Solana-Based Meme Coin Launchpad Pump.fun Hacked for $1.9 Million

Solana-based meme coin launchpad Pump.fun fell victim to an exploit by a former employee, resulting in the misappropriation of approximately $1.9 million worth of SOL. The exploit involved the manipulation of bonding curves through flash loans, leading to the temporary suspension of trading. The stolen tokens are currently in limbo and untradeable.

Pump.fun Meme Coin Launchpad Falls Victim to Insider Exploit, Over $1.9 Million Siphoned

Solana-based meme coin launchpad Pump.fun has become the latest victim of a malicious insider exploit, resulting in the misappropriation of approximately 12,300 SOL, valued at roughly $1.9 million at the time of the incident.

Insider Access, Flash Loan Abuse

According to Pump.fun's official announcement, a former employee exploited their "privileged position" to gain unauthorized access to "withdraw authority" within the platform's systems. This illicit access allowed the perpetrator to execute a sophisticated attack utilizing flash loans from a Solana lending protocol.

The former employee borrowed SOL via flash loans and then purchased targeted meme coins on Pump.fun, artificially inflating their bonding curves to reach 100%. This maneuver enabled them to drain liquidity from the bonding curves and repay the flash loans, leaving the platform with a substantial loss.

Immediate Response, Platform Suspension

Upon detecting the exploit, Pump.fun promptly halted trading operations and swiftly initiated contract updates to prevent further damage. Out of the platform's total liquidity of $45 million, approximately $1.9 million was compromised in the attack.

Reparations and Future Enhancements

To compensate affected users, the Pump.fun team has pledged to replenish liquidity pools for the targeted coins with an equivalent or greater amount of SOL within 24 hours. The coins that reached 100% during the exploit will remain temporarily untradeable until liquidity pools are re-established on Raydium, a Solana lending protocol.

The team is actively collaborating with renowned security experts to both minimize the impact of the incident and implement robust measures to prevent future vulnerabilities. They emphasized their commitment to ensuring the safety and integrity of the platform for all users.

Internal Insider Suspected

Prior to Pump.fun's official announcement, Igor Igamberdiev, Head of Research at cryptocurrency market maker Wintermute, attributed the exploit to an internal private key leak and implicated X user "STACCoverflow" as a potential suspect.

Subsequently, an X user known as "Stacc" confessed to executing the exploit, criticizing the "horrible bosses" at Pump.fun and questioning their suitability within the blockchain community.

Wider Implications for the Meme Coin Market

The Pump.fun exploit highlights the inherent risks associated with meme coins and the importance of due diligence for investors. While meme coins may offer potential for speculative gains, it is crucial to recognize their volatility and the potential for manipulation.

The incident underscores the need for robust security measures, transparency, and accountability within the rapidly evolving meme coin market. Investors are urged to approach such investments with caution and conduct thorough research before allocating funds.