Ex-Pump.Fun Employee Claims Credit to $1.9M Hack, on Free Bail After London Arrest

Pump.Fun, a Solana-based platform aimed at facilitating token launches, encountered a significant exploit on 16 May, resulting in a loss of at least 12,300 SOL, valued at approximately $2 million.

The exploit unfolded as the suspected attacker leveraged flash loans from Raydium, a prominent Solana lending protocol.

Flash loans, a potent DeFi tool, enable users to conduct transactions that would otherwise require substantial capital.

However, they also present considerable risks, as evidenced by this incident.

Within Pump.Fun's framework, bonding curves play a pivotal role in determining token prices based on their supply.

Upon reaching full bonding curves, liquidity is intended to be directed to Raydium for burning, enabling tokens to enter the open market.

In this exploit, the hacker utilised MarginFi's flash loan services to manipulate these bonding curves.

By maxing out these curves at 100%, they gained access to and withdrew liquidity earmarked for Raydium, subsequently repaying the flash loan and pocketing significant profits.

Pump.Fun Team Upgraded Their Contracts to Prevent Further Damage

In response to the attack, the Pump.Fun team immediately upgraded their contracts to mitigate further damage.

They reassured users that all associated wallets and tokens burned to Raydium remain secure.

Notably, during the attack, Pump.Fun's service account served as a cosigner for all of the exploiter's transactions, prompting speculation among analysts about a potential compromise of private keys facilitating the malicious flash loan exploit.

A few hours after the exploit, the team provided a detailed rundown of what transpired.

Hacker, Who Was Identified as an Ex-Staff, Claimed Credit for the Exploit

Pump.Fun had initiated collaboration with law enforcement to probe the breach.

However, Igor Igamberdiev, head of research at cryptocurrency market maker Wintermute, posited that the hack may have stemmed from an internal private key leak.

He singled out a user known as "STACCoverflow," later identified as Jarett Reginald S Dunn, who took credit for the exploit in a series of unusual tweets.

Leveraging his access to Pump.Fun's admin privileges, Dunn utilised flash loans to drain nearly $2 million in liquidity from the platform.

Dunn claimed that the pilfered funds would be distributed to holders of various Solana tokens.

Numerous users have reported receiving token distributions from the hacker, yet the criteria governing these distributions remain ambiguous.

The team later identified the attacker as a former employee named Jarett Dunn, also known as StaccOverflow on X.

Pump.Fun Hacker Arrested in London but Released on Free Bail

Following his arrest and release on bail, Dunn disclosed spending a night in custody in connection with the incident.

In subsequent comments from a different X account, Dunn indicated his intention to contest the allegations against him, asserting that Pump Fun should be held accountable for what he considers more severe offenses.

Dunn shared a series of posts featuring Polls outlining his accusations against Pump Fun.

Among these, he alleges that the platform functions as an unregistered securities exchange or gambling site without a license.

He asserts that Pump Fun lacks proper Know Your Customer (KYC) or Anti-Money Laundering (AML) procedures and has been blacklisted by Saudi Arabia for operating as a casino.

Additionally, he accuses the team of not setting a minimum value for users while implementing Automated Market Making (AMM), effectively turning it into a centralised exchange.

Dunn also insinuates a strategy of hiring overseas and maintaining a minimal staff presence to deceive investors about the platform's operations.

Furthermore, he accuses the team of harboring intentions of child abuse, suggesting he may subpoena Telegram for evidence.

In communications with Dunn, another X account disclosed Dunn's intention to stay in the UK until his court appearance, which is currently scheduled for August, after being released on bail.

Dunn seems to be in a hospital at the moment, as he mentioned using a "super restricted hospital iPad" to access X.

Although Dunn's claims lack evidence, they shed light on the intricacies of hacking within the crypto ecosystem.

Internal Attacks Pose a Significant Set of Challenges

Guarding against external attacks poses significant challenges due to the vast array of potential threats originating from unknown sources, ranging from sophisticated hacking groups to individual malicious actors.

These external threats can exploit vulnerabilities in networks, software, or human behaviour, making them difficult to anticipate and defend against.

Additionally, the constantly evolving nature of cyber threats means that organisations must continuously update and adapt their security measures to stay ahead of attackers.

However, internal hacks or attacks from individuals within the same organisation pose a distinct set of challenges.

Unlike external threats, internal attackers often have legitimate access to sensitive systems and information, making their actions harder to detect and mitigate.

Furthermore, internal attacks can be carried out by employees, contractors, or trusted partners who may have privileged knowledge of the organisation's systems and protocols.

The threat of insider attacks is compounded by the fact that these individuals may have a deeper understanding of the organisation's weaknesses and may exploit them more effectively.

Additionally, internal attackers may be motivated by a variety of factors, including financial gain, personal grievances, or ideological reasons, making their behavior harder to predict.

Moreover, internal attacks can also have a more significant impact on an organisation's reputation and trust among stakeholders.

When breaches occur from within, it can erode trust among employees, customers, and partners, leading to reputational damage and potentially severe financial consequences.