Pump.fun, a Solana-based memecoin launchpad, has identified a former employee as the mastermind behind a daring exploit that resulted in the theft of approximately $1.9 million worth of SOL. The incident occurred on Thursday, with the former employee leveraging their privileged position to gain admin access and manipulate the platform's bonding curves.

According to Pump.fun's post-mortem analysis, the exploiter utilized flash loans to borrow SOL and buy out memecoins, ultimately draining liquidity from the platform. This brazen attack affected a relatively small portion of the total liquidity within the bonding curve contracts, with only $1.9 million out of $45 million being compromised.

Pump.fun swiftly responded to the incident, halting trading and upgrading its contracts to prevent further damage. The platform has since resumed operations, with its contracts deemed safe and secure. To rectify the situation, the Pump.fun team will seed the affected coins with an equal or greater amount of SOL liquidity within the next 24 hours.

Interestingly, the exploiter, identified as "Stacc" on X, has publicly acknowledged their involvement, expressing disdain for their former employers at Pump.fun. Another X user, @valerio_eth, who claims to be the first engineer hired by Pump.fun, has also come forward, stating that they had worked closely with Stacc in the past.

Pump.fun, which enables users to create new tokens for a minimal fee, prides itself on its robust security measures, including the prevention of "rugs" and the prohibition of presales and team allocations for new coins. The platform's bonding curve mechanism sets the price of tokens based on current supply, and its trading functionality allows users to buy and sell their holdings. With daily revenue exceeding $1.2 million, Pump.fun has been experiencing significant user activity, making this exploit a notable exception rather than the norm.