Raydium Hack

On June 10, 2026, the Solana-based decentralized exchange Raydium suffered a smart contract exploit targeting its deprecated AMM V3 program, resulting in a loss of approximately $1.34 million. The vulnerability was entirely self-contained within an inactive program phased out in 2021 and did not affect current users, active liquidity pools, or the current Raydium dApp/SDK. Raydium committed to fully compensating the losses using its protocol treasury.

The exploit targeted five inactive legacy pools (Sollet USDT-RAY, Sollet ETH-RAY, SRM-RAY, USDC-RAY, and RAY-SOL) that remained live on-chain despite being deprecated. The legacy AMM V3 program relied on the total supply of a pool's Liquidity Provider (LP) token mint to calculate proportional token distributions when users withdrew liquidity.

The root cause was an insufficient validation flaw regarding the LP token mint address. When a user initiated a liquidity withdrawal, the legacy contract failed to verify if the passed LP mint account strictly matched the pool's authentic, immutable LP mint address. The attacker exploited this missing check by creating an entirely new, malicious token mint on Solana and minting a massive supply of fake LP tokens to themselves. By passing this arbitrary mint into the deprecated contract, the attacker satisfied the proportion mathematics and executed unauthorized pool withdrawals, draining the remaining idle assets. The hacker immediately bridged the stolen funds from Solana to Ethereum and laundered 810 ETH through Tornado Cash and 7 ETH via FixedFloat.

Attacker Solana Address: 4WnPebowR4…q33QVk