dark:text-neutral-100\"><span style=\"font-weight:400\">\u201cOur analysis strongly suggests the exploit occurred from those victims importing PKs into a specific application,\u201d BONKbot tweeted. The team did not reveal the alleged application in question, however. <\/span><i><span style=\"font-weight:400\">Decrypt<\/span><\/i><span style=\"font-weight:400\"> reached out for clarification but did not immediately receive a response.<\/span><\/p>\n<div class=\"relative w-full\">\n<blockquote class=\"twitter-tweet mx-auto\">\n<p lang=\"en\" dir=\"ltr\">There maybe a chance we got exploited.<\/p>\n<p>\u2014 Solareum (@SolareumProject) <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/twitter.com\/SolareumProject\/status\/1773751219149824274?ref_src=twsrc%5Etfw\" data-wpel-link=\"internal\">March 29, 2024<\/a><\/p>\n<\/blockquote>\n<\/div>\n<p class=\"font-meta-serif-pro scene:font-noto-sans scene:text-base scene:md:text-lg font-normal text-lg md:text-xl md:leading-9 tracking-px text-body gg-dark:text-neutral-100\">According to <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/docs.google.com\/spreadsheets\/d\/1l3voZhJCLXWDV5n8fWwjlNJQfoxNflP9qkaljGgYQNk\/edit#gid=555630762\" class=\"sc-adb616fe-0 bJsyml\">analysis<\/a> from BONKbot, the largest single victim lost just over 500 SOL in the attack, or about $93,000 worth.<\/p>\n<p class=\"font-meta-serif-pro scene:font-noto-sans scene:text-base scene:md:text-lg font-normal text-lg md:text-xl md:leading-9 tracking-px text-body gg-dark:text-neutral-100\"><span style=\"font-weight:400\">There\u2019s rampant speculation on Twitter that a competing Telegram trading bot, Solareum, could be tied to the potential leak of private keys. In a tweet reply, the team <\/span><a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/twitter.com\/SolareumProject\/status\/1773751219149824274\" class=\"sc-adb616fe-0 bJsyml\"><span style=\"font-weight:400\">acknowledged to a Twitter user<\/span><\/a><span style=\"font-weight:400\"> that \u201cthere [may be] a chance we got exploited,\u201d however the Solareum team also went on the defensive and said <\/span><a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/twitter.com\/SolareumProject\/status\/1773745573234983021\" class=\"sc-adb616fe-0 bJsyml\"><span style=\"font-weight:400\">that they were actually victims<\/span><\/a><span style=\"font-weight:400\">.<\/span><\/p>\n<p class=\"font-meta-serif-pro scene:font-noto-sans scene:text-base scene:md:text-lg font-normal text-lg md:text-xl md:leading-9 tracking-px text-body gg-dark:text-neutral-100\"><span style=\"font-weight:400\">\u201cUntil we can confirm that we are actually exploited, then we will publicly announce it. Otherwise, it&#8217;s just a possible scenario,\u201d they wrote. \u201cThere are also other wallets exploited that&#8217;s never generated wallets through our bot or imported their PKs into our bot.\u201d<\/span><\/p>\n<p class=\"font-meta-serif-pro scene:font-noto-sans scene:text-base scene:md:text-lg font-normal text-lg md:text-xl md:leading-9 tracking-px text-body gg-dark:text-neutral-100\"><i><span style=\"font-weight:400\">Decrypt<\/span><\/i><span style=\"font-weight:400\"> contacted Solareum for comment but did not immediately receive a response.<\/span><\/p>\n<p class=\"font-meta-serif-pro scene:font-noto-sans scene:text-base scene:md:text-lg font-normal text-lg md:text-xl md:leading-9 tracking-px text-body gg-dark:text-neutral-100\"><i>Edited by <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/decrypt.co\/author\/ryanozawa\" class=\"sc-adb616fe-0 bJsyml\">Ryan Ozawa<\/a>.<\/i><\/p>\n<div class=\"my-4 border-b border-decryptGridline\">\n<div class=\"text-start p-8 md:py-12 md:px-12 max-w-prose relative\"><span class=\"border-t-4 border-l-4 w-4 h-4 md:border-t-[6px] md:border-l-[6px] md:w-6 md:h-6 border-decryptPurple dark:border-decryptNeon gg-dark:border-cc-pink-2 absolute top-4 left-4 md:top-6 md:left-6\" \/><span class=\"border-t-4 border-l-4 w-4 h-4 md:border-t-[6px] md:border-l-[6px] md:w-6 md:h-6 border-decryptPurple dark:border-decryptNeon gg-dark:border-cc-pink-2 absolute rotate-180 bottom-4 right-4 md:bottom-6 md:right-6\" \/><\/p>\n<h3 class=\"font-akzidenz-grotesk font-bold text-xl md:text-3xl mb-6 md:text-center gg-dark:text-white\">Stay on top of crypto news, get daily updates in your inbox.<\/h3>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>A string of wallet drainer attacks on Solana over the last day may be tied to Telegram trading bots, although the team behind the most prominent one\u2014BONKbot\u2014denies that the exploit is tied to their application. Numerous reports of Solana wallets being emptied of their SOL popped up over the past several hours on Twitter, with [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":214373,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[230,225,221,227,226,228,229,60,223,224,222],"class_list":["post-274758","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cryptocurrency","tag-brave","tag-coinbase","tag-crypto","tag-decentralised","tag-decentralized","tag-decentralized-exchange","tag-erc-20","tag-featured","tag-meme-coin","tag-robinhood","tag-solana"],"_links":{"self":[{"href":"https:\/\/dripp.zone\/news\/wp-json\/wp\/v2\/posts\/274758","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dripp.zone\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dripp.zone\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dripp.zone\/news\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/dripp.zone\/news\/wp-json\/wp\/v2\/comments?post=274758"}],"version-history":[{"count":2,"href":"https:\/\/dripp.zone\/news\/wp-json\/wp\/v2\/posts\/274758\/revisions"}],"predecessor-version":[{"id":274760,"href":"https:\/\/dripp.zone\/news\/wp-json\/wp\/v2\/posts\/274758\/revisions\/274760"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/dripp.zone\/news\/wp-json\/wp\/v2\/media\/214373"}],"wp:attachment":[{"href":"https:\/\/dripp.zone\/news\/wp-json\/wp\/v2\/media?parent=274758"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dripp.zone\/news\/wp-json\/wp\/v2\/categories?post=274758"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dripp.zone\/news\/wp-json\/wp\/v2\/tags?post=274758"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}