Account Compromisation Situation

The **Account Compromisation Situation** was a crisis on Bonk.io that lasted publicly from December 31st 2021 to January 7th 2022.

*Please note beforehand:*

1. Information regarding the event is limited in some areas for several external reasons. If you can add factual information or remove inaccuracies while providing digital evidence, please do so. If you have any questions, contact one of the wiki staff members.
2. All time stamps are in EST.

### How it Worked

The exploit worked by using paid search engines to gain access to Bonk.io accounts via matching account and password combinations from previous data breaches. At the time, Bonk.io lacked the ability for a user to change their account password. This resulted in Bonk.io accounts being especially vulnerable to this tactic.

### Scale

The security flaw resulted in the immediate vulnerability of an estimated hundreds of thousands to millions of Bonk.io user accounts. This estimate is gathered by the large number of high profile users who were affected by it, suggesting that a considerable chunk of the broad community was vulnerable. Since Bonk.io has over eleven million registered accounts, such a number is likely to be reasonable.

The total number of users who were actually breached remains unknown due to it being near-impossible to gain information for accounts that are lower-profile. However, it is probably much lower than the amount of those who were vulnerable.

### Currrent Recommendation

If you have reused your Bonk.io username and password on other sites, consider changing your password on Bonk.io as that is now an in-game feature. This will prevent any other user from using the exploit to hijack your account and lock you out.

If your account is already locked out, direct message Chaz on Discord.

## **Timeline**

### **Origins & Backstory**

The exploit was originally discovered by Shunk and wizardlypig, two American Bonk players who were active in the Bonk community, particularly on Discord.

On 26th December, 2021, the pair discovered that by using paid websites that indexed known data breaches, and searching for the usernames of Bonk accounts, it was possible to learn the passwords for some of those accounts, specifically, the ones which had reused their password from other sites in Bonk.

In total, Shunk and wizardlypig were able to collect the account information of thirty-five mostly high-profile accounts, including renowned usernames such as billioninjoe, Levesile, retard, ProBond, and Querp.

On 27th December, 2021, Shunk brought the situation to the attention of The \_ Llama, a prominent community figure who was widely suspected of having surer means of contacting Chaz than the rest of the community. Upon learning of the exploit and how it worked, The \_ Llama immediately e-mailed Chaz, detailing the situation.

The intention of this was to encourage Chaz to add a password changing feature to the game as soon as possible. This would allow vulnerable users to change their Bonk account passwords, thus making their accounts secure against the exploit. It was done in the hope of allowing Chaz to add the password changing feature, without malicious actors discovering the exploit and using it to their advantage. However, this was not to be.

**December 31st, 2021**

    In a series of posts on the Bonk.io subreddit, the Bonk player retard revealed the existence of the exploit, and subsequently also the details of how the exploit could be performed.

This occurred because wizardlypig had shared with the user retard that his account was one of the thirty-five accounts that were first affected. After hearing about this, at 5:04 AM, retard posted on the Bonk.io Subreddit about what Shunk and Wizardlypig had been doing, along with broadly explaining how the hack worked.

This action leaked knowledge of the situation to the public. However, some of the information posted by retard was misleading and erroneous, also painting Shunk and wizardlypig as malicious hackers while portraying retard himself as a noble whistleblower.

The leaks prompted Shunk to record and release a video on YouTube, entitled “bonk.io compromised accounts situation”. Originally released unlisted sometime on December 31st, 2021, it clarified that the exploit was originally discovered by him and wizardlypig, and detailed the actions taken by them up to that point, including the involvement of The \_ Llama in the attempt to contact Chaz. The video included him logging into multiple of the compromised accounts as proof.

It was alleged by Shunk in the video that he and wizardlypig had done their actions in good faith, without malicious intent. Along with this, they emphasised that they had privately disclosed the matter with Chaz (the developer of Bonk.io), allowing him to resolve it, before making knowledge of the situation public. These statements are believed as valid by the majority of the Bonk.io community. The video also emphasised that retard had betrayed their trust by releasing the information to the public.

This was later attached in a Bonk.io Subreddit post, containing the video at 1:20 PM.

For the remainder of the day, news of the account situation began spreading slowly trickling into other Bonk.io communities and in-game. However, the vast majority of activity remained on the subreddit, in which retard began continually adding more harmful information, including the precise method by which the exploit could be conducted.

Additionally, at 10:44 PM he purposefully leaked his own password and proclaimed that he was quitting Bonk.io.

