Raydium Suffers $1.34M Exploit via Fake LP Tokens: Here’s Why

After draining the pools, the exploiter bridged all funds from Solana to Ethereum via a cross-chain bridge, then deposited them into Tornado Cash to obscure the trail, a standard cross-chain laundering sequence that leaves recovery prospects slim.

Discover: The Best Crypto to Diversify Your Portfolio

The LP Mint Validation Flaw: How Fake Tokens Emptied Real Pools

The root cause was a smart contract vulnerability in Raydium’s legacy AMM V3 program, a DeFi exploit enabled by insufficient LP token validation. In any standard automated market maker, liquidity pool shares are represented by LP tokens that track a provider’s proportional stake. When funds are withdrawn, the contract verifies the LP tokens being burned match the pool’s legitimate mint.

Raydium’s deprecated AMM V3 program failed to perform that check. The attacker created a fake SPL token mint unrelated to any real Raydium liquidity pool, minted a single unit of that counterfeit LP token, then called the legacy withdraw function.

The old contract treated the attacker as a 100% LP shareholder and released the entire pool’s reserves.

The sequence was repeated across all five deprecated pools, Sollet USDT–RAY, Sollet ETH–RAY, SRM–RAY, USDC–RAY, and RAY–SOL, draining approximately 150,177 RAY, 5,603 SOL, and 893,700 USDC in total.

Pseudonymous Raydium contributor 0xInfra confirmed on X that the attack was caused by “a self-contained logic flaw” and explicitly ruled out any key compromise or authority-level issue, meaning no propagation risk exists to current Raydium programs.

The December 2022 Raydium hack, a roughly $4.4 million loss caused by a private key theft – had pushed the team to harden operational security and migrate to audited contracts.

The June 2026 incident is a structurally different failure: not an operational breach, but a legacy codebase left callable on-chain with real assets still sitting inside it.

Tornado Cash Exit: Funds Bridge to Ethereum, Trail Goes Cold

On-chain investigators flagged the exploit in real time as the attacker aggregated USDC, SOL, and RAY across the five drained pools before moving cross-chain.

The full balance was bridged from Solana to Ethereum, then routed through KuCoin and FixedFloat before landing in Tornado Cash, the privacy protocol that remains the exit ramp of choice for DeFi exploit proceeds.

Community analysts tracking the wallet ending in ‘Bq33QVk’ confirmed the complete cross-chain exit, noting the attacker did not attempt to liquidate funds through Solana-native venues.

Once inside Tornado Cash, transaction-level tracing breaks down. No funds are reported frozen or flagged by centralized exchanges at this time.

No Active Users Affected, Raydium Treasury to Cover Losses

The most important immediate fact for Raydium users: no active accounts or current pools were touched. “No current users of Raydium are affected by this exploit or would have been able to interact with these pools through the UI since their deprecation,” 0xInfra stated.

The deprecated AMM V3 pools were invisible in the front-end and inaccessible through normal user flows.

Raydium confirmed it will repay all stolen funds in full using its protocol treasury. Legacy AMM V3 program IDs are being formally retired to prevent further calls, and the team has launched a comprehensive security review of all mainnet and legacy code paths. The reimbursement timeline has not been specified publicly.

RAY token is up around 2% in the 24 hours following the incident, trading at $0.578. The token has shed 7% over the past week amid broader Solana ecosystem weakness and sits 96.6% below its all-time high of $16.83.

Discover: The Best Token Presales