Pump.fun 駭客攻擊：流氓員工竊取數百萬美元，重新分配到隨機錢包

Pump.fun Exploited: Rogue Employee Drains Millions and Redistributes to Random Wallets

Pump.fun 被利用：流氓員工吸走數百萬美元並重新分配到隨機錢包

On Thursday, Pump.fun, a popular platform for launching meme coins on Solana, fell victim to a brazen exploit that compromised the protocol and resulted in the theft of millions of dollars worth of cryptocurrency. The incident has sent shockwaves through the crypto community and raised serious concerns about the security and ethics of meme coin mania.

週四，Pump.fun（一個在 Solana 上推出模因幣的流行平台）成為了一次無恥漏洞的受害者，該漏洞破壞了協議，並導致價值數百萬美元的加密貨幣被盜。這起事件在加密貨幣社群引起了軒然大波，並引發了人們對迷因幣狂熱的安全和道德的嚴重擔憂。

The Attack

攻擊

The attack targeted bonding curve contracts, which facilitate the liquidity of tokens generated on Pump.fun. Utilizing a private key accessible only to Pump.fun employees, the attacker rerouted funds intended for Raydium, a decentralized exchange on Solana, to unrelated wallet addresses.

這次攻擊針對的是聯合曲線合約，該合約促進了 Pump.fun 上生成的代幣的流動性。攻擊者利用只有 Pump.fun 員工才能存取的私鑰，將原本用於 Solana 上的去中心化交易所 Raydium 的資金重新路由到不相關的錢包位址。

Igor Igamberdiev, head of research at crypto market maker Wintermute, estimated that the attacker siphoned off at least $2 million worth of SOL through this exploit. However, in an unexpected twist, the attacker immediately began airdropping the stolen funds to random wallet addresses.

加密貨幣做市商 Wintermute 研究主管 Igor Igamberdiev 估計，攻擊者透過此漏洞竊取了至少價值 200 萬美元的 SOL。然而，出人意料的是，攻擊者立即開始將被盜資金空投到隨機錢包地址。

The Attacker's Motive

攻擊者的動機

Within minutes of the attack, a Twitter account belonging to a self-proclaimed former Pump.fun employee claimed responsibility. The user, known as @pumpfunrobber, posted extensively about the exploit, expressing indifference towards imprisonment and revealing that his identity had been doxxed.

襲擊發生後幾分鐘內，一名自稱前 Pump.fun 員工的 Twitter 帳戶聲稱對此事負責。該用戶名為@pumpfunrobber，廣泛發布了有關該漏洞的信息，表達了對監禁的冷漠態度，並透露他的身份已被人肉搜索。

The attacker's posts revealed a deep-seated resentment towards Pump.fun, alleging mismanagement and personal grievances. In a Twitter Spaces, he stated that he "just kind of wanted to kill Pump.fun because it's something to do" and that the company had "inadvertently hurt people for a long time."

攻擊者的貼文揭示了對 Pump.fun 根深蒂固的不滿，聲稱管理不善和個人不滿。他在 Twitter Spaces 中表示，他“只是想殺死 Pump.fun，因為這是要做的事”，該公司“長期以來無意中傷害了人們”。

Pump.fun's Response

Pump.fun 的回應

Pump.fun promptly paused trading on the protocol after the attack and announced an investigation into the matter. The company declared its intention to cooperate with law enforcement, considering that the attacker is reportedly a Canadian citizen.

攻擊發生後，Pump.fun 立即暫停了該協議的交易，並宣布對此事進行調查。考慮到據報襲擊者是加拿大公民，該公司宣布打算與執法部門合作。

In a statement, Pump.fun addressed the potential impact on users: "We are aware that the bonding curve contracts have been compromised and are investigating the matter. We have upgraded the contracts so the attacker cannot siphon any more funds. The TVL in the protocol right now is safe."

Pump.fun 在聲明中談到了對用戶的潛在影響：「我們意識到聯合曲線合約已被洩露，正在調查此事。我們已經升級了合約，以便攻擊者無法竊取更多資金。現在的協議是安全的。

Meme Coin Mania: A Double-Edged Sword

迷因幣狂熱：一把雙面刃

Pump.fun has experienced significant trading volume in recent months due to the surge in meme coin popularity. However, this trend has also attracted criticism, as meme coins often lack intrinsic value and can foster speculative behavior.

由於 meme 幣受歡迎程度的激增，Pump.fun 近幾個月的交易量大幅增加。然而，這種趨勢也招致了批評，因為迷因幣往往缺乏內在價值，並且會助長投機行為。

The self-proclaimed Pump.fun attacker echoed these concerns, asserting that the company was on a downward trajectory and that he had accelerated its demise. He also claimed to have witnessed unethical practices within the company, but provided no concrete evidence.

這位自稱 Pump.fun 的攻擊者也回應了這些擔憂，聲稱該公司正處於下滑軌道，而他加速了該公司的滅亡。他還聲稱親眼目睹了公司內部的不道德行為，但沒有提供具體證據。

Legal Implications

法律影響

The Pump.fun exploit has raised legal questions, as the attacker faces potential charges of theft and fraud. Law enforcement agencies are likely to investigate the incident thoroughly, especially considering the large sums of money involved.

Pump.fun 漏洞利用引發了法律問題，因為攻擊者可能面臨盜竊和欺詐指控。執法機構可能會對這一事件進行徹底調查，特別是考慮到涉及的巨額資金。

Lessons Learned

得到教訓

The Pump.fun exploit serves as a stark reminder of the need for robust security measures in the crypto industry. It also highlights the potential risks associated with meme coin mania and the importance of investor due diligence.

Pump.fun 漏洞清楚地提醒人們加密產業需要採取強而有力的安全措施。它還強調了與迷因幣狂熱相關的潛在風險以及投資者盡職調查的重要性。

As the crypto landscape continues to evolve, it is crucial for platforms and users alike to prioritize security and ethical considerations. The Pump.fun exploit should serve as a wake-up call to address vulnerabilities and foster a more responsible crypto ecosystem.

隨著加密貨幣領域的不斷發展，平台和用戶都必須優先考慮安全和道德因素。 Pump.fun 漏洞應該為解決漏洞並培育更負責任的加密生態系統敲響警鐘。