pump.fun hack — May 2024

On 16 May 2024 pump.fun, a Solana memecoin launchpad where each new token trades on a bonding curve until it graduates to a Raydium pool, lost about 12,300 SOL, roughly $1.9 million at the time.

The attacker was a former pump.fun developer who had retained the platform's withdraw authority credentials from his employment. Using that access he took flash loans of SOL, bought tokens until their bonding curves reached 100 percent, drew down the liquidity held against those curves, and repaid the loans. Rather than keeping the proceeds he scattered them across thousands of unrelated wallets. He announced the theft himself on X under the handle STACCoverflow, writing that this was a robbery.

pump.fun paused trading, halted token migrations to Raydium, redeployed its contracts, and said the attacker had misused access to the withdrawal authority obtained through a previous position at the company. It stated that about $1.9 million of roughly $45 million in platform liquidity was affected, undertook to replenish the liquidity pools of affected coins with an equal or greater amount of SOL within 24 hours, and reopened with zero trading fees for seven days. Completion of that replenishment is not documented in the sources cited here.

Jarett Dunn, a Canadian national who had worked at the company as a senior developer for about six weeks, was arrested in the United Kingdom, pleaded guilty to fraud by abuse of position and to transferring criminal property, and was sentenced at Wood Green Crown Court in London on 18 December 2025 to two concurrent six-year terms. Prosecutors dismissed his claim that the theft amounted to whistleblowing as post-arrest spin and the judge rejected it. Contemporaneous loss figures range from $1.9 million to $2 million; the lower figure is the one pump.fun itself used.