blockworks.co
Pump.fun was attacked Thursday by an exploiter who seemingly used flash loans to buy out the bonding curve.
In a post on X, Pump.fun said that it was “aware” that the contracts were compromised and were investigating.
“We have upgraded the contracts so the attacker cannot siphon any more funds. The TVL in the protocol right now is safe,” the team said. “We’ve paused trading — you cannot buy and sell any coins at the moment. Any coins that are currently in the process of migrating to Raydium cannot be traded and will not be migrating for an indefinite period of time.”
Igor Igamberdiev, head of research at Wintermute, analyzed the situation in a series of posts on X, saying that the key was compromised, “though the possibility of an inside job remains.”
Igamberdiev said that the amount lost by Pump.fun is “at least” 12,000 SOL, or roughly $2 million.
An account on X going by Stacc seemed to take credit for the attack, writing “I’m about to change the course of history” in a post.
Stacc seemed to imply in his posts that he didn’t intend to keep the stolen funds, but rather planned to transfer the “remaining balances of bonding curves” to some token users.
It’s not clear as of publication how Stacc was able to execute the attack, or if they’re distributing the balances to random people.
As Blockworks previously reported, Pump.fun lets developers launch tokens without seed liquidity for a couple of dollars. Its revenue comes from users buying and selling tokens.
Tokens that exceed market caps of $69,000 can then be listed on the Raydium DEX.
This is a developing story.