A disgruntled former employee of the Solana platform, Pump.fun, attacked the platform on May 16 after the recent security hack. According to a tweet on X, the ex-employee, who used the username @STACCoverflow, attacked the platform while publicly disclosing his crime on Twitter.

While the nature of the misunderstanding between the platform and the attacker remains unclear, the hackers used a wallet address to sweep up all the token supplies of newly listed projects in just minutes. The attack caused the platform to lose an estimated $1.9 million out of the $45 million locked on it.

The raid on the tokens caused the bonding curve to fill up to a 100%. A bonding curve typically reaches its full capacity after allocating all tokens to buyers during an Initial Token Offering (ITO) or token sale, and after that, the market then sets the token’s price based on demand and supply. However, the attacker bought all the tokens for himself. In this case

By reaching 100%, the bonding curve halted the trading of stolen tokens on the Raydium DEX, resulting in a lag in Raydium listings.

The disgruntled ex-employee claimed responsibility for the attack. He took advantage of MarginFi, a decentralized lending platform on the Solana blockchain, by using flash loans to obtain SOL, which he then used to buy up the exploited tokens without actually spending their own SOL tokens.

Pump.fun Suffers Flash Loan Hack.

Pump.fun’s troubles did not end there, as hackers exploited a flash loan from MarginFi to drain user funds from the platform’s liquidity pools. During the attack, Phantom, a security platform working with Pump.fun, issued a notice to users on the Pump.fun website warning them against using the website in the meantime.

According to a tweet by Pump.fun, its security team investigated the breach and assured users that they had successfully resolved the security breach later that day, confirming that contracts on the platform are now safe. The platform also stated that traders will enjoy a % trading fee for the next seven days.

https://t.co/uE2QNKXkIT coin migration issue post-mortem

TL;DR:

1. the https://t.co/uE2QNKXkIT contracts are safe. they have always been safe
2. a former employee used their privileged position at the company to misappropriate ~12.3K SOL (~$1.9m)
3. https://t.co/uE2QNKXkIT is…

— pump.fun (@pumpdotfun) May 16, 2024

Meanwhile, Solana experienced a 5% dip that same day because of the news that user’s accounts on the FTX platform will be closed.