Raydium: Attackers May Have Remotely Accessed Servers to Obtain Private Keys, Will Offer 10% of Stolen Amount Bounty to Recover Funds

Raydium, a Solana ecological decentralized exchange, released an investigation report on being hacked. The report stated that the Pool Owner account that can withdraw funds from the liquidity pool was initially deployed on a virtual machine with a dedicated internal server, and there was no evidence of the private key of the Pool Owner account. Has been passed, shared, transferred or stored locally outside of the virtual machine in which it was originally deployed. It is initially suspected that the attacker may have remotely accessed the virtual machine or internal server where the account is deployed. This attack involved seven tokens including ETH, USDC, RAY, SOL, stSOL, UXP, and ZBC, with a total amount of about $4.4 million. Raydium said it had previously deployed a patch to revoke permissions from the attacked address and move permissions to cold wallet addresses. In addition, unnecessary management parameters have been deleted at 18:27 Beijing time yesterday to avoid affecting the fund pool. Raydium is currently determining the amount of liquidity pool impact from the hack, and is also working with the Solana team, third-party auditors, and centralized exchanges to locate the attacker. And offered to offer 10% of the stolen amount and stolen RAY as a bounty in exchange for returning the stolen funds.