Bondly Finance Token Holders Lose Millions After a 373 Million-Token Infinite Mint
Bondly Finance, a multi-service NFT platform founded in November 2020, suffered an infinite-mint exploit that netted its attacker an estimated $5.9 million in profit, leaving the project's token holders to absorb the loss.

Whether this was a straightforward rug pull or something else remains an open question, but Bondly wasn't a minor food-coin farm — the project had a genuine following of roughly 47,000 Twitter followers, had received investment from Binance, and had struck partnerships with reasonably well-known celebrities, including Logan Paul. Logan's brother Jake Paul had separately been caught up in the Chainswap exploit just days earlier. Bondly's site also detailed its involvement with the PolkaPets Trading Card Game and broader work spanning digital collectibles, brands, influencers, and artists — by most measures, a project that had been doing reasonably well up to this point.
The exploit ran through a mint address and an associated wallet. The party behind the mint created 373 million new BONDLY tokens — far beyond anything the market could absorb — and began selling in increments of 100,000 tokens at a time. That selling pressure drove the price of BONDLY down by 80%. Roughly $4.8 million worth of DAI from the proceeds was routed through Tornado Cash, while about $1.1 million combined in DAI and BONDLY remained sitting in the wallet at the time of writing.
Bondly's own announcement attributed the incident to a wallet compromised by an unknown outside party. Whether that explanation holds, or whether the episode instead echoes the Paid Network case — where an inside job was suspected behind an ostensible hack — remains unresolved.
What happens next may matter as much as the exploit itself. Post-incident compensation has become something close to an expectation for hit protocols, but when rekt polled its Telegram community on whether victims should always receive it, the responses were far from unanimous.
This is Bondly's first appearance on the rekt leaderboard, debuting at #28.

Get new scam files the moment we publish them — usually 2–3 emails a week.