The trading Telegram bot BONKbot on the Solana network was allegedly subjected to a hacker attack, as a result of which users lost about $ 208,000.
#CertiKInsight 🚨
We are seeing reports that @bonkbot_io users have lost funds in a possible private key leak.
Problem may lie in users exporting private keys
Based on reports, it appears that at least ~$208k has been stolen pic.twitter.com/JD91fBZNLI
CertiK analysts drew attention to multiple reports of losses and allowed a possible leak of private keys.
The exact cause of the exploit remains unknown. BONKbot representatives and other users point to different culprits.
According to the Telegram bot developers, the problem arose because users exported their private keys, which were then compromised in another application.
TLDR: BONKbot is SAFE, as always, and exporting your private key itself did NOT put you at risk. There has been an exploit with another Solana app.
More than half of the ~300 victims were non-BONKbot wallets.
The BONKbot users affected had imported their private key into a…
"BONKbot is still secure, and exporting the private key itself does not put you at risk. A vulnerability has been noticed in another Solana application. More than half of the approximately 300 victims were wallets not owned by BONKbot," the post says.
At the same time, traders who did not export keys also reported losses.
My bonkbot wallet got drained. And, contrary to what the devs claim, my wallet was not linked to any other app (except sol-incinerator). The private key was only exported to Phantom.
If you want to help me a little bit to get back on track:… pic.twitter.com/ywxWFZ6TX9
"My BONKbot wallet is empty. Contrary to the claims of the developers, my wallet was not linked to any other application (except sol-incinerator). The private key was exported only to Phantom," marc611 stated.
BONKbot blamed a "specific application", and some pointed to Solareum, another Telegram bot based on Solana.
Representatives of the latter deny any vulnerabilities and claim that the exploit may have a larger scale and affect other bots and decentralized applications.
solareum devs confirm they are closing the project
Full message in next tweet pic.twitter.com/xqHtgxVfwG
They suggested that hackers could steal access tokens to the Telegram bot, gaining control over the message history containing private keys. The damage was estimated at about $310,000.
A few days after the incident, Solareum announced the closure. The developers referred to "insufficient funds, emerging market trends and a recent security breach."
The bot's team has already contacted law enforcement in an attempt to freeze the stolen funds if they end up on centralized exchanges.
The situation has caused confusion in the community, as the nature of the vulnerability is not fully clear. The number of affected users also remains unknown: BONKbot claims that only 0.1% of their traders were affected, while some users allowed much larger values.
Bans in the BONKbot chat for expressing concerns have further reduced the credibility of such statements.
Hey @bonkbot_io is this how you deal with real situations? when your clients loses hundreds of thousands. Your admin team literally kicking everyone speaking up. And you tell us this is safe continue to use it?
You fucking scammers I will take you down myself pic.twitter.com/JCKlGrbmal
"Hey BONKbot, is this what you do in real situations when your customers lose hundreds of thousands? Your admin team literally kicks everyone who speaks out. And you tell us that everything is safe and suggest that we continue to use [the bot]? You are ***s scammers, I will close you myself," the disgruntled trader wrote.
Recall, according to PeckShield, in March, crypto projects lost assets worth $187 million as a result of hacks. The indicator decreased by 48% compared to the previous month.
According to a study by Immunefi, in the first quarter, as a result of fraud and hacker attacks, the damage to the industry reached $336 million. 100% of the losses are related to the DeFi sector.
https://forklog.com/news/haker-nazval-belym-vzlom-prisma-na-11-mln-no-sredstva-poka-ne-vernul