Raydium DEX Loses $1.34M in AMM Exploit

Raydium Suffers $1.34 Million Exploit Linked to Outdated Program

Raydium, a decentralized exchange operating on the Solana blockchain, announced Wednesday that it had been the victim of an exploit resulting in a loss of $1.34 million. The incident is tied to the platform’s retired automated market maker (AMM) V3 program.

Raydium Pools Drained

The protocol reported that the attacker siphoned approximately 150,000 RAY tokens, 5,600 SOL, and nearly 900,000 USDC stablecoins from Raydium pools that included RAY-SOL, USDC-RAY, and SRM-RAY pairings.

Raydium attributed the security breach to a flaw in how its older AMM V3 program handled liquidity provider (LP) mints. The platform stated that the vulnerability “stemmed from insufficient validation of the LP mints, which in practice allowed the attacker to bypass intended proportion checks.”

According to the technical explanation, the legacy AMM V3 program failed to properly verify the LP mint address. This deficiency enabled an attacker to create a new mint and utilize it as the LP token, thereby circumventing the checks designed to regulate asset accounting within Raydium’s pools.

The exchange stressed that the compromised AMM V3 program is no longer accessible through Raydium’s interface. It clarified that the legacy AMM V3 program was decommissioned in 2021 and is effectively unreachable via Raydium’s current user tools.

Funds Traced Across Two Blockchains

Details regarding the alleged money laundering activities were provided by blockchain security firm PeckShield. PeckShield outlined how the attacker’s funds were initially sourced from the KuCoin exchange and subsequently bridged from Solana to the Ethereum blockchain.

PeckShield reported that 810 ETH had already been transferred to Tornado Cash, a privacy-focused cryptocurrency mixer, and an additional 7 ETH was moved to FixedFloat, a cryptocurrency exchange service. These movements were characterized as part of an active effort to launder the stolen Raydium funds.

In its own analysis of the exploit, Raydium reiterated that its current programs remain unaffected by the incident. The exchange also confirmed that its core contributors are currently undertaking a comprehensive security review of all mainnet programs.