Key Highlights
- Raydium confirmed a $1.34 million exploit affecting five deprecated AMM V3 liquidity pools that had been inactive since 2021.
- The attack exploited insufficient LP mint validation, allowing a fake token mint to bypass liquidity withdrawal checks.
- No current users, active pools, or Raydium’s modern protocols were impacted, as the affected program was no longer accessible through official interfaces.
Raydium, a decentralized exchange on Solana, has confirmed an exploit that drained approximately $1.34 million from its legacy AMM V3 program, which was phased out in 2021. The incident involved the unauthorized removal of liquidity from five deprecated pools that had remained idle following the deprecation of the Serum order book.
According to Raydium’s update, no current users were affected. The legacy pools had not been accessible through the official UI, SDK, or DApp for several years, and the affected program did not support swap functionality. The liquidity had been used solely to place orders on Serum and remained dormant after Serum’s shutdown.
Root cause of vulnerability and impacted pools
The five impacted pools were Sollet USDT-RAY, Sollet ETH-RAY, SRM-RAY, USDC-RAY, and RAY-SOL. Assets removed include roughly 150,177 RAY, 5,603 SOL, and 893,700 USDC. The exploiter’s address is 4WnPebowR4HHfumvNPaDjG6Pa5Hi1jxLm6xmmBq33QVk.
The vulnerability originated from insufficient validation of the LP mint address in the legacy program. The attacker created a fake mint and used it to bypass proportion checks that relied on LP token supply.
In contrast, Raydium’s current mainnet programs use a virtual supply mechanism and verify LP mints along with other account data, preventing this type of exploit. The issue was described as a self-contained logic flaw with no key compromise or broader propagation risk.
Raydium stated that its treasury will provide full compensation for the drained funds. Core contributors are currently conducting a security review of all mainnet programs to ensure no similar issues exist elsewhere.
Expanding ecosystem with LaunchLab rollout
In a separate development, Raydium launched its own memecoin launchpad called LaunchLab on April 16, shortly after ending its partnership with Pump.fun.
The new platform enabled users to easily create and deploy tokens on Solana, with seamless integration into Raydium’s liquidity pools for near-instant trading. Projects that raise a minimum of 85 SOL (approximately $11,150) are automatically added to Raydium’s automated market maker (AMM), providing immediate access to deeper liquidity.
Tracking effort still goes on
This incident highlights ongoing risks associated with deprecated code in decentralized protocols, even when inactive. While legacy components are often left untouched after upgrades, they can retain value and become targets if not fully retired or audited to modern standards. Many DeFi projects face similar challenges when migrating users and liquidity to newer versions while older contracts remain on-chain.
The exploit does not appear to impact Raydium’s active trading infrastructure, liquidity pools, or current users. However, it serves as a reminder of the importance of thorough code retirement processes and continuous security audits in public blockchain environments.
As of the announcement, tracking efforts are underway on the movement of funds from the identified exploiter address.
Growing crypto attacks in 2026
2026 has seen continued high levels of crypto-related hacks and exploits, with losses surpassing $1 trillion in the first five months of the year alone, according to multiple security trackers.
Some major incidents include:
- Kelp DAO (April 19): Approximately $292 million lost in what is currently the largest DeFi hack of the year, linked to a bridge/infrastructure exploit involving rsETH.
- Drift Protocol (April 1): Around $285 million drained from the Solana-based DEX after a prolonged social engineering campaign attributed to North Korean-linked actors.
- Humanity Protocol (June): Roughly $36 million lost due to private key compromise.
Other notable incidents include exploits affecting Step Finance, Resolv, Truebit, and various bridge-related protocols.
While some funds have been recovered and some projects have committed to treasury compensation, the overall trend underscores ongoing challenges in DeFi security, multi-signature practices, and the safe retirement of old code.
Also Read: Crypto Market Today: BTC & ETH Holds Price XRP Stays Weak, ETFs Bleed Again
