Pump.fun, a DeFi memecoin platform based on Solana, suffered a significant breach on May 16 when an exploiter used flash loans to manipulate the platform’s bonding curve contracts.

Following the exploit, Pump.fun has halted all trading activities and issued a statement on social media acknowledging the incident. The platform assured users that they have upgraded the affected contracts to prevent further funds from being drained. They confirmed the Total Value Locked (TVL) in the protocol remains secure. Currently, trading has been paused, preventing any buying or selling of coins. Additionally, coins in the process of migrating to Raydium will not proceed with migration indefinitely.

Experts such as Igor Igamberdiev, Wintermute's head of research, suggested a compromised key might be involved, hinting at a potential internal breach. He estimated the losses to be at least 12,000 SOL, equivalent to approximately $2 million.

Shortly after news of the exploit surfaced, an account named STACCoveflow on X claimed responsibility for the attack, suggesting broader intentions beyond personal gain, stating, "I’m about to change the course of history." STACC implied redistributing the remaining balances from bonding curves to certain token users. However, the exact method used for the attack and the status of the redistributed funds remain unclear.

Allegedly belonging to a doxxed developer formerly associated with Pump.fun, the STACC account reportedly airdropped stolen SOL to holders of four different coins. However, these claims have not been independently verified by CryptoSlate at the time of reporting.