Solana Memecoin creation tool Pump.fun claimed that a former employee extorted the company out of approximately $2 million through a “bond curve” attack.
The former employee used his “privileged position” to gain access to “withdrawal authority” and compromise the protocol’s internal systems, Pump.fun. It was claimed in X’s post on May 16th.
Approximately $1.9 million of the total $45 million held in Pump.fun’s bonding curve contracts was stolen.
The platform has temporarily suspended trading, but is now back up and running.
Pump.fun smart contracts are “secure” and users affected by the incident will receive “100% of the liquidity” they previously held within the next 24 hours, Pump.fun said.
Prior to Pump.fun’s post, Igor Igamberdiev, head of research at cryptocurrency marketplace maker Wintermute, claimed that the hack was caused by an internal private key leak attributed to X user “STACCoverflow.”
In a series of cryptic X posts, STACCoverflow “seeks to change the course of history. n (sic) Then you rot in prison.” “I don’t care, I’ve already been completely doxxed,” they added in a separate post.
Related: The Solana memecoin hit a whopping $328 trillion market cap for all the wrong reasons.
In a previous X post, Pump.fun said it was cooperating with law enforcement. It did not name the former employee and did not immediately respond to a request for comment.
How the hack unfolded
The suspect borrowed Solana (SOL) using flash loans on Raydium, the Solana lending protocol, and used the money to “purchase as many coins” as possible, Pump.fun said.
Once the coin reaches 100% on that bonding curve, the exploiter can access the bonding curve liquidity to repay the flash loan.
The Pump.fun sai attack occurred between 3:21 PM and 5:00 PM UTC on May 16, resulting in the theft of approximately 12,300 SOLs worth approximately $1.9 million.
Solana Memecoin Launchpad stated that between this time, affected users will recover more than 100% of the liquidity they had prior to the attack.
magazine: 1 in 6 new Base Meme coins are a scam, and 91% have vulnerabilities.