Raydium News: $1.34M Drain Hits Deprecated Solana Pools

Raydium, a Solana-based decentralized exchange, was hit by a $1.34 million exploit on June 10, 2026. The attacker targeted five legacy liquidity pools linked to its outdated AMM V3 system, taking advantage of a vulnerability that had remained dormant on-chain for roughly five years.

Funds were stolen from a wallet linked to the attacker ending in “Bq33QVk,” including around $900,000 in USDC, $357,000 in SOL, and $86,000 in RAY.

After extracting liquidity, the attacker bridged assets from Solana to Ethereum and then funneled them through Tornado Cash, significantly obscuring the transaction trail and limiting recovery chances.

Exploit Breakdown: Fake LP Tokens and Broken Validation

The root cause of the exploit was a design flaw in Raydium’s legacy AMM V3 contracts, specifically weak validation of liquidity provider (LP) tokens.

In a standard AMM system, LP tokens represent ownership shares in a liquidity pool, and withdrawals require burning legitimate tokens tied to the correct pool mint.

In this case, the old Raydium contract failed to properly verify that the LP tokens belonged to valid liquidity pools.

The attacker exploited this by deploying a fake SPL token mint, generating a single counterfeit LP token, and using it to trigger withdrawal functions across multiple pools.

This same technique was repeated across five deprecated pools—Sollet USDT–RAY, Sollet ETH–RAY, SRM–RAY, USDC–RAY, and RAY–SOL—resulting in total losses of roughly 150,177 RAY, 5,603 SOL, and 893,700 USDC.

Raydium contributor 0xInfra confirmed the issue stemmed from a self-contained logic flaw rather than a private key compromise, meaning active contracts and current users are not at risk.

Unlike Raydium’s 2022 exploit, which was tied to a $4.4 million private key breach, this incident originated from legacy code that remained accessible despite being deprecated.

Cross-Chain Exit Through Tornado Cash

On-chain monitoring detected the exploit as the attacker consolidated drained assets across the affected pools. The funds were then bridged from Solana to Ethereum, routed through KuCoin and FixedFloat, and ultimately sent into Tornado Cash.

Once deposited into Tornado Cash, transaction tracing effectively ended, making further tracking extremely difficult.

Analysts tracking the wallet ending in “Bq33QVk” confirmed a complete cross-chain laundering route with no use of Solana-native liquidation channels.

As of now, no funds have been reported frozen or recovered by centralized exchanges.

User Impact and Raydium Response

No active users were affected by the exploit, as the compromised pools had already been deprecated and were not accessible through Raydium’s user interface.

Raydium has stated it will fully reimburse all stolen funds using its protocol treasury. The team is also formally retiring the legacy AMM V3 program IDs and conducting a full security review of both active and deprecated contracts. A public timeline for reimbursement has not yet been provided.

Following the incident, the RAY token rose roughly 2% in the short term to around $0.578. However, it remains down about 7% over the past week and is still trading far below its all-time high of $16.83, reflecting broader weakness across the Solana ecosystem.