Bitget App
Trade smarter
Buy cryptoMarketsTradeFuturesEarnWeb3SquareMore
Trade
Spot
Buy and sell crypto with ease
Margin
Amplify your capital and maximize fund efficiency
Onchain
Going Onchain, without going Onchain!
Convert
Zero fees, no slippage
Explore
Launchhub
Gain the edge early and start winning
Copy
Copy elite trader with one click
Bots
Simple, fast, and reliable AI trading bot
Trade
USDT-M Futures
Futures settled in USDT
USDC-M Futures
Futures settled in USDC
Coin-M Futures
Futures settled in cryptocurrencies
Explore
Futures guide
A beginner-to-advanced journey in futures trading
Futures promotions
Generous rewards await
Overview
A variety of products to grow your assets
Simple Earn
Deposit and withdraw anytime to earn flexible returns with zero risk
On-chain Earn
Earn profits daily without risking principal
Structured Earn
Robust financial innovation to navigate market swings
VIP and Wealth Management
Premium services for smart wealth management
Loans
Flexible borrowing with high fund security
Pump.fun identifies $1.9 million exploiter as former employee in post mortem

Pump.fun identifies $1.9 million exploiter as former employee in post mortem

The BlockThe Block2024/05/17 04:34
By:The Block

Quick Take Pump.fun identified the profiteers behind the $1.9 million exploit as a former employee. The platform laid out plans to compensate users that suffered from the exploit in a post-mortem posted on X.

Pump.fun identifies $1.9 million exploiter as former employee in post mortem image 0

Solana-based memecoin launchpad Pump.fun said a former employee was behind the exploit that took place Thursday. 

The incident involved a former employee gaining pump.fun's admin privileges, resulting in the misappropriation of approximately 12,300 SOL, valued around $1.9 million at the time.

“At 15:21 UTC, a former employee, having illegitimately taken access of the withdraw authority using their privileged position at the company, used flash loans on a Solana lending protocol,” the platform said in a post-mortem posted on X. 

The loans were used to borrow SOL to buy out as many memecoins until they hit 100% on their bonding curves, which allowed the exploiter to gain liquidity to repay the flash loans, Pump.fun detailed. This affected roughly $1.9 million out of a total of $45 million in liquidity within the bonding curve contracts during a specific timeframe.

“By 17:00 UTC, all trading on pump.fun was halted. Out of a total of $45m of liquidity in the bonding curve contracts, only ~$1.9m was affected,” the platform said.

Pump.fun had paused trading and upgraded the contracts on the platform to stop further damage. The platform is back live, and its contracts remain safe, it added.

“To make users whole, the pump.fun team will seed the LPs for each affected coin with an equal or greater amount of SOL liquidity that the coin had at 15:21 UTC within the next 24 hours,” the platform said, adding that its trading fees are set to 0% for the next seven days. 

Meanwhile, X user that goes by the name “Stacc” acknowledged that they had executed the exploit. In their thread of tweets, Stacc expressed disdain for their “horrible bosses” that appear to describe Pump.fun, who they said are “not the type of ppl you want front n center as the face of blockchain.”

Another X user  @valerio_eth , who claimed to be the first engineer that Pump.fun had hired, stated that they had worked in-person with Stacc.

What is Pump.fun?

Solana-based Pump.fun helps users create new tokens for a minimal fee of around a few dollars. The platform emphasizes its security measures, writing on its website that it "prevents rugs by making sure that all created tokens are safe" by prohibiting presales and team allocations for new coins.

Users can mint new tokens and determine their purchase price through a bonding curve mechanism, which sets the price based on current supply. Trading functionality allows users to buy and sell their holdings.

An additional feature automatically locks a portion of a token's liquidity pool, about $12,000, into Raydium and permanently removes it from circulation if the token reaches a specific market capitalization of around $69,000.

Pump.fun appears to be experiencing significant user activity, with the daily revenue exceeding $1.2 million on Tuesday, according to The Block’s data dashboard .


0

Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.

PoolX: Locked for new tokens.
APR up to 10%. Always on, always get airdrop.
Lock now!