W3BStation
Markets
BTC $96,420 +2.34% ETH $3,280 +1.82% SOL $185.40 -0.92% BNB $642.50 +0.45% XRP $2.18 +3.12% DOGE $0.082 -1.50% ADA $1.05 +0.80% AVAX $42.10 +1.15%
BTC $96,420 +2.34% ETH $3,280 +1.82% SOL $185.40 -0.92% BNB $642.50 +0.45% XRP $2.18 +3.12% DOGE $0.082 -1.50% ADA $1.05 +0.80% AVAX $42.10 +1.15%
05/16/2024

Token Issuance Platform Pump.fun on Solana Hacked

The token issuance platform pump.fun on Solana has been hacked, with the attacker draining large amounts of memecoins issued on the platform.

Token Issuance Platform Pump.fun on Solana Hacked

The token issuance platform pump.fun on Solana has been hacked, with the attacker draining large amounts of memecoins issued on the platform.

Token Issuance Platform Pump.fun on Solana Hacked

On-chain data confirms that pump.fun was exploited. The vulnerability appears to be tied to the application's bonding curve mechanism.


Pump.fun was exploited, resulting in significant memecoin losses.

Before the attack, the hacker took out a flash loan through marginfi, used the borrowed SOL to exploit the vulnerability in pump.fun, repaid the loan, and walked away with a large haul of memecoins from the platform.

Marginfi posted a tweet clarifying that its platform is operating normally and that the vulnerability was isolated to pump.fun. Marginfi is currently working with pump.fun to help address the issue.

Hacker's Bizarre Tweets

Following the attack, the hacker posted a string of erratic tweets from their Twitter account, adding another strange layer to the incident.


The hacker's erratic tweets after the exploit. Source: Twitter (05/16/2024)

Damage Assessment

A full damage estimate is still unavailable. However, in the hour following the attack, a large number of memecoins were withdrawn from pump.fun to the hacker's wallet address "5Px...2Qx."

According to Igor Igamberdiev, a blockchain researcher at Wintermute, the actual damage is estimated at around $300,000 — far below the $80 million figure that spread across social media.

The crypto community quickly identified the attacker as Jarrett Reginald S Dunn from Nova Scotia, Canada.

About Pump.fun

Pump.fun is a platform designed for low-cost token launches. Newly created tokens build momentum through a bonding curve mechanism and, once they hit a sufficient market cap, get listed directly on Raydium. Before the exploit, pump.fun had quickly climbed into the top 10 applications by transaction fee revenue.

Key Highlights:

  • Flash Loan Exploit: The attacker used a flash loan from marginfi to exploit the bonding curve vulnerability on pump.fun.
  • Marginfi's Clarification: Marginfi confirmed its platform is secure and is helping pump.fun resolve the issue.
  • Hacker's Identity: The attacker was identified as Jarrett Reginald S Dunn from Nova Scotia, Canada.
  • Damage Estimates: Current estimates put losses at around $300,000 — not the $80 million rumored on social media.
  • Pump.fun's Role: The platform supports low-cost token issuance via a bonding curve mechanism and had been rapidly rising in transaction fee rankings prior to the attack.

This incident underscores the persistent security challenges facing decentralized platforms and the critical need for strong safeguards to protect user funds and platform integrity.