Raydium to cover $1.3M loss after Solana legacy exploit

Raydium’s treasury said it will cover roughly $1.3 million in losses after an attacker withdrew funds from five deprecated automated market maker (AMM) V3 pools on Solana. The breach, flagged Wednesday by security firms, targeted retired pool code rather than the protocol’s active pools or user interface.

On-chain investigators identified a validation flaw in the legacy AMM V3 program. The attacker used a fake mint address to remove liquidity from the dormant pools, extracting about 150,177 RAY, 5,603 SOL and 893,700 USDC. Raydium confirmed the affected pools belonged to a program that was phased out in 2021 and are not accessible to users through the platform’s current UI.

Raydium posted on X: “No current users of Raydium are affected by this exploit,” and said the protocol will reimburse the full loss from its treasury. The team indicated there was no compromise of active pools or the current platform interface.

Blockchain security firm PeckShield and on-chain investigator Specter traced the attacker’s funds. PeckShield reported the attacker initially funded operations through KuCoin before moving assets to Ethereum. Investigators traced about 810 ETH into Tornado Cash and another seven ETH to FixedFloat. Mixers and similar services are being used to obscure the on-chain trail.

Markets showed little immediate reaction. The RAY token fell under 1% in the 24 hours following the report, trading near $0.57, while Solana’s SOL declined about 2% to roughly $63.88.

Raydium previously experienced a security incident in December 2022 when an admin key compromise drained active pools. That event was followed by a governance vote that allocated buyback fees and vested team tokens to compensate affected liquidity providers.

Investigators continue to trace the funds moved through Ethereum and mixing services. Recovery efforts and any response from custodial platforms remain ongoing as on-chain analysis proceeds.