Incident Overview
On June 10, 2026, the Solana-based decentralized exchange Raydium suffered a smart contract exploit targeting its deprecated AMM V3 program, resulting in a loss of approximately $1.34 million. The vulnerability was entirely self-contained within an inactive program phased out in 2021 and did not affect current users, active liquidity pools, or the current Raydium dApp/SDK. Raydium committed to fully compensating the losses using its protocol treasury.
The exploit targeted five inactive legacy pools (Sollet USDT-RAY, Sollet ETH-RAY, SRM-RAY, USDC-RAY, and RAY-SOL) that remained live on-chain despite being deprecated. The legacy AMM V3 program relied on the total supply of a pool's Liquidity Provider (LP) token mint to calculate proportional token distributions when users withdrew liquidity.
The root cause was an insufficient validation flaw regarding the LP token mint address. When a user initiated a liquidity withdrawal, the legacy contract failed to verify if the passed LP mint account strictly matched the pool's authentic, immutable LP mint address. The attacker exploited this missing check by creating an entirely new, malicious token mint on Solana and minting a massive supply of fake LP tokens to themselves. By passing this arbitrary mint into the deprecated contract, the attacker satisfied the proportion mathematics and executed unauthorized pool withdrawals, draining the remaining idle assets. The hacker immediately bridged the stolen funds from Solana to Ethereum and laundered 810 ETH through Tornado Cash and 7 ETH via FixedFloat.
Attacker Solana Address: 4WnPebowR4HHfumvNPaDjG6Pa5Hi1jxLm6xmmBq33QVk
Incident Report
Protocol Information
Market Context at Time of Hack
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Raydium, these are the critical security checks that could have prevented this incident (June 2026).
- Verify all logic paths related to Other are guarded by proper access controls and input validation
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialSources & References
Learn to Prevent the Next Raydium
The Raydium hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.