Pump.fun was stolen in the early morning, a brief account of the incident

2024-05-17 10:53

Read this article in 5 Minutes

1. The attacker @STACCoverflow is a former employee of @pumpdotfun and owns a wallet account used to create Raydium trading pairs. 2. The attacker borrowed a flash loan from @marginfi, filled the pool that did not meet the standard, and then took away the transferred $Sol. 3. The users who were mainly affected were those in the pool that had not been filled before the attack, and the amount of loss may be as high as $80M. 4. The attacker may have obtained the private key of the "hacked account" due to improper team management, and may have been responsible for filling the pool of issuing coins to create attention. 5. The article reminds copycat projects to pay attention to providing initial push and strengthening permission management to ensure security.

Original author: Charlemagne, crypto KOL

Original translation: Crypto Wei, AC Capital partner

Pump theft incident lazy package, thanks to @0x_charlemagne for his wonderful analysis of the cause of the accident, translated here and added my personal speculation.

How did the attack work?

First of all, the attacker @STACCoverflow is not a great hacker, but a former employee of @pumpdotfun. He has the wallet account that Pump uses to create each Tugou Raydium trading pair, which we call the "hacked account". And all the Bonding Curve LP pots created on Pump before they meet the Raydium standard are called "preparatory accounts".

The attacker borrowed a flash loan from @marginfi to fill all the pools that had been created but not filled to the state of being listed on Raydium. Originally, the operation that would happen at this time was that the $Sol originally in the virtual pool's "preparatory account" would be transferred to this "hacked account" because it met the standards for listing on Raydium. But at this time, the attacker withdrew the transferred $Sol, making these memecoins that should have been listed on Raydium and locked in the pool unable to be listed on Raydium (because the pool had no money)

So, whose money did the attacker hack?

In response to this, @0x_charlemagne explained:

First of all, it was definitely not @marginfi's. Because the flash loan money is returned in the same block, its purpose is only to trigger the operation of transferring money from the reserve account to the hacked account, so there will be no loss.

Secondly, the local dogs that have been sent to Raydium in the past should not be affected because the LP has been locked (personal speculation)

The unlucky ones should be the users who bought in all the unfilled pools in the entire Pump before this attack, and their $Sol was transferred away by the above attack. This also explains why the loss may be as much as $80M (Note: According to the latest information, the loss amount is about 2 million US dollars).

Why does the attacker have the private key of this "hacked account"?

First of all, it must be the improper management of the team. There is no way to wash it off, just like the patriotic network development general of North Korea in Blast.

Secondly, we can guess that filling the pool may be one of the attacker's previous jobs. Just like when Friendtech V1 was launched last year, there were a large number of robots rushing to buy your key. In the first few days, it was probably the official one, which played the role of market making for the key and guiding the initial heat.

It can be boldly speculated that at that time, in order to do the initial cold start, Pump asked the attacker to use the project's own money to fill the pool of coins issued (most of them are probably issued by themselves, such as $test $alon) and let them go to Raydium and then pull the market to create attention. It's just that I didn't expect that it would become the key of the insider in the end.

Lessons learned

First of all, copycats must pay attention, don't be stupid and just copy the fur, meaning that people will come to trade after the product is made and put it there. You have to provide an initial push for mutual assistance.

Then you must do a good job of permission management and pay attention to security.