Aquifer Hack

On August 31, 2026, Solana-based automated market maker Aquifer suffered an unverified CPI token program injection exploit resulting in approximately $2.5 million in total losses across 90+ attack transactions, after which the protocol issued an on-chain whitehat offer allowing the attacker to keep 20% if 80% of the stolen funds are returned by September 3, 2026.

The exploit targeted Aquifer's swap function on Solana. When executing a token swap, the protocol allowed callers to supply an unverified, caller-controlled token program parameter (tokenProgramA) for the input token rather than enforcing a check against canonical SPL Token Program addresses. The attacker deployed a custom, dummy Solana program (DMBpPM...) designed to mirror SPL Token Transfer instruction formats and return a success signal without performing any actual token transfers.

During the attack, the adversary initiated swap instructions passing USDC as the nominal input token parameter alongside their malicious token program, targeting real liquidity vaults such as HYPE. Aquifer invoked the malicious program via Cross-Program Invocation (CPI), which accepted the parameters and reported a successful transfer. Because Aquifer relied entirely on the CPI return status without verifying actual input token balance deltas, it released output tokens from its vaults without receiving any input tokens.

The stolen assets were swapped to SOL, bridged to Ethereum, and converted into approximately 1,000.8 ETH. On the same day, Aquifer's upgrade authority published an on-chain message offering a 20% whitehat bounty if 80% of the funds are returned to designated recovery addresses.

On-Chain Key Addresses:

Upgrade Authority: 8pJhHxPQRi…RzheSA

Attacker Solana Address: 7fTe9pvrwX…4gRk7J

Attacker Ethereum Address: 0x2Dfe9e969796e2797278b02761dd9Ad6aE922746

Solana Recovery Address: 8af8RnAgyK…vRyjox

Ethereum Recovery Address: 0xb7EAA8cd5dFAD8021d9fB19c8a21613679f268F5