Verify a decision

{"actor":"system:backfill","investigation_id":"5239205a-8d5b-48f7-9cc9-c9146236f5b5","kind":"publish","page_slug":"bonad","published_at":"2026-05-19T16:33:21.722Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Bonad","sections":[{"content":"BONAD.fun is a permissionless meme token launchpad on the Monad blockchain. It structures token creation and price discovery around Doppler-powered auction pools built on Uniswap v4. The platform is described as BONK's community-driven initiative to extend its ecosystem presence from Solana (where BONK.fun operates) into the EVM-compatible Monad network. A key economic feature is that a portion of protocol fees is designated for open-market buybacks of $BONK, creating a fee-recycling loop intended to benefit BONK holders. The project is listed on Messari and has been covered in trade publications including Bitget News as part of the wave of Monad mainnet dApps. However, BONAD.fun is explicitly an independent community launchpad and is not endorsed or vetted by the BONK Foundation.","heading":"Platform Overview","severity":"medium","sources":[{"credibility":2,"name":"What is Bonad Fun? | Messari","type":"research","url":"https://messari.io/project/bonad-fun/profile"},{"credibility":2,"name":"BONAD.fun Launches: BONK Empowers the Next Phase of the Monad Ecosystem | Bitget News","type":"news_article","url":"https://www.bitget.com/news/detail/12560605079874"},{"credibility":2,"name":"BONAD Official Site","type":"official","url":"https://bonad.fun/"}]},{"content":"On March 11–12, 2026, Bonk.fun — the Solana-based platform that BONAD.fun is modeled on — suffered a domain hijacking attack. According to reporting by CoinDesk, Decrypt, and The Block, attackers compromised a team member's account at the domain registrar, seized control of the bonk.fun domain, and deployed a wallet-draining script disguised as a fake terms-of-service compliance prompt. Users who signed the malicious prompt inadvertently authorized the attacker to empty their wallets within seconds. The attack was a front-end takeover, not a smart contract exploit; underlying blockchain infrastructure and code repositories were reportedly unaffected. The platform operator, known as Tom, warned users via X: 'Do not use the bonk.fun domain until further notice. Hackers have hijacked a team account, forcing a drainer on the domain.' Estimated losses were approximately $30,000; the team reimbursed affected users at 110% of losses. The platform restored service on March 20, 2026. This incident is directly relevant to BONAD.fun because both platforms share architectural patterns, brand identity, and operator overlap. A front-end attack on BONAD.fun would follow the same vector.","heading":"Front-End Attack on Sister Platform Bonk.fun","severity":"high","sources":[{"credibility":1,"name":"Bonk.fun hacked: Domain hijacked, crypto drainer planted | CoinDesk","type":"news_article","url":"https://www.coindesk.com/tech/2026/03/12/bonk-fun-hacked-domain-hijacked-crypto-drainer-planted"},{"credibility":1,"name":"Hackers Hijack Bonk.fun Domain, Deploy Wallet-Draining Phishing Prompt | Decrypt","type":"news_article","url":"https://decrypt.co/360805/hackers-hijack-bonk-fun-domain-deploy-wallet-draining-phishing-prompt"},{"credibility":1,"name":"Bonk.fun's official website hijacked, draining user funds upon interaction | The Block","type":"news_article","url":"https://www.theblock.co/post/393345/bonk-fun-hijacked"},{"credibility":1,"name":"Bonk Fun Website Hijacked: Live Exploit Is Draining User Funds | Yahoo Finance","type":"news_article","url":"https://finance.yahoo.com/news/bonk-fun-website-hijacked-live-074134743.html"},{"credibility":2,"name":"What happened to Bonk.fun? Hijacked and the latest updates | Smithii","type":"news_article","url":"https://smithii.io/en/what-happened-bonk-fun/"},{"credibility":2,"name":"Bonk fun hack highlights front-end risks on Solana platforms | Cryptonomist","type":"news_article","url":"https://en.cryptonomist.ch/2026/03/12/bonk-fun-hack-frontend-risks/"}]},{"content":"No publicly available smart contract audit for BONAD.fun has been identified. Searches across security firm databases (Hacken, Beosin, CertiK) and official BONAD.fun communications returned no audit reports. By contrast, the closely related Monad launchpad Nad.fun is reported to have passed a Beosin security review. The absence of a documented audit for BONAD.fun is a notable risk factor for users interacting with its bonding curve contracts and Doppler-powered auction pools built on Uniswap v4 hooks. Permissionless launchpads that accept user funds into smart contracts without third-party audits carry elevated smart contract risk, particularly for newly deployed EVM infrastructure on Monad mainnet, which launched on November 24, 2025.","heading":"Absence of Documented Smart Contract Audit","severity":"high","sources":[{"credibility":2,"name":"A Deep Dive into Monad and an Introduction to Its Meme Culture | Beosin","type":"research","url":"https://beosin.com/resources/a-deep-dive-into-monad-and-an-introduction-to-its-meme-culture"},{"credibility":2,"name":"What is Bonad Fun? | Messari","type":"research","url":"https://messari.io/project/bonad-fun/profile"}]},{"content":"Monad's public mainnet launched on November 24, 2025, with MON as its native token used for transaction fees and staking. BONAD.fun was deployed in the early mainnet phase, positioning itself alongside other Monad ecosystem launchpads including Nad.fun, Printr, Token Mill, and Clanker. The meme launchpad sector on Monad is nascent and has not undergone the same level of community scrutiny as more established Solana or Ethereum counterparts. Meme launchpads by design enable permissionless token creation with low barriers to entry, which historically correlates with high rates of project failure, rug pulls, and low-quality token issuance. The ZachXBT flag associated with BONAD.fun appears to reflect concern about the combination of: inherited front-end attack risk from the Bonk.fun incident, absence of a documented audit, and the speculative meme token environment in which the platform operates.","heading":"Ecosystem Context: Monad Mainnet and Meme Launchpad Risk","severity":"medium","sources":[{"credibility":1,"name":"Monad Blockchain Goes Live With 100B MON Token Supply, Airdrop | CoinDesk","type":"news_article","url":"https://www.coindesk.com/tech/2025/11/24/monad-blockchain-goes-live-with-100b-token-supply-and-airdrop"},{"credibility":2,"name":"Top Monad Ecosystem Coins by Market Cap | CoinGecko","type":"other","url":"https://www.coingecko.com/en/categories/monad-ecosystem"},{"credibility":2,"name":"BONAD.fun Launches: BONK Empowers the Next Phase of the Monad Ecosystem | Bitget News","type":"news_article","url":"https://www.bitget.com/news/detail/12560605079874"}]},{"content":"ZachXBT, the pseudonymous blockchain investigator whose Telegram channel (t.me/investigations) routinely flags high-risk crypto entities, has flagged BONAD.fun. The specific content of ZachXBT's post regarding BONAD.fun was not retrievable from publicly indexed sources at the time of this investigation; the flag is reflected in the source tags associated with this entity (zachxbt, front_end_attack, no_audit_documented, bonk_ecosystem, monad_ecosystem, meme_token). ZachXBT's investigative methodology combines on-chain wallet tracing, OSINT, and social graph analysis. Given the timing and source tags, the flag is alleged to relate to the inherited front-end attack risk from the Bonk.fun incident and the absence of a documented audit, rather than a discrete rug pull or exit scam event specific to BONAD.fun. This claim is assessed as medium confidence pending direct retrieval of the original Telegram post.","heading":"ZachXBT Flag","severity":"high","sources":[{"credibility":2,"name":"ZachXBT Investigations Telegram Channel","type":"social_media","url":"https://t.me/investigations"},{"credibility":2,"name":"Who Is ZachXBT, the Crypto Sleuth Exposing Scams? | BeInCrypto","type":"news_article","url":"https://beincrypto.com/learn/zachxbt-crypto-scam/"}]},{"content":"Bonk.fun (letsbonk.fun) is a Solana-based meme token launchpad backed by Raydium and the BONK community. BONAD.fun is its community-driven counterpart on the Monad EVM blockchain. Both platforms share the BONK brand identity and the fee-to-BONK-buyback economic model. However, BONAD.fun is explicitly not endorsed or vetted by the BONK Foundation and operates as an independent community initiative. Bonk.fun's market share on Solana collapsed from approximately 84% of the launchpad market in mid-2025 to roughly 7% by end-2025, with revenue falling to approximately $84,000 versus Pump.fun's $720,000 in the same period. BONAD.fun enters the Monad launchpad market against this backdrop of declining parent-platform relevance. The structural similarity between both deployments means that operational security failures at Bonk.fun — particularly the domain hijacking vector — represent a concrete precedent risk for BONAD.fun.","heading":"Platform Relationship: Bonk.fun vs. BONAD.fun","severity":"medium","sources":[{"credibility":2,"name":"BONK.fun Hack: A Liquidity Drain for a Failing Launchpad | Ainvest","type":"news_article","url":"https://www.ainvest.com/news/bonk-fun-hack-liquidity-drain-failing-launchpad-2603/"},{"credibility":2,"name":"BONAD.fun Launches: BONK Empowers the Next Phase of the Monad Ecosystem | Bitget News","type":"news_article","url":"https://www.bitget.com/news/detail/12560605079874"},{"credibility":2,"name":"What is Bonk.fun? The Community-First Launchpad on Solana | Backpack","type":"news_article","url":"https://learn.backpack.exchange/articles/what-is-bonk-fun-solana"}]}],"sources_used":[{"credibility":2,"name":"What is Bonad Fun? | Messari","type":"research","url":"https://messari.io/project/bonad-fun/profile"},{"credibility":2,"name":"BONAD.fun Launches: BONK Empowers the Next Phase of the Monad Ecosystem | Bitget News","type":"news_article","url":"https://www.bitget.com/news/detail/12560605079874"},{"credibility":1,"name":"Bonk.fun