Solana

Solana memecoin creation tool pump.fun has claimed a former employee exploited the firm for nearly $2 million through a “bonding curve” attack. 
The ex-employee used their “privileged position” to access a “withdraw authority” and compromise the protocol’s internal systems, pump.fun alleged in a May 16 X <a href="https://x.com/pumpdotfun/status/1791235050643636303" target="_blank" rel="noopener nofollow">post</a>.
About $1.9 million was stolen from the total $45 million held in pump.fun’s bonding curve contracts. 
The platform temporarily paused trading but it is now back up and running.
The pump.fun smart contracts “are safe,” and users impacted by the incident will receive “100% of the liquidity” that it previously had within the next 24 hours, pump.fun said.
<figure data-ct-non-breakable="true">
 <img src="https://s3.cointelegraph.com/uploads/2024-05/879a8ec3-c090-4114-8cf9-1a1558f844e4.jpg" alt="" title="">
 <figcaption style="text-align: center;">
 Source: <a href="https://x.com/pumpdotfun/status/1791235050643636303" target="_blank" rel="noopener nofollow">pump.fun</a>
 </figcaption>
</figure>
Prior to pump.fun’s post, Igor Igamberdiev, the head of research at cryptocurrency market maker Wintermute, <a href="https://x.com/FrankResearcher/status/1791164323047293325" target="_blank" rel="noopener nofollow">claimed</a> the hack came about from an internal private key leak, which he suspected to be X user “STACCoverflow.”
In a series of cryptic X posts, STACCoverflow <a href="https://x.com/STACCoverflow/status/1791134470071865576" target="_blank" rel="noopener nofollow">claimed</a> they were “about to change the course of history. n [sic] then rot in jail.” They added in a separate post they “do not care, I am already fully doxxed.”
Related: <a href="https://cointelegraph.com/news/solana-memecoin-hits-328-trillion-market-cap-but-its-honeypot">Solana memecoin hits a whopping $328T market cap — for all the wrong reasons</a>
In an earlier X post, pump.fun <a href="https://x.com/pumpdotfun/status/1791164438852083807" target="_blank" rel="noopener nofollow">said</a> it has been collaborating with law enforcement. It did not name the former employee and did not immediately respond to a request for comment.
<h3 data-ct-non-breakable="true" id="how-the-hack-unfolded">How the hack unfolded</h3>
The alleged exploiter used flash loans on a Solana lending protocol Raydium to borrow Solana's (<a href="https://cointelegraph.com/solana-price-index">SOL</a>) token, which was then used to “buy as many coins” as possible, pump.fun said.
Once the coins hit 100% on their respective bonding curves, the exploiter could then access the bonding curve liquidity and repay the flash loans.
Approximately 12,300 SOL, worth $1.9 million, was stolen in the attack, which pump.fun sai occurred between 3:21 pm and 5:00 pm UTC on May 16.
The <a href="https://cointelegraph.com/news/solana-memecoin-crypto-utility-reputation">Solana memecoin launchpad</a> said users impacted between these hours would recover 100% or more of the liquidity held prior to the attack.
Magazine:&nbsp;<a href="https://cointelegraph.com/magazine/base-meme-coins-scams-vulnerabilities-honeypot/">1 in 6 new Base meme coins are scams, 91% have vulnerabilities</a>

Memecoin launcher pump.fun claims ex-employee behind $1.9M exploit

Table of Contents

Cointelegraph

Other articles published on May 17, 2024

Notcoin’s [NOT] ‘rocky’ launch – How a $1 billion start ended with a major sell-off

BlockDAG Rolls Out New Dashboard, Raises $26.9M in Presale, Surpasses BNB Chain and XRP Price

OpenAI Secures Reddit Content for ChatGPT Improvement

5 Lesser-Known Altcoins to Buy Amid Bitcoin’s Bounce Back

Memereum Partners With Toobit For Token Pre-Listing

Bitcoin ETFs compensate April outflows, analyst predicts long-term returns

Join our free newsletter for daily crypto updates!