由於私鑰洩露，閃貸攻擊導致 Pump.Fun 損失 200 萬美元的 SOL

Memecoin 啟動板 Pump.Fun 今天成為漏洞的受害者，導致價值約 200 萬美元的 SOL 被盜。攻擊者利用該平台的服務帳戶提取 Raydium 的流動性，然後將其用於償還閃貸並向 Solana 代幣持有者捐贈資金。 Pump.Fun 團隊升級了合約以防止進一步的損害，並強調用戶錢包和燒毀的代幣是安全的。

Pump.Fun Exploited for $2 Million in SOL Amidst Private Key Compromise

Pump.Fun 因私鑰洩漏而被利用，索取 200 萬美元的 SOL

In a brazen cyberattack today, Pump.Fun, a memecoin launchpad platform, fell victim to a malicious flashloan exploit that siphoned away a staggering 12,300 SOL, valued at approximately $2 million.

在今天的無恥網路攻擊中，memecoin 啟動平台 Pump.Fun 成為惡意閃貸漏洞的受害者，該漏洞竊取了驚人的 12,300 SOL，價值約 200 萬美元。

The sophisticated attack utilized flashloans, instantaneous loans designed to be borrowed and repaid within a single blockchain block, to drain funds from the platform. According to analysts, the exploiter was able to gain access to Pump.Fun's service account, which acted as a cosigner for all of the attacker's transactions, suggesting a possible private key compromise.

這次複雜的攻擊利用了閃貸，即旨在在單一區塊鏈區塊內借入和償還的即時貸款，以從平台中抽走資金。據分析人士稱，攻擊者能夠訪問 Pump.Fun 的服務帳戶，該帳戶充當攻擊者所有交易的共同簽署者，這表明可能存在私鑰洩露。

Pump.Fun's service account is responsible for burning bonding curve liquidity to Raydium, a decentralized exchange, once a token has filled its bonding curve on Pump.Fun, allowing the token to commence trading on the open market. However, by accessing the service account through the compromised key, the hacker intercepted the liquidity meant for Raydium, used it to repay the flashloan, and donated the remaining funds to holders of various Solana tokens.

一旦代幣在 Pump.Fun 上填滿其聯合曲線，Pump.Fun 的服務帳戶負責將聯合曲線流動性燃燒至去中心化交易所 Raydium，從而允許代幣開始在公開市場上進行交易。然而，透過洩漏的金鑰存取服務帳戶，駭客截獲了 Raydium 的流動性，用其償還閃貸，並將剩餘資金捐贈給各種 Solana 代幣的持有者。

In response to the attack, the Pump.Fun team swiftly upgraded their contracts to prevent further damage. They have assured users that all wallets connected to the application remain secure, and any tokens previously burned to Raydium are unaffected. However, trading on Pump.Fun has been temporarily suspended, and tokens that were manipulated to migrate to Raydium via the exploit will remain in limbo for an indefinite period.

為了應對此次攻擊，Pump.Fun 團隊迅速升級了合同，以防止進一步的損害。他們向用戶保證，連接到該應用程式的所有錢包都是安全的，之前燒錄到 Raydium 的任何代幣都不會受到影響。然而，Pump.Fun 上的交易已暫時停止，透過該漏洞操縱遷移到 Raydium 的代幣將無限期地處於不確定狀態。

Pump.Fun, a platform that empowers non-technical individuals to launch memecoins with minimal effort or expense, has seen explosive growth, enabling the launch of hundreds of tokens on Blast and Solana. According to DeFiLlama, the platform generated over $10 million in revenue last month alone.

Pump.Fun 是一個讓非技術人員能夠以最少的努力或費用推出 memecoin 的平台，該平台已經實現了爆炸性增長，使得在 Blast 和 Solana 上推出了數百種代幣。據 DeFiLlama 稱，該平台僅上個月就創造了超過 1000 萬美元的收入。

The incident highlights the vulnerabilities that persist in the decentralized finance (DeFi) ecosystem, particularly around private key security and the potential for malicious flashloan exploits. As DeFi continues to gain popularity, the industry must prioritize robust security measures to safeguard user assets and maintain investor confidence.

這起事件凸顯了去中心化金融（DeFi）生態系統中持續存在的漏洞，特別是在私鑰安全和惡意閃貸利用的可能性方面。隨著 DeFi 的不斷普及，業界必須優先考慮強有力的安全措施，以保護用戶資產並維持投資者信心。