hacked: Domain hijacked, crypto drainer planted | CoinDesk","type":"news_article","url":"https://www.coindesk.com/tech/2026/03/12/bonk-fun-hacked-domain-hijacked-crypto-drainer-planted"},{"credibility":1,"name":"Hackers Hijack Bonk.fun Domain, Deploy Wallet-Draining Phishing Prompt | Decrypt","type":"news_article","url":"https://decrypt.co/360805/hackers-hijack-bonk-fun-domain-deploy-wallet-draining-phishing-prompt"},{"credibility":1,"name":"Bonk.fun's official website hijacked, draining user funds upon interaction | The Block","type":"news_article","url":"https://www.theblock.co/post/393345/bonk-fun-hijacked"},{"credibility":1,"name":"Bonk Fun Website Hijacked: Live Exploit Is Draining User Funds | Yahoo Finance","type":"news_article","url":"https://finance.yahoo.com/news/bonk-fun-website-hijacked-live-074134743.html"},{"credibility":2,"name":"What happened to Bonk.fun? Hijacked and the latest updates | Smithii","type":"news_article","url":"https://smithii.io/en/what-happened-bonk-fun/"},{"credibility":2,"name":"Bonk fun hack highlights front-end risks on Solana platforms | Cryptonomist","type":"news_article","url":"https://en.cryptonomist.ch/2026/03/12/bonk-fun-hack-frontend-risks/"},{"credibility":2,"name":"BONK.fun Team Account Breach Deploys Wallet Drainer on Solana Launchpad | Ainvest","type":"news_article","url":"https://www.ainvest.com/news/bonk-fun-team-account-breach-deploys-wallet-drainer-solana-launchpad-2603/"},{"credibility":2,"name":"BONK.fun Hack: A Liquidity Drain for a Failing Launchpad | Ainvest","type":"news_article","url":"https://www.ainvest.com/news/bonk-fun-hack-liquidity-drain-failing-launchpad-2603/"},{"credibility":2,"name":"Critical Alert: Bonk.fun Domain Hijacked in Security Breach | CryptoRank","type":"news_article","url":"https://cryptorank.io/news/feed/79918-bonk-fun-domain-hijacked-security-warning"},{"credibility":1,"name":"Monad Blockchain Goes Live With 100B MON Token Supply, Airdrop | CoinDesk","type":"news_article","url":"https://www.coindesk.com/tech/2025/11/24/monad-blockchain-goes-live-with-100b-token-supply-and-airdrop"},{"credibility":2,"name":"A Deep Dive into Monad and an Introduction to Its Meme Culture | Beosin","type":"research","url":"https://beosin.com/resources/a-deep-dive-into-monad-and-an-introduction-to-its-meme-culture"},{"credibility":2,"name":"ZachXBT Investigations Telegram Channel","type":"social_media","url":"https://t.me/investigations"},{"credibility":2,"name":"What is Bonk.fun? The Community-First Launchpad on Solana | Backpack","type":"news_article","url":"https://learn.backpack.exchange/articles/what-is-bonk-fun-solana"},{"credibility":2,"name":"BONAD Official Site","type":"official","url":"https://bonad.fun/"}],"summary":"BONAD.fun is a permissionless meme token launchpad operating on the Monad blockchain, positioned as BONK's community-driven expansion from Solana into the EVM ecosystem via Monad. The platform is an independent community project not officially endorsed or vetted by the BONK Foundation, and no public smart contract audit has been documented. The platform shares brand identity and fee-recycling mechanics with Bonk.fun, the Solana-based predecessor that suffered a domain hijacking and wallet-drainer attack in March 2026 — a front-end attack vector that is directly relevant to BONAD.fun's risk surface as a structurally similar deployment.","timeline":[{"date":"2025-11-24","event":"Monad public mainnet launched with 100B MON token supply; dApp ecosystem including meme launchpads began deploying.","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2025/11/24/monad-blockchain-goes-live-with-100b-token-supply-and-airdrop"},{"date":"2025-12-31","event":"Bonk.fun's Solana market share had fallen from 84% to approximately 7%; revenue dropped to ~$84,000 vs Pump.fun's $720,000.","source":"Ainvest","source_url":"https://www.ainvest.com/news/bonk-fun-hack-liquidity-drain-failing-launchpad-2603/"},{"date":"2026-01-01","event":"BONAD.fun launches on Monad as a community-driven meme launchpad using Doppler auction pools on Uniswap v4, with BONK buyback fee mechanics.","source":"Bitget News","source_url":"https://www.bitget.com/news/detail/12560605079874"},{"date":"2026-03-11","event":"Bonk.fun (Solana) domain hijacked via compromised team account at domain registrar; wallet-draining script deployed as fake terms-of-service prompt.","source":"Cryptonomist","source_url":"https://en.cryptonomist.ch/2026/03/12/bonk-fun-hack-frontend-risks/"},{"date":"2026-03-12","event":"Bonk.fun operator Tom issues public warning on X; users advised not to interact with the domain. Losses estimated at approximately $30,000. BONK token dropped ~0.9%.","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2026/03/12/bonk-fun-hacked-domain-hijacked-crypto-drainer-planted"},{"date":"2026-03-20","event":"Bonk.fun restored service; team confirmed internal systems and smart contracts were unaffected. Affected users reimbursed at 110% of losses.","source":"Smithii","source_url":"https://smithii.io/en/what-happened-bonk-fun/"}]},"v":1}