Solana-based DeFi memecoin platform Pump.fun skilled a major breach on Might 16 when an exploiter apparently utilized flash loans to control the platform’s bonding curve contracts.
The platform has since paused all trading actions.
In a statement on social media, Pump.fun acknowledged the exploit and guaranteed customers that the platform is investigating the problem. The staff wrote:
“We have upgraded the contracts so the attacker cannot siphon any more funds. The TVL in the protocol right now is safe. We’ve paused trading — you cannot buy and sell any coins at the moment. Any coins that are currently in the process of migrating to Raydium cannot be traded and will not be migrating for an indefinite period of time.”
Trade consultants, together with Wintermute head of analysis Igor Igamberdiev, advised {that a} key had been compromised, elevating the potential for an inside job. He estimated the loss to be at the least 12,000 SOL, equal to roughly $2 million.
An account on X, recognized as STACCoveflow, claimed accountability for the assault shortly after the exploit broke within the information. Stacc hinted at a bigger motive of their posts, stating:
“I’m about to change the course of history.”
He implied that he didn’t intend to maintain the stolen funds however deliberate to redistribute the “remaining balances of bonding curves” to sure token customers. The precise methodology Stacc used to execute the assault stays unclear, and it’s unknown if the balances are certainly being distributed to different customers.
The account allegedly belongs to a doxxed developer who beforehand labored on Pump.fun. Moreover, a number of accounts claimed that Stacc had airdropped the stolen SOL to holders of 4 completely different cash.
Nonetheless, CryptoSlate was unable to confirm the claims on social media as of press time.
