Pump.fun hacked for $1.9 million—Is the Solana meme season over?
TechFlow Selected TechFlow Selected
Pump.fun hacked for $1.9 million—Is the Solana meme season over?
The emergence of pump.fun has lowered the entry barrier for meme coin speculation, increasing the difficulty of early-stage market manipulation.
Navigating Web3 tides with focused insightsAuthor: 0xFacai
On May 17, according to community feedback, pump.fun may have suffered an attack where a vulnerability allowed attackers to infinitely participate in meme coins launched on the platform. At the time of writing, Phantom Wallet has temporarily blocked access to pump.fun's official website. Subsequently, Pump.fun stated in a post on X that the team was aware the contract had been compromised and was conducting an investigation.
On May 17, pump.fun released an update stating its contract is secure and confirmed the incident involved a former employee abusing privileged access during their tenure to steal approximately 12,300 SOL (about $1.9 million). The pump.fun team has since redeployed the contract, with trading set to resume within the next seven days. As compensation for affected users, the pump.fun team will inject SOL liquidity—equal to or greater than the token amount—into each impacted token within the next 24 hours for tokens affected after 15:21 UTC.
Insider Job Over a Romance Gone Wrong?
Igor Lamberdiev, Research Head at Wintermute, suggested that a leaked private key likely led to the attack on pump.fun, resulting in the theft of 2,000 SOL and a large quantity of MEME coins.
Lamberdiev explained that 5PXxuZ is Pump’s service account primarily used to transfer liquidity from pump.fun’s bonding curve to Raydium. The normal process involves someone executing the final trade and adding sufficient liquidity to deploy the Raydium pool, after which 5PXxuZ withdraws all liquidity from the bonding curve and deposits it into Raydium.
Normal pump.fun liquidity transfer process, image source: Lamberdiev
In this attack, however, the process changed: the attacker initiated a flash loan of 129 SOL to purchase a meme token, triggering 5PXxuZ to extract liquidity from the bonding curve, then repaid the flash loan—while no liquidity pool was created on Raydium.
Transaction flow after pump.fun attack, image source: Lamberdiev
Interestingly, 5PXxuZ served as a co-signer on all attack transactions, leading Lamberdiev to conclude that while insider involvement remains possible, the compromise at minimum indicates a leak of team private keys.
5PXxuZ as co-signer in attack transactions, image source: Lamberdiev
The alleged attacker also appears unusually bold. An X user named @STACCoverflow posted that they were “about to change the course of history,” and hinted they do not intend to keep the stolen funds, planning instead to transfer the remaining balance in the bonding curve to certain token holders.
Another X user, @gucciprayers, claimed the incident stemmed from two pump.fun developers falling in love. After the founder discovered the relationship, he allegedly threatened to expose them by launching a meme coin about it, causing one of the developers to panic and hack the platform to prevent the meme’s deployment. Of course, this claim has yet to be verified.
pump.fun Was Already Highly Profitable
As a dedicated meme-trading platform, pump.fun was initially launched for Solana. On this platform, users can deploy tokens for less than $2. Currently, pump.fun may already be the largest memecoin platform in the Solana ecosystem and has recently expanded support to Ethereum L2 Blast.
Due to extremely low deployment costs, numerous new trading pairs are listed daily on decentralized exchanges, making it a fast-paced environment. However, most meme projects typically last only 24 hours or less, largely because bad actors exploit the frenzy through orchestrated scams and marketing to deceive eager but inexperienced investors.
According to Dune data, pump.fun’s protocol revenue has reached 147,661 SOL, roughly $21.58 million. As a project launched in January this year, pump.fun’s cash flow generation has clearly been substantial.
Image source:
https://dune.com/hashed_official/pumpdotfun
Is the Solana Meme Season Over?
After the hack, the community sparked extensive discussion around this meme issuance product, with many users commenting they “rarely made money on the platform.” X user @YeruiZhang described pump.fun’s emergence as “the end of the Solana meme era, much like how Blur marked the end of the ETH NFT boom,” a view that particularly ignited heated debate.
@YeruiZhang argued that pump.fun reduced the tradable scale of memes on Solana from millions or even tens of millions down to the hundred-thousand-dollar level. While there have been rare success stories, pump.fun lowered the entry barrier for meme speculation, making early-stage manipulation more difficult. Additionally, the flood of similarly named meme coins increases the risk of users buying the wrong token, eroding enthusiasm for holding or “bagholding.”
Meanwhile, @tradergirlsuki does not believe this marks the end of meme coins, predicting new, higher-quality token launch mechanisms and on-chain issuance for other asset classes.
@tradergirlsuki believes early-stage control of supply is crucial for launching successful memes; without holding significant supply, it’s hard to initiate momentum. Since pump.fun makes it difficult for retail investors to profit, the market will naturally seek new alternatives. “Chasing shitcoins and finding alpha is an eternal theme.”
Currently, the pump.fun team has redeployed its contract, with trading expected to resume over the next seven days. To compensate users, the team will inject SOL liquidity—equal to or exceeding the token amount—into each affected token within the next 24 hours for those impacted after 15:21 UTC. Will the Solana meme season come to an end? And will a new “pump.fun” emerge within the ecosystem? These developments warrant our continued attention.
Join TechFlow official community to stay tuned
Telegram:https://t.me/TechFlowDaily
X (Twitter):https://x.com/TechFlowPost
X (Twitter) EN:https://x.com/BlockFlow_News
