Solana token launcher Pump.fun suffers flash loan exploit

Pump.fun, a Solana-based platform that streamlines token launches, appears to have been exploited.

The exploiter seems to be using flash loans to get enough SOL to buy out the bonding curve for Pump.fun memecoins. The situation is developing, and The Block reached out to the project's team for comment.

As one user who goes by SOLCircle explained on the social media platform X, the exploiter employs a crypto loan service to borrow the SOL necessary to purchase Pump tokens. Even though the loan doesn't accept the tokens, the transaction still goes through, letting the exploiter keep the tokens without paying for anything.

Someone has taken credit for the exploit, a social media user who goes by Stacc. In a Thursday social media post , Stacc mentioned that he has engaged in a robbery, though alluded to poor mental health, and that he wishes for his mom to be raised from the dead.

"What I've been able to figure out is that only one project has gone to Raydium so far and his bag is currently worth approximately 1,000 SOL ($157,000) which he hasn't sold any yet," SOLCircle told The Block. "From his tweet regarding the passing of his mother, where he details the exploit, it seems like he doesn't plan to make any money from this and it's more so a display of his aggression and sadness but that could swiftly change.

"He could make a big disruption to the memecoin space on Solana as Pump.fun is one of it's biggest assets," SOLCircle said, adding that, "He is currently holding millions of dollars of tokens and if all these projects get sent to Raydium a big bag is waiting for him to cash out if he chooses."

How Pump.fun works

Pump.fun "prevents rugs by making sure that all created tokens are safe," the platform wrote on its website, adding that each new coin has no presale or team allocation. Pump allows users to mint new tokens for only a few dollars. Users pick a token and then buy it on a bonding curve. They can sell their token holdings to seal their profit or losses. A token reaching a market capitalization of $69,000 spurs $12,000 of the token's liquidity to get deposited onto Raydium , a Solana-based decentralized exchange, before getting burned. A bonding curve is a formula that determines a token's price based on its supply.

Pump.fun charges users around 0.02 SOL to create a new token, which costs $3.16 at current prices. SOL traded hands at $158.056 as of 12:55 p.m. ET (16:55 UTC) on May 16, having increased 3.45% in the past 24 hours, according to The Block Prices.

Pump amassed an all-time high daily revenue of $1.23 million on May 14, with the platform most recently amassing over $669,000 on May 15, The Block's Data Dashboard shows.