Pump.fun 漏洞利用：前员工窃取 190 万美元，引发罗宾汉谣言

基于 Solana 的平台 Pump.fun 遭受攻击，导致数百万美元的用户资金被盗。虽然此次攻击最初引发了人们对 8000 万美元损失的担忧，但后来透露，一名前员工利用闪电贷和挪用资金窃取了约 190 万美元。此后，该平台团队升级了合约，向受影响的用户提供补偿，并声明该协议锁定的总价值仍然安全。

Pump.fun Exploit: Ex-Employee Misappropriates $1.9 Million, Prompts Crypto Robin Hood Speculation

Pump.fun 漏洞：前员工挪用 190 万美元，引发加密货币罗宾汉猜测

The Solana-based platform Pump.fun has fallen victim to a malicious exploit that has left the crypto community reeling. Millions of dollars in user funds have been pilfered, and the exact circumstances surrounding the attack remain shrouded in uncertainty. However, amidst the confusion, a tantalizing twist has emerged: the perpetrator may have been acting as a crypto Robin Hood, redistributing ill-gotten gains to the affected community.

基于 Solana 的平台 Pump.fun 成为恶意攻击的受害者，这让加密社区感到震惊。数百万美元的用户资金被盗，此次攻击的具体情况仍然存在不确定性。然而，在混乱之中，一个诱人的转折出现了：肇事者可能一直在充当加密罗宾汉，将不义之财重新分配给受影响的社区。

The Incident: Millions Vanish from Pump.fun

事件：数百万人从 Pump.fun 消失

On Thursday, Pump.fun announced that its bonding curve contracts had been compromised. Trading was immediately suspended while the platform's team scrambled to investigate the incident.

周四，Pump.fun 宣布其联合曲线合约已被泄露。交易立即暂停，平台团队忙于调查这一事件。

Pump.fun operates as a trading platform designed to prevent "rugs," a term used to describe scams where tokens are abandoned by their creators after raising funds. The platform allows users to launch instantly tradeable tokens with ease, eliminating the need for presales or team allocation.

Pump.fun 作为一个交易平台运营，旨在防止“地毯”，“地毯”一词用于描述代币在筹集资金后被其创建者抛弃的骗局。该平台允许用户轻松启动可即时交易的代币，无需预售或团队分配。

Speculation and Alarms: $80 Million Heist or Crypto Robin Hood?

猜测与警报：8000 万美元抢劫还是加密罗宾汉？

In the aftermath of the attack, the community was abuzz with speculation. Some users alleged that the attacker had siphoned away a staggering $80 million in crypto from the platform's bonding curve contracts. This alarming claim further fueled concerns among the impacted users.

袭击事件发生后，社会各界纷纷猜测。一些用户声称，攻击者从该平台的联合曲线合约中窃取了高达 8000 万美元的加密货币。这一令人震惊的说法进一步加剧了受影响用户的担忧。

However, the plot thickened when Lookonchain, a blockchain analytics firm, released its report. The report identified the hacker and revealed a surprising twist: the individual had initially acted as an innocent victim, inquiring about the extent of the damage. However, he later accused the platform's founders of withdrawing the stolen funds a day earlier.

然而，当区块链分析公司 Lookonchain 发布其报告时，情节变得更加复杂。该报告确定了黑客的身份，并揭示了一个令人惊讶的转折：此人最初充当无辜受害者，询问损害的程度。然而，他后来指责该平台的创始人在一天前撤回了被盗资金。

One user, who remains anonymous, suggested that the individual may have chosen to adopt the mantle of Robin Hood, distributing the hacked funds to the victims of crypto scams. The attacker himself alluded to such a motive in a post, expressing a desire to "change the course of history."

一位不愿透露姓名的用户表示，该人可能选择继承罗宾汉的衣钵，将被黑的资金分发给加密货币诈骗的受害者。攻击者本人在帖子中暗示了这样的动机，表达了“改变历史进程”的愿望。

Unveiling the Truth: A Misappropriation by a Former Employee

揭露真相：前雇员的挪用行为

Despite the speculation and the attacker's claims, the truth eventually emerged. Pump.fun's post-mortem post revealed that the perpetrator was a former employee who had exploited his privileged position to pilfer funds from the bonding curve contracts.

