cryptocurrency widget, price, heatmap
Burger icon
cryptocurrency widget, price, heatmap
News/Pump.Fun Exploit Rocks Solana: 12,300 SOL Stolen by Ex-Employee

Pump.Fun Exploit Rocks Solana: 12,300 SOL Stolen by Ex-Employee

Van Thanh Le

May 17 2024

last month read
Cubist robot heist, crypto swirl, futuristic city background

This article comes to you with the generous support of Discover the excitement and rewards that await you at with a 100% deposit bonus!

Pump.Fun's Multimillion-Dollar Meltdown

Solana-based meme coin launchpad fell victim to a devastating $2 million exploit orchestrated by a former employee operating under the alias "Staccoverflow." The daring heist, which unfolded on May 16th, saw the attacker leverage flash loans to manipulate's bonding curve contracts, ultimately leading to the theft of approximately 12,300 SOL.

Utilizing borrowed funds from Solana's money market MarginFi, Staccoverflow strategically purchased tokens on until reaching the required market cap threshold for trading on the decentralized exchange Raydium. Once the threshold was met, the attacker immediately dumped the assets, repaying the flash loan and pocketing the remaining funds in a meticulously executed scheme.

The exploit's success hinged on a compromised private key, granting Staccoverflow access to's service account, which manages liquidity transfers to Raydium. With this access, the attacker redirected the funds to various Solana addresses, leaving a trail of digital breadcrumbs.

Staccoverflow, claiming personal grievances against's leadership and a desire to dismantle the project, took responsibility for the exploit on social media platform X (formerly Twitter). The attacker stated their intention to distribute the stolen funds to other Solana token holders, with a desire to "kill" the project due to its perceived mismanagement and harm to users.

In the aftermath, swiftly paused all trading activities, upgraded their contracts to prevent further losses, and assured users that the Total Value Locked (TVL) in the protocol remained secure. The immediate actions aimed to mitigate any additional damage and restore user confidence. issued official statements acknowledging the exploit, ensuring the security of user wallets, and detailing compensation plans. They announced plans to seed liquidity pools for affected coins and reduce trading fees to 0% for a week, in an effort to regain user trust.

A comprehensive post-mortem revealed that the exploiter was indeed a former employee who had abused their admin privileges, shedding light on the exploit's mechanics and prompting the implementation of upgraded contracts to prevent future incidents.

Community reactions varied, with some users reporting unexpected airdrops of the stolen funds, while others observed market fluctuations in the affected tokens. The incident highlighted the urgent need for enhanced security measures and regular contract audits within the Solana ecosystem.

Despite the exploit's impact, reported daily revenues exceeding $1.2 million prior to the incident, emphasizing the platform's significant user activity and trading volumes. The financial impact was limited to $1.9 million of the $45 million TVL within the bonding curve contracts.

Coinciding with the Pump.Fun heist, Pink Drainer, a notorious cybercriminal toolkit responsible for enabling the theft of over $85 million in crypto assets, announced its retirement in a Telegram announcement. While the shutdown of high-profile drainer services like Monkey Drainer and Inferno Drainer provides temporary relief, the crypto community remains vigilant against persistent threats.


The Pump.Fun heist underscores the urgency for robust security measures and stringent access controls within the Solana ecosystem. As decentralized platforms gain traction, meticulous audits and community vigilance become paramount to safeguarding user funds and maintaining trust in this burgeoning financial paradigm.


1. What was the total value stolen in the Pump.Fun exploit? 

The attacker, known as "Staccoverflow," managed to steal approximately 12,300 SOL tokens, valued at around $2 million at the time of the exploit.

2. How did the attacker execute the exploit? 

Staccoverflow leveraged flash loans from MarginFi to manipulate Pump.Fun's bonding curve contracts, reaching the required market cap threshold on Raydium. They then immediately dumped the assets, repaying the loan and pocketing the profits.

3. Was the attacker's identity revealed? 

Yes, Pump.Fun's post-mortem analysis revealed that the exploiter was a former employee who had abused their admin privileges to gain access to the platform's service account.

4. What measures did Pump.Fun take to mitigate the damage? 

Pump.Fun swiftly paused all trading activities, upgraded their contracts, assured users of the security of their wallets, and announced plans to compensate affected users by seeding liquidity pools and reducing trading fees temporarily.

This article has been refined and enhanced by ChatGPT.

cryptocurrency widget, price, heatmap
v 5.6.19
© 2017 - 2024 All Rights Reserved.