How a principled hacker exploited a hole in Solana to fund indie projects
By Kike Gandia · Threats · 3 min read
In the world of shitcoins and DEXs, where a new token is born and dies every week, there is always someone who finds a way to game the rules of the system. This is the story of how a guy called Jared hacked Pump.fun, a memecoin platform on Solana, and instead of walking off with the cash, decided to redistribute it to projects he found interesting. A modern-day Robin Hood, with lines of code instead of arrows.
Pump.fun: the crypto degens' money-printing machine
If you have never heard of Pump.fun, it is basically a platform that lets anyone create their own memecoin on the Solana blockchain in a few clicks. The trick is its “graduation” mechanism: tokens start trading on a price curve inside Pump.fun, and once they hit 85 SOL (roughly $68,000 to $73,000 in market cap), they are automatically listed on Raydium, a decentralized exchange (DEX). At that point:
- 85 SOL
- the threshold that graduates a token to Raydium (between $68,000 and $73,000 in market cap)
- 2.3 SOL
- is kept by Pump.fun as a service fee
- $12,000
- in tokens goes to the liquidity pool (the LP tokens are burned: permanent liquidity)
- 0.5 SOL
- goes to the token's creator
The automatic split at the moment of graduation. Where there is money, there is an exploit waiting to be found.
This model encourages creators and traders to launch new tokens and push their prices all the way to graduation. But as with everything in crypto, where there is money, there is an exploit waiting to be found.
Jared and the smartest flash loan of the year
Jared spotted an opportunity in this system and exploited it with surgical precision. Using a flash loan, which is basically an instant, uncollateralized loan that must be repaid within the same transaction, he did the following:
- Step 1 — The flash loan
An instant, uncollateralized loan that has to be repaid within the same transaction. He uses it to buy enough tokens to force graduation. - Step 2 — The diversion
He manipulates the system to redirect the SOL meant for the liquidity pool to addresses he controls. - Step 3 — The exit
He immediately sells the tokens to repay the loan and pockets between 1 and 80 SOL for every memecoin that graduates. - Step 4 — The scale-up
He automates the process to repeat it across thousands of tokens, and sends the profits to Solana projects he finds interesting.
Surgical precision against the contract's own logic: he stole from no one; he bent an arbitrage process in his favor.
Unlike the usual exploiters, who simply drain contracts and vanish into the murk of Tornado Cash, Jared was running an attack with a purpose. His bot redistributed part of the money to other projects in the Solana ecosystem, helping to fund independent initiatives.
Pump.fun strikes back: fees through the roof
Obviously, when someone starts playing around with millions of dollars in a semi-automated system, somebody notices. Pump.fun's response was quick and simple: it raised transaction fees on the platform. From then on, every time Jared tried to buy tokens to run his exploit, he was charged an absurd amount of SOL in fees. End of hack.
Was what Jared did illegal? Technically, no. He simply turned the logic of Pump.fun's contract against itself. He did not steal directly from anyone; he just bent an arbitrage process in his favor. It is the kind of hack that forces platforms to revisit their mechanisms and tighten their security. In this case, the fix was drastic but effective: make any attempt to repeat the feat cost more than it could earn.
The typical exploit what usually happens
- Drain the contract and disappear.
- The funds end up in the murk of Tornado Cash.
- Anonymous wallets, no trail.
What Jared did the outlier
- An attack with a stated purpose.
- The bot redistributed part of the money to the Solana ecosystem.
- It funded independent initiatives instead of disappearing.
Pump.fun's response was quick and simple: raise fees until repeating the hack cost more than it earned.
A hacker or a benefactor of the ecosystem?
Jared's case is a reminder that security in DeFi is a game of cat and mouse. There is always someone willing to squeeze every last line of code for an edge, and sometimes, as here, the outcome is more interesting than just watching someone get rich.
At heart, what Jared did was prove that the system had a weak spot and use it to fund something he believed in. In an industry where most exploits end with the funds disappearing into anonymous wallets, his story is a rarity: a guy who, instead of vanishing with the funds, reinvested them in the community.
The moral is clear: in crypto, nothing is written in stone, and real innovation sometimes comes from those who choose to challenge the status quo.
Related service
Pentesting and ethical hacking services