Solana-based meme coin launchpad Pump.fun revealed that a former employee exploited their "privileged position" to access "withdraw authority," misappropriating around 12,300 SOL, valued at approximately $1.9 million at the time.

To prevent further issues, Pump.fun halted trading and updated the contracts.

Flash Loan Exploit

Pump.fun addressed the exploit, stating in a post on X that a former employee misused their withdrawal authority, which they had gained through their previous role in the company.

The individual used flash loans on a Solana lending protocol to borrow SOL and buy coins, pushing them to 100% on their bonding curves. This allowed them to access the bonding curve liquidity and repay the flash loans.

Trading on the platform was halted shortly after the exploit. Out of $45 million in total liquidity, approximately $1.9 million was affected. The Pump.fun team then redeployed the contracts and resumed trading with a 0% fee for the next seven days.

The platform noted that the tokens reaching 100% during the exploit are currently in limbo and untradeable until liquidity pools are deployed for them on the Solana lending protocol, Raydium. To compensate users, the team promised to replenish the liquidity pools for the affected coins with an equal or greater amount of SOL within the next 24 hours.

“Please bear with us as we aim to resume the trading of these coins in a safe and structured manner. We have been working with esteemed security experts to minimize the impact and ensure this never happens again.”

Internal Private Key Leak

Before Pump.fun's announcement, Wintermute's head of research, Igor Igamberdiev, attributed the hack to an internal private key leak and suspected X user "STACCoverflow."

Shortly thereafter, X user "Stacc" admitted to executing the exploit, criticizing their "horrible bosses" at Pump.fun and describing them as unfit representatives of the blockchain community.