Pump.fun was attacked Thursday by an exploiter who seemingly used flash loans to buy out the bonding curve. 

In a post on X, Pump.fun said that it was “aware” that the contracts were compromised and were investigating. 

“We have upgraded the contracts so the attacker cannot siphon any more funds. The TVL in the protocol right now is safe,” the team said. “We’ve paused trading — you cannot buy and sell any coins at the moment. Any coins that are currently in the process of migrating to Raydium cannot be traded and will not be migrating for an indefinite period of time.”

Igor Igamberdiev, head of research at Wintermute, analyzed the situation in a series of posts on X,…

Read more on Blockworks