Raydium

Documented events with consequences still open. Each entry carries a source and a date.

1. Dec 16, 2022 Hack / funds theft Severe $4M ✓ resolved

   Pool admin account key compromised: eight pools drained for about 4.4 million dollars. No contract flaw — it was the Pool Owner authority. Compensation actually carried out: claim portal open until 14 May 2023, 100% of principal returned on three pools and 90% on the other six

   On 16 December 2022 at 10:12 UTC an attacker began removing liquidity from Raydium using the **Pool Owner (admin)** account of the Liquidity Pool V4 program. The technical point, and Raydium writes it in its own post-mortem, is that **there was no vulnerability in the contracts**: the attacker held the private key of the administrative authority, most likely through trojan-type malware on the machine holding it. With that key they called a fee-withdrawal function and drained **eight constant-product pools** for roughly **4.4 million dollars** in total, in RAY, stSOL, whETH, USDC, SOL, UXP, ZBC and USDT. Developers shipped a patch within hours, blocking any further reach into the other pools. The recovery attempt failed: Raydium publicly offered a 10% bounty plus the stolen RAY balance, and the attacker returned nothing. At that point the protocol did the only thing left, and saw it through: governance authorised the use of buyback revenues and team token allocations to reimburse liquidity providers, against a snapshot of LP balances taken at the moment of the exploit. The **claim portal** stayed open until **14 May 2023 at 23:59 UTC** and returned **100% of the principal** lost on RAY-USDC, RAY-SOL and RAY-USDT, and **90%** on SOL-USDC, SOL-USDT, stSOL-USDC, ETH-USDC, UXP-USDC and ZBC-USDC. Whatever went unclaimed returned to the Buyback Treasury. Stated precisely, because the difference matters: this is not a promise of a refund, it is a refund made and closed — but not whole for everyone, six pools out of nine recovered nine tenths.

   ↗ source
2. Jun 10, 2026 Hack / funds theft Moderate $1M ● open

   Five pools of the old AMM V3 program, retired in 2021 but never switched off, drained for 1.34 million dollars with a fake one-unit LP token. Raydium committed to covering it all from the treasury: as of today that is a declared commitment, not a verified refund

   On 10 June 2026 an attacker withdrew **1.34 million dollars** — 150,177 RAY, 5,603 SOL and 893,700 USDC — from **five pools** of the **AMM V3** program, the automated market maker version Raydium had **retired in 2021**. RAY-SOL and USDC-RAY were among the pools hit. The flaw is of a simplicity that explains why years of audits are not enough when old code stays alive: on withdrawal the legacy program checked the *amount* of LP tokens but **not the address of the mint** they came from. The attacker created an arbitrary SPL mint with no link to any real pool, issued **a single unit** of it and called the old contract's withdraw function, bypassing the proportion checks and taking the entire liquidity. No key compromised, no current contract touched. The official Raydium Infra account acknowledged it the same day: «Raydium is aware of an exploit involving unauthorized removal of liquidity from its legacy AMM V3 program which was previously phased out in 2021. No current users of Raydium are affected by this exploit or would have been able to interact with these pools through the UI». The company stated that **the treasury will fully cover** the losses of the liquidity providers left in those pools, and opened a security review. ⚠️ This is what keeps the incident open: four months on, **no source, Raydium included, has published confirmation that the refunds were actually paid** — no timeline was disclosed at the time of the announcement. The usual rule applies: a promise of a refund is not a refund, and until the repayment is