BONKbot says an unreported third-party application was compromised

CertiK, a cybersecurity company, reported yesterday a potential exploit affecting users of BONKbot’s Solana trading bot. CertiK estimates that the thefts totaled at least $208,000.

The team at CertiK speculated that a leak of private keys could be the cause for financial harm to cryptocurrency investors.

You can also read: Video Game Wallet Drainers target Almost 5 million Players

BONKbot shared the news of this exploit also with its users. The team behind the bot appeared to be trying to explain the situation, but its comments caused confusion for the bot users. The BONKbot team acknowledged the breach but also stressed the bot’s safety, stating that there are “exploits being triggered in other parts of the ecosystem.”

BONKbot stated that the logs of its application “show that each user account that is being drained had previously exported his private key,” and that users who did not export their keys would not be affected by this exploit. BONKbot claims that wallets from other apps, unrelated to BONKbot were also affected.

They have committed to finding the third-party app that was compromised and responsible for financial losses suffered by BONKbot customers who had connected their wallets with this software. The team assured users that their funds are safe, as BONKbot was unaffected.

BONKbot’s later posts provided more information on the incident. It highlighted that 113 users were affected, which is less than 0.1%. The team reiterated that their analysis showed that the exploit was caused by victims who imported private keys to a particular application. They also noted that the data indicated exactly 113 BONKbot keys were exported. It was also stated that the bot team’s “industry grade AES-256” encryption would keep users safe. However, this protection will not be effective if keys were exported to other applications.

BONKBot reports that the exploited 302 people who collectively lost $2,808.38 SOL, or $553.307.

Although the messages from BONKbot were cheerful, users voiced strong doubts because the team never mentioned the name of exploited app.

WazzCrypto, an influencer in the crypto-space, stated that, regardless of BONKbot’s attempt to place blame on another “specific” app, the bot is responsible if exporting private keys caused a large leak.

WazzCrypto’s followers were informed that “I am sorry, but it is pretty clear BonkBot does not provide 100% security if every user who has been drained previously exported BONKbot keys.”

The comment sparked a debate, with many opinions ranging between accusations of Solareum and claims that it was the connection to a “malicious website or dApp”, before exporting private keys, which caused this problem.

It does not follow that everyone who exported was also drained. Zn2plusC, a X user, commented that he didn’t. He said that, “The only ones getting drained were those who imported the wallet into Solareum. This is proof that Solareum is at fault.”

X-user SoLorden, who lost 44 SOL, worth more than $8,700, relied in fact on wallets created by the bot, while the private keys of their victims were imported to Solareum.

Solareum is now facing accusations from users that their money was drained in this exploit. Some of these people believe they lost their money because it turned out to have been an exit scam.

Solareum’s X-post stated that the team “can clarify that we don’t steal money.” It added that, “a lot Solar users wallets were drained but this was part of an exploit that affects other bot projects as well as dApps.”

Solareum’s team believes that cyber criminals may have stolen Telegram bot tokens and accessed all messages in their history. This could include messages containing wallet creation messages, as well as private keys, as long as the owners of the messages did not delete them.

BONKbot users have also expressed their doubts about the accuracy of exploit statistics reported by Telegram’s bot. MaxOrigin, who claimed to know five victims, was among them. It seemed unlikely that only five people had been affected.

The case is even more mysterious. MarcTheYolo was one of the victims who mentioned that he exported the private key to Phantom exclusively, and the wallet compromised only connected to Sol-Incinerator.

Please read: What You Should Know About Revoke.Cash and Revoking.Approvals

Some victims, such as FortKnox user, say that they have been drained even though they never exported their keys.

ShrekCrypto’s reports, a BONKbot-user who had lost an incredible 620 SOL valued at over $121,476 heightened the controversy.

When I shared my transaction details with the BonkBot team, I received more FUD and death threats for speaking up,” ShrekCrypto complained about the lack of proper communication between bot’s team. ShrekCrypto also complained that when he shared his transaction details with BonkBot’s team, he received death threats and more FUD for speaking out.