Pump.fun 黑客攻击：流氓员工窃取数百万美元，重新分配到随机钱包

Pump.fun Exploited: Rogue Employee Drains Millions and Redistributes to Random Wallets

Pump.fun 被利用：流氓员工吸走数百万美元并重新分配到随机钱包

On Thursday, Pump.fun, a popular platform for launching meme coins on Solana, fell victim to a brazen exploit that compromised the protocol and resulted in the theft of millions of dollars worth of cryptocurrency. The incident has sent shockwaves through the crypto community and raised serious concerns about the security and ethics of meme coin mania.

周四，Pump.fun（一个在 Solana 上推出模因币的流行平台）成为了一次无耻漏洞的受害者，该漏洞破坏了协议，并导致价值数百万美元的加密货币被盗。该事件在加密货币社区引起了轩然大波，并引发了人们对模因币狂热的安全和道德的严重担忧。

The Attack

攻击

The attack targeted bonding curve contracts, which facilitate the liquidity of tokens generated on Pump.fun. Utilizing a private key accessible only to Pump.fun employees, the attacker rerouted funds intended for Raydium, a decentralized exchange on Solana, to unrelated wallet addresses.

这次攻击针对的是联合曲线合约，该合约促进了 Pump.fun 上生成的代币的流动性。攻击者利用只有 Pump.fun 员工才能访问的私钥，将原本用于 Solana 上的去中心化交易所 Raydium 的资金重新路由到不相关的钱包地址。

Igor Igamberdiev, head of research at crypto market maker Wintermute, estimated that the attacker siphoned off at least $2 million worth of SOL through this exploit. However, in an unexpected twist, the attacker immediately began airdropping the stolen funds to random wallet addresses.

加密货币做市商 Wintermute 研究主管 Igor Igamberdiev 估计，攻击者通过此漏洞窃取了至少价值 200 万美元的 SOL。然而，出人意料的是，攻击者立即开始将被盗资金空投到随机钱包地址。

The Attacker's Motive

攻击者的动机

Within minutes of the attack, a Twitter account belonging to a self-proclaimed former Pump.fun employee claimed responsibility. The user, known as @pumpfunrobber, posted extensively about the exploit, expressing indifference towards imprisonment and revealing that his identity had been doxxed.

袭击发生后几分钟内，一名自称前 Pump.fun 员工的 Twitter 账户声称对此事负责。该用户名为@pumpfunrobber，广泛发布了有关该漏洞的信息，表达了对监禁的冷漠态度，并透露他的身份已被人肉搜索。

The attacker's posts revealed a deep-seated resentment towards Pump.fun, alleging mismanagement and personal grievances. In a Twitter Spaces, he stated that he "just kind of wanted to kill Pump.fun because it's something to do" and that the company had "inadvertently hurt people for a long time."

攻击者的帖子揭示了对 Pump.fun 根深蒂固的不满，声称管理不善和个人不满。他在 Twitter Spaces 中表示，他“只是想杀死 Pump.fun，因为这是要做的事”，并且该公司“长期以来无意中伤害了人们”。

Pump.fun's Response

Pump.fun 的回应

Pump.fun promptly paused trading on the protocol after the attack and announced an investigation into the matter. The company declared its intention to cooperate with law enforcement, considering that the attacker is reportedly a Canadian citizen.

攻击发生后，Pump.fun 立即暂停了该协议的交易，并宣布对此事进行调查。考虑到据报道袭击者是加拿大公民，该公司宣布打算与执法部门合作。

In a statement, Pump.fun addressed the potential impact on users: "We are aware that the bonding curve contracts have been compromised and are investigating the matter. We have upgraded the contracts so the attacker cannot siphon any more funds. The TVL in the protocol right now is safe."

Pump.fun 在一份声明中谈到了对用户的潜在影响：“我们意识到联合曲线合约已被泄露，正在调查此事。我们已经升级了合约，以便攻击者无法窃取更多资金。现在的协议是安全的。”

Meme Coin Mania: A Double-Edged Sword

迷因币狂热：一把双刃剑

Pump.fun has experienced significant trading volume in recent months due to the surge in meme coin popularity. However, this trend has also attracted criticism, as meme coins often lack intrinsic value and can foster speculative behavior.

由于 meme 币受欢迎程度的激增，Pump.fun 近几个月的交易量大幅增加。然而，这种趋势也招致了批评，因为模因币往往缺乏内在价值，并且会助长投机行为。

The self-proclaimed Pump.fun attacker echoed these concerns, asserting that the company was on a downward trajectory and that he had accelerated its demise. He also claimed to have witnessed unethical practices within the company, but provided no concrete evidence.

这位自称 Pump.fun 的攻击者也回应了这些担忧，声称该公司正处于下滑轨道，而他加速了该公司的灭亡。他还声称亲眼目睹了公司内部的不道德行为，但没有提供具体证据。

Legal Implications

法律影响

The Pump.fun exploit has raised legal questions, as the attacker faces potential charges of theft and fraud. Law enforcement agencies are likely to investigate the incident thoroughly, especially considering the large sums of money involved.

Pump.fun 漏洞利用引发了法律问题，因为攻击者可能面临盗窃和欺诈指控。执法机构可能会对这一事件进行彻底调查，特别是考虑到涉及的巨额资金。

Lessons Learned

得到教训

The Pump.fun exploit serves as a stark reminder of the need for robust security measures in the crypto industry. It also highlights the potential risks associated with meme coin mania and the importance of investor due diligence.

Pump.fun 漏洞清楚地提醒人们加密行业需要采取强有力的安全措施。它还强调了与迷因币狂热相关的潜在风险以及投资者尽职调查的重要性。

As the crypto landscape continues to evolve, it is crucial for platforms and users alike to prioritize security and ethical considerations. The Pump.fun exploit should serve as a wake-up call to address vulnerabilities and foster a more responsible crypto ecosystem.

随着加密货币领域的不断发展，平台和用户都必须优先考虑安全和道德因素。 Pump.fun 漏洞应该为解决漏洞并培育更负责任的加密生态系统敲响警钟。