Propose an edit: pump.fun insider exploit

From memecoin.wiki, the free memecoin encyclopedia

Title Category One sentence summary Infobox, one "key: value" per line Article body, markdown, use [[wiki links]] and end with a ## References section

The **pump.fun insider exploit** was a May 16, 2024 attack on [[pump.fun]] in which a former employee used privileged access and flash loans to drain about 12,300 SOL, worth roughly 1.9 million dollars at the time, from the platform's [[bonding curve]] contracts. The attacker, Canadian developer Jarett Dunn, known online as @STACCoverflow, announced the theft on X while it was in progress and was arrested in London two days later. It remains the most serious security incident in pump.fun's history and a fixture of [[the trenches]] folklore because of the theatrical way it unfolded in public.

## The attack

According to pump.fun's post mortem, Dunn was a former employee who used his privileged position to obtain access to an internal withdraw authority. On May 16 he borrowed SOL through flash loans on the Solana lending protocol marginfi, used the borrowed funds to buy coins on pump.fun until they reached 100 percent of their bonding curves, then intercepted the liquidity that would normally migrate to Raydium at [[graduation rate|graduation]], repaying the loans and keeping the difference. The platform said about 1.9 million dollars was taken out of roughly 45 million dollars held in bonding curve contracts at the time.

Rather than hide, Dunn narrated the exploit on X, telling followers words to the effect of "everybody be cool, this is a robbery," and began airdropping portions of the stolen SOL to holders of various Solana meme coin and NFT communities, framing the theft as a protest against the platform. In later posts he cited grief over his mother's death and mental health struggles rather than financial motive, and claimed he wanted to "send a message."

## Response and arrest

pump.fun paused trading, upgraded its contracts, and restarted within about 24 hours. To make users whole, the team seeded the Raydium liquidity pools of every affected coin with equal or greater SOL liquidity than the coin had at the time of the attack, and set trading fees to zero percent for seven days. The team also said it was cooperating with law enforcement.

In the early hours of May 18, 2024, British police arrested Dunn at the Middle Eight Hotel in Covent Garden, London. Posting from a new account, Dunn said he had spent a night in custody, was accused of stealing 1.9 million dollars and of conspiring to steal a further 80 million dollars (his own characterization, not a confirmed charge), and had been released on bail under mental health observation. Subsequent reporting in 2025 described Dunn publicly admitting responsibility for the exploit as proceedings continued.

## Significance

The exploit landed during what had been a record week for the young platform and became an early stress test of its credibility, four months after launch. The rapid restart, liquidity backstop, and fee holiday were widely credited with containing the damage, and the incident is often cited alongside the platform's later crises, such as the [[pump.fun livestreaming]] shutdown, as evidence of how pump.fun absorbed scandals that might have killed a smaller venue. Dunn's public, confessional X posts made the episode one of 2024's strangest crypto crime stories.

## References

* The Block, pump.fun identifies 1.9 million dollar exploiter as former employee in post mortem: https://www.theblock.co/post/295029/pump-fun-post-mortem
* Blockworks, Pump dot Fun exploiter identified and arrested in London: https://blockworks.co/news/pump-dot-fun-exploiter-arrest-london
* crypto.news, pump.fun exploiter arrested, team alleges I stole 2 million: https://crypto.news/pump-fun-exploiter-arrested-allegations-stole-2m/
* CCN, pump.fun exploiter Jarett Dunn arrested over 1.9 million dollar hack: https://www.ccn.com/news/crypto/pump-fun-exploiter-jarett-dunn-arrested-over-1-9-million-hack/
* CryptoSlate, pump.fun halts trading after suffering flash loan exploit: https://cryptoslate.com/pump-fun-halts-trading-after-suffering-flash-loan-exploit/
* DL News, pump.fun's record week marred by 2 million dollar exploit: https://www.dlnews.com/articles/defi/pumpfuns-record-week-marred-by-2-million-exploit/
* City AM, pump.fun's 1.9 million dollar attacker claims exploit was about sending a message: https://www.cityam.com/pump-funs-1-9-million-attacker-claims-exploit-was-about-sending-a-message/

Your handle or name (optional) Note to the moderators (optional)

A moderator reviews every submission before it publishes.