Raydium $1.34M Exploit: Root Cause & LP Risk
Published 6/15/2026, 7:44:39 AM
The Exploit: What Happened
On June 10, 2026, Raydium lost approximately $1.34 million (893,700 USDC, 5,603 SOL, and 150,177 RAY) from five deprecated liquidity pools. The attack exploited a vulnerability in Raydium's legacy AMM V3 program, which had been deprecated since 2021 but remained live on-chain.
Root Cause: Missing LP Mint Validation
The technical vulnerability was a smart contract logic flaw in the legacy AMM V3 program. The attack worked as follows:
| Step | Attack Vector |
|---|---|
| 1 | Attacker identified five abandoned pools still holding funds on-chain |
| 2 | Created a fake LP token mint with a supply of just 1 unit |
| 3 | Submitted a withdrawal request using the counterfeit LP token |
| 4 | The AMM V3 program did not properly validate the LP mint address |
| 5 | Contract released the entire pool balance as if the attacker were a legitimate LP |
The core flaw: the legacy program lacked proper LP mint verification that exists in Raydium's current programs (V4, V5, CLMM), which use a virtual supply mechanism and strict LP mint validation.
Why Deprecated Pools Remained Vulnerable
The five targeted pools (Sollet USDT–RAY, Sollet ETH–RAY, SRM–RAY, USDC–RAY, RAY–SOL) were associated with the defunct Serum protocol and deprecated in 2021. However:
- No automatic freeze: When Raydium phased out AMM V3, the UI was removed but the smart contract remained live and callable on-chain
- Funds not migrated: Liquidity remained locked in old pools with active smart contracts
- No access controls: The legacy code lacked validation checks that should have been implemented
Attacker Details
| Attribute | Details |
|---|---|
| Attacker Address | 4WnPebowR4HHfumvNPaDjG6Pa5Hi1jxLm6xmmBq33QVk |
| Funding Source | KuCoin (centralized exchange) |
| Bridge | Solana → Ethereum via deBridge |
| Primary Mixer | 810 ETH → Tornado Cash |
| Secondary Mixer | 7 ETH → FixedFloat |
Are Liquidity Pool Risks Underestimated?
Evidence from this incident supports the claim that LP risks are underestimated—specifically legacy code exposure:
| Risk Factor | Evidence |
|---|---|
| Deprecated ≠ Safe | Blockchain programs remain live on-chain even when UI access is removed |
| Dormant Liquidity | Old pools held ~$1.34M with no active monitoring for years |
| Migration Gaps | Protocols often fail to formally migrate or freeze deprecated contracts |
| LP Token Validation | Missing validation allows fake token presentation attacks |
However, the research data does not provide direct evidence about retail participants' risk perception or broader DeFi-wide patterns of LP risk underestimation. The analysis is limited to Raydium's specific technical failure.
Protocol Response & Market Impact
- No propagation risk: Raydium confirmed the vulnerability was self-contained, not a key compromise
- Current users unaffected: Active pools (CLMM, newer AMM versions) have no equivalent vulnerability
- Full compensation: Treasury will cover all losses
- RAY price: Trading at $0.58 on June 11, 2026 (24-hour price impact relative to the incident not independently confirmed)
Comparison: June 2026 vs. December 2022 Raydium Incidents
| Aspect | Dec 2022 Incident | June 2026 Incident |
|---|---|---|
| Loss | $4.4M–$5.5M | $1.34M |
| Root Cause | Private key compromise (trojan malware) | Smart contract logic flaw |
| Attack Vector | Admin key theft → withdrawPNL() abuse | Fake LP mint → validation bypass |
| Affected Pools | Active pools | Deprecated pools |
Conclusion
The Raydium exploit demonstrates a specific, well-documented technical vulnerability (missing LP mint validation in legacy code) that led to a $1.34M loss. The incident provides concrete evidence that deprecated smart contracts pose real financial risk when they remain live on-chain without proper validation logic. However, the research data does not directly address whether retail participants systematically underestimate these risks, nor does it provide broader DeFi-wide evidence of LP risk underestimation beyond this case.
What remains open: Independent verification of the attacker wallet address against block explorers, the specific compensation timeline, and comparative data on how retail participants perceive legacy pool risks versus active pool risks.