Quick Take:

• Pump.fun identifies exploiter as a former employee.
• Approximately 12,300 SOL (around $1.9 million) misappropriated.
• Plans in place to compensate affected users.
• Trading on platform halted and later resumed with upgraded contracts.

In a detailed post-mortem report, Solana-based memecoin launchpad Pump.fun revealed that a former employee was responsible for the recent $1.9 million exploit. This incident, which involved the misappropriation of 12,300 SOL, highlights significant internal security challenges within the crypto platform.

The Incident Unfolds

On Thursday, Pump.fun experienced a severe security breach that saw a former employee take advantage of their previous admin privileges. At 15:21 UTC, the ex-employee used their access to manipulate the platform’s withdrawal authority. Utilizing flash loans from a Solana lending protocol, they managed to siphon off approximately 12,300 SOL, valued at around $1.9 million at the time.

The Exploit Mechanics

According to Pump.fun’s post-mortem, the exploiter borrowed SOL through flash loans, then rapidly purchased memecoins until these coins reached 100% on their bonding curves. This maneuver enabled the exploiter to gain sufficient liquidity to repay the flash loans, effectively laundering the stolen funds. The exploit impacted about $1.9 million out of a total of $45 million in liquidity within the bonding curve contracts during this short period.

Immediate Response and Mitigation

By 17:00 UTC, Pump.fun had halted all trading activities to prevent further losses. The platform quickly paused operations and initiated upgrades to their contracts, ensuring no additional damage could occur. Following these measures, the platform confirmed that it had resumed operations with enhanced security protocols in place.

Compensation Plans for Affected Users

Pump.fun has committed to compensating users who suffered losses due to the exploit. The platform announced it would replenish the liquidity pools for each affected coin with an equal or greater amount of SOL that was present at 15:21 UTC. This restoration process is expected to be completed within 24 hours of the announcement.

Additionally, as a goodwill gesture, Pump.fun has set trading fees to 0% for the next seven days to alleviate the impact on its user base.

The Exploiter’s Identity and Motive

The perpetrator, identified as an X user known as “Stacc,” admitted to the exploit in a series of tweets. Stacc justified their actions by expressing dissatisfaction with their former employers, describing them as “horrible bosses” and unsuitable representatives for the blockchain community. This revelation sparked further discussion among the community, with another user, @valerio_eth, who claimed to be Pump.fun’s first engineer, corroborating Stacc’s narrative and recounting their personal interactions with the exploiter.

About Pump.fun

Pump.fun is a Solana-based platform that facilitates the creation of new tokens for a minimal fee. It emphasizes security by preventing rug pulls and ensuring newly created tokens are safe by prohibiting presales and team allocations. Users can mint new tokens and set their purchase prices through a bonding curve mechanism, which adjusts prices based on current supply.

The platform also features an automatic liquidity lock mechanism. When a token reaches a market capitalization of approximately $69,000, around $12,000 of its liquidity pool is locked into Raydium and permanently removed from circulation. This feature aims to enhance the stability and security of the tokens traded on Pump.fun.

Moving Forward

The exploit at Pump.fun underscores the ongoing security challenges in the crypto space, particularly concerning insider threats. As the platform implements its compensation plan and strengthens its security measures, it hopes to restore trust among its users. The incident serves as a stark reminder of the importance of robust internal security protocols and vigilant oversight within cryptocurrency platforms.

Pump.fun’s swift response and commitment to compensating affected users may help mitigate some of the reputational damage caused by this exploit. However, the incident also highlights the need for continuous improvement and adaptation in the face of evolving security threats in the digital asset space.