TLDR
- A malicious actor extracted approximately $1.34 million from five defunct Raydium liquidity pools on the Solana blockchain
- The stolen crypto included about 150,000 RAY tokens, 5,600 SOL, and 893,700 USDC
- The vulnerability existed in an outdated AMM program that was discontinued in 2021, leaving active pools untouched
- Raydium has pledged to fully compensate all impacted users through its treasury
- Blockchain analytics firm PeckShield identified roughly 810 ETH of the stolen assets moving to Tornado Cash
On June 10, Raydium, a prominent decentralized exchange operating on the Solana network, disclosed that a malicious actor had successfully exploited legacy infrastructure, siphoning approximately $1.34 million worth of cryptocurrency.
The compromised liquidity pools had been inaccessible via Raydium’s user interface since the AMM V3 program was retired in 2021. According to Raydium’s statement, no current users or active liquidity pools were impacted by the security breach.
Technical Breakdown of the Exploit
On-chain security researcher Specter revealed that the perpetrator leveraged a fraudulent mint address to circumvent security validation mechanisms within the obsolete pools. The critical vulnerability stemmed from inadequate validation protocols for LP mint addresses, creating an opportunity to sidestep proportion verification checks.
The hacker successfully withdrew approximately 150,177 RAY tokens, 5,603 SOL, and 893,700 USDC from the dormant pools. According to Specter’s investigation, the attacker obtained their initial funding through the KuCoin exchange before transferring the stolen assets to the Ethereum blockchain.
PeckShield, a prominent blockchain security company, monitored the movement of the compromised funds following their transfer to Ethereum. Their analysis shows that approximately 810 ETH was funneled through Tornado Cash, while an additional seven ETH was routed to FixedFloat.
Notably, Tornado Cash was delisted from U.S. Treasury Department sanctions in March 2025. Despite this development, the mixer’s involvement may present ongoing challenges for investigators attempting to recover the stolen cryptocurrency.
Full Compensation Promised by Raydium
Raydium has publicly committed to reimbursing all financial losses stemming from the exploit using its treasury reserves. The platform clarified that while no current active users were impacted, certain users maintained residual exposure to the outdated pool infrastructure.
This marks not the first instance of Raydium stepping up to cover user losses. Following an administrative key compromise in December 2022 that resulted in losses from operational pools, the protocol’s governance system voted to utilize buyback fees and vested team token allocations to reimburse liquidity providers.
The development team confirmed that all current mainnet programs remain secure and are presently undergoing additional independent security audits.
Market impact was minimal following the disclosure. Raydium’s native token traded around $0.57, experiencing less than a 1% decline in the 24-hour period after the incident became public. Solana experienced a slightly larger drop, declining approximately 2% to trade near $63.88 during the corresponding timeframe.
Interestingly, the RAY token demonstrated resilience, trading more than 2% higher on the day the exploit was publicly announced.
Raydium emphasized that its SDK and decentralized application do not facilitate any interactions with the legacy AMM V3 pools on the mainnet, validating that the attack exclusively affected deprecated code infrastructure.
Security investigators from PeckShield and Specter are actively tracking the stolen cryptocurrency. Current evidence confirms the exploit was limited to obsolete infrastructure components and did not compromise Raydium’s operational trading platforms or active liquidity systems.





