Raydium to Cover $1.34M Loss After Exploit of Retired AMM

Raydium announced Wednesday that an exploit of a retired Solana AMM V3 program removed about $1.34 million from inactive liquidity pools for RAY-SOL, USDC-RAY and SRM-RAY.

The protocol estimated the attacker withdrew roughly 150,000 RAY, 5,600 SOL and nearly 900,000 USDC. The affected pools were inactive and tied to a deprecated on-chain program that was phased out in 2021 and had not been accessible through Raydium's user interface since then.

Raydium attributed the flaw to “insufficient validation of the LP mints,” which allowed the attacker to bypass intended proportion checks. In automated market makers, smart contracts mint liquidity provider tokens to represent shares of a pool. If LP mint validation is incomplete, an actor can create or alter those tokens to withdraw assets in unintended ratios.

The protocol noted no current users were affected and that its “SDK and DAPP do not support mainnet interactions with legacy AMM V3 pools.” Raydium's active mainnet programs were not impacted and are undergoing a separate security review.

Raydium will reimburse all losses from its treasury and is reviewing its legacy code base to reduce the risk of similar incidents. The team did not disclose how the attacker moved or converted the drained assets, or whether any funds have been recovered.

The project's native token RAY showed little market reaction and traded slightly higher on the day. No further information was provided about the attacker's identity or motives.