Is stonkfoundation.fun safe? No: it's a fake $STONK "Holder Crates" page carrying wallet-draining code

Is stonkfoundation.fun safe? No. Don't connect a wallet to it, and don't sign anything it shows you. As of 3:27 PM ET on 18 October, it is a fake "Holder Crates" page using StonkFun's name. We're not linking it.

Who is behind it isn't StonkFun. The page is promoted by @UseLauchsSF, an X account named "Stonk's Foundation's", named to look like StonkFun's real account, @LaunchOnSF. The account was opened in December 2017, and its older posts are unrelated link spam. At 2:36 PM ET it posted an article, "Launch Anything. Hold $STONK. Build Your Crate.", whose "Open Your Crate Here" button goes to stonkfoundation.fun/crates. It had about 7,400 views by 3:27 PM ET from an account with about 550 followers. We found no crates program on StonkFun's own account or site.

The domain is new. Its registration record shows it was created at 1:21 PM ET today, through the registrar NICENIC, about 75 minutes before the post went up.

What the page says, and what its code does. The page tells visitors that it "will never ask you to connect a wallet or send tokens", and every visible link points to StonkFun's real site and X account to look legitimate. Its main script, which we read as text without running it, does the opposite: it looks up the visitor's location through two IP lookup services, hooks the Phantom, Solflare and Jupiter wallets, and calls the wallet functions that ask you to sign transactions, sending what it collects to an outside server. A crates page has no reason to make your wallet sign anything; signing on a page like this is how wallets get emptied.

It's a template. The same "Foundation" crates article has run this week under other coins' names, from lookalike accounts, with sites built the same way; we've reported earlier crates pages for $GOMO, $SI and $HOOKED. The pattern: a renamed old X account, a near-copy of the real project's handle, a free "crate" or allocation for holders, and a page that asks your wallet to sign.

If you already signed something on it: move what's left to a new wallet right away and revoke the old wallet's token approvals. If you only opened the page and didn't connect or sign, nothing has moved, but don't go back.