Solana Platform Pump.fun Suffers Flash Loan Exploit With Contracts Drained

Pump.fun, a Solana-based token launch platform that enables users to create memecoins with relative ease, has suffered a security exploit. While the root cause of the exploit remains unknown, it appears user funds in liquidity pools on the platform are being drained using a flash loan from the DeFi protocol, MarginFi.

In the meantime, Solana wallet provider Phantom, which integrates with Pump.fun, has placed a warning on the Pump.fun website. Users who try to access the platform are greeted with a message noting that the website is “malicious and unsafe to use.”

Pump.fun Issues Update On Security Exploit

At press time, Pump.fun released an update clarifying that the exploit involved the protocols bonding curve contracts, which evidently handle liquidity on the platform. Following investigations, the Pump.fun team has upgraded its contracts to prevent the hacker from accessing more user funds.

In the meantime, the platform has disabled trading and is collaborating with law enforcement, as well as partners, to minimize the damage. Users who have connected their wallets to Pump.fun also do not need to take additional action, as the security exploit did not compromise their private keys.

We are aware that the https://t.co/uE2QNKXkIT bonding curve contracts have been compromised and are investigating the matter.

We have upgraded the contracts so the attacker cannot siphon any more funds. The TVL in the protocol right now is safe.

We’ve paused trading — you…

— pump.fun (@pumpdotfun) May 16, 2024

Meanwhile, Pump.fun, in a subsequent update, confirmed in line with speculations that a former employee had taken advantage of their privileged position to exploit the protocol’s contracts. Nonetheless, they were only able to steal approximately $1.9 million out of the $45 million locked on the platform. Trading has resumed on the platform since then, with memecoins retaking center stage.

Given that Solana’s blockchain ecosystem and SOL usage have largely been driven by memecoin traders in recent times, it is worth noting that the cryptocurrency has not been badly hit by the latest exploit. SOL is trading at $159 at the time of writing, representing a 4% increase in the past 24 hours.

Update: This article has been updated to reflect new information from Pump.fun that the total amount lost to the hack is an estimated $2 million. An earlier version mentioned $200,000 as the total amount lost.