Raydium’s old liquidity pools exploited for $1.3 million

Decentralized exchange Raydium has reportedly suffered a $1.3 million exploit that saw attackers drain the firm’s old liquidity pools.

Crypto investigator “Specter” spotted what they believed to be a Raydium exploit at 3pm GMT+1, claiming that the funds have been bridged to Ethereum and are now being laundered via Tornado Cash.

They also shared what they believe to be the attacker’s addresses:

• 0x0EaBAAb9a56011c6158D4aA7f2E49A82fB34E609
• 4WnPebowR4HHfumvNPaDjG6Pa5Hi1jxLm6xmmBq33QVk.

Since Specter’s post, Raydium official “Infra” has revealed that the firm is aware of the exploit and is conducting a security review to determine what happened.

Infra says, “No current users of Raydium are affected by this exploit or would have been able to interact with these pools through the UI since their deprecation.”

They claim that after an initial review, 150,177 RAY, 5,603 SOL, and 893,700 USDC have been stolen. Together, the stolen funds are worth roughly $1.34 million.

The cause of the attack has been attributed to a vulnerability associated with “insufficient validation of the LP mint,” and an exploit with Raydium’s legacy AMM V3 program that was phased out in 2021.

Infra said, “Because the program did not properly verify the LP mint address, an attacker was able to create a new mint and use it as the LP token, bypassing the intended proportion checks.”

It added that all other Raydium mainnet programs avoid this vulnerability as they use a “virtual supply mechanism for proportion checks and correctly verify the LP mint along with all other relevant account information.”

Infra ruled out any key compromise or authority-level issue, and claimed that the attack was caused “by a self-contained logic flaw.”

According to Infra, affected users will be fully compensated by Raydium’s treasury.