尽管有各种猜测和攻击者的说法，真相最终还是浮出水面。 Pump.fun 的验尸报告显示，肇事者是一名前雇员，他利用自己的特权地位从联合曲线合同中窃取资金。

The ex-employee had gained unauthorized access to accounts by obtaining their private keys. Using his insider knowledge, he borrowed SOL, a Solana-based cryptocurrency, from a lending protocol to purchase as many tokens as possible in Pump.fun.

前雇员通过获取私钥获得了未经授权的账户访问权限。他利用自己的内幕知识，从借贷协议中借用了 SOL（一种基于 Solana 的加密货币），在 Pump.fun 中购买了尽可能多的代币。

Once the tokens reached 100% on their respective bonding curves, the attacker utilized the compromised keys to access the bonding curve liquidity, repaying the loans he had taken out.

一旦代币在各自的联合曲线上达到 100%，攻击者就会利用受损的密钥来访问联合曲线流动性，偿还他所借出的贷款。

Fortunately, the attacker's access was limited, and he was only able to steal $1.9 million out of the $45 million liquidity in the contracts.

幸运的是，攻击者的访问权限受到限制，他只能从合约的 4500 万美元流动性中窃取 190 万美元。

Aftermath: Making Affected Users Whole

后果：让受影响的用户变得完整

Following the exploit, the Pump.fun team has taken swift action to redeploy the bonding curve contracts and implement measures to assist the impacted crypto investors.

漏洞发生后，Pump.fun 团队迅速采取行动，重新部署联合曲线合约，并采取措施帮助受影响的加密货币投资者。

As a gesture of goodwill, the team has pledged to "seed the LPs for each affected coin with an equal or greater amount of SOL liquidity that the coin had at 15:21 UTC within the next 24 hours." Additionally, trading fees will be waived for the next seven days.

为了表达善意，该团队承诺“在未来 24 小时内，为每个受影响的代币的 LP 注入与该代币在世界标准时间 15:21 时相同或更多的 SOL 流动性。”此外，未来 7 天内交易费用将被免除。

This move is a "non-trivial" concession, as Pump.fun generates approximately $1 million in daily revenue from fees. The team's commitment to rectifying the situation has been met with cautious optimism by the community.

这一举措是一个“不平凡”的让步，因为 Pump.fun 每天的收费收入约为 100 万美元。该团队对纠正这种情况的承诺得到了社区的谨慎乐观。

The Cipher: A Robin Hood or a Crypto Criminal?

密码：罗宾汉还是加密罪犯？

The Pump.fun exploit has raised intriguing questions about the nature of altruism and deceit in the crypto realm. While the initial speculation about a crypto Robin Hood may have been unfounded, the attacker's motives remain a subject of speculation.

Pump.fun 漏洞引发了有关加密领域利他主义和欺骗本质的有趣问题。虽然关于加密罗宾汉的最初猜测可能没有根据，但攻击者的动机仍然是猜测的主题。

Some argue that the attacker's decision to redistribute a portion of the stolen funds to victims of crypto scams may have been a genuine act of remorse or rebellion against the platform's founders. Others dismiss such claims, suggesting that the attacker's actions were driven solely by self-interest.

一些人认为，攻击者决定将部分被盗资金重新分配给加密货币诈骗的受害者，这可能是对该平台创始人的真正悔恨或反叛行为。其他人则驳斥了此类说法，认为攻击者的行为完全是出于自身利益。

As the crypto community grapples with the aftermath of the exploit, the full extent of the attacker's intentions may never be fully known. However, the incident serves as a stark reminder of the risks associated with investing in the crypto space and the importance of exercising due diligence when entrusting funds to third parties.

当加密社区努力应对漏洞利用的后果时，攻击者意图的全部范围可能永远不会被完全了解。然而，这一事件清楚地提醒人们，投资加密货币领域存在风险，以及在将资金委托给第三方时进行尽职调查的重要性。