**January 1st, 2022**

Shortly after New Year’s, at 12:09 AM, the user *monkey butler*, a moderator of the Bonk.io Wiki, decided to immedately comment on the subreddit his plan for the containment of the situtation, seeking cooperation from all Bonk.io communities. All core and semi-peripheral Bonk.io communities adopted a type of containment measure hours later, although largely deviating from one another. [See Additional Resources]

Monkey butler published a community post at 12:35 AM along with a notice at 1:04 AM onto the Bonk.io Wiki regarding the situation and recommended guidance. These were the first actions by a user to control the spread of harmful information regarding the situation.

Although done with good intent, these notices partially contained inaccurate advice and were argued by some of the community to have potentially accelerated the spread of harmful information regarding the crisis. At 7:39 AM, the edits were removed by Mad bonkio user, an administrator of the Wiki, citing that they did more harm than good.

At 8:12 AM, TSUSL (The \_ Llama), in his capacity as a moderator on the Bonk.io subreddit, decided to adopt an airtight containment stance for the spread of information on the subreddit. He issued a public statement on the subreddit that prohibited all communications relating to the account situation. Additionally, he banned the user retard from the subreddit for leaking harmful details of the exploit to the public.

At 2:42 PM, the notices on the Bonk.io Wiki were reinstated by monkey butler and GreenHood after majority agreement by the Wiki staff team.

At 5:24 PM, Chaz, the developer of Bonk.io, went onto the Bonk.io Community Discord (BCD) to announce that he had taken action by locking all of the initial thirty-five breached accounts to prevent vandalism, and would work with each of the affected users to restore them. This was the first message that Chaz had given on the server in over a year. By this point, multiple of the initial thirty-five accounts had been publicly leaked.

Chaz spent the next few hours helping primarily high-profile users to regain control of their accounts and to answer any community questions through direct messaging on Discord. It is unknown whether Chaz learnt of the situation via The \_ Llama's initial e-mail from December 27th, or whether he was forced into action after the rapid escalation of the situation via the subreddit and BCD.

At 5:42 PM, monkey butler created an updated community post regarding the situation on the Bonk.io Wiki, providing new information following Chaz’s announcement.

At 10:34 PM, The \_ Llama, in his capacity as an administrator of BCD, rejected calls from multiple users to ban retard on BCD. He noted that while retard deserved to be "blacklisted off every Bonk community entity", retard had not technically broken any rules of the server and so it was not in his jurisdiction to effect a ban. He additionally cited that the harassment that retard was already receiving from the community may have been more effective punishment than a ban. Known information suggests that retard left BCD the following day.

At 11:06 PM, after a considerable effort to bring the views of the Wiki staff team into unison, a decision was made to adopt a stricter containment stance, closer to that of the Subreddit. The notice on the Bonk.io Wiki was amended by Mad bonk.io user and Shunk, clarifying that there was nothing a vulnerable user could do to prevent getting their Bonk.io account broken into. However, they could change the passwords of their other websites to prevent further damage for themselves. The notice was also reworded to prevent users from gleaning any indication of the details of the exploit from it.

At 11:13 PM, The \_ Llama reminded users on BCD that Chaz still had not fully resolved the issue and that “thousands of accounts are still at risk”.

The notice added on the Accounts article at 1:04 AM by monkey butler. The notice added in the dicussions page shortly beforehand remains missing due to it having been erased by another staff member removing outdated information.The public statement made at 8:12 AM by The \_ Llama, banning dicussion of the crisis on the subreddit.A statement released by Chaz at 5:26 PM on the BCD, addressing the situation.**January 2nd, 2022**

At 7:21 PM, TSUSL (The \_ Llama) made an edit to the public statement on the Bonk.io Subreddit, reusing and crediting the notice on the Bonk.io Wiki. Along with this, the post was pinned.

Aside from this, no major additional changes in policy or notable statements occurred. Efforts to contain harmful knowledge regarding the situation had mostly failed by this point. As a result, staff members on the various community entities, particularly BCD, did not attempt any further actions to mitigate the situation.

**January 3rd-6th, 2022**

No major additional changes in policy or notable statements occurred.

    **January 7th, 2022**

Chaz mostly ended the situation for the broader community by releasing a patch allowing for any user to change their passwords via the Settings button in the top bar.

## Impact

As a result of the patch, this has fundementally changed some aspects of Bonk.io. One of these is that public accounts no longer meaningfully exist as users can simply reserve them for themselves.

## Additional Resources

A map of the communities within Bonk.io and their overall influence on the broader community.The response plans taken by the staff teams of each community.Criteria for the levels of censorship employed by different staff teams.A qualitative graph providing estimates for where harmful information spread between the different communities as the event was taking place. Accounts for community size and time decay.A qualitative graph providing estimates for where helpful information spread between the different communities as the event was taking place. Accounts for community size and time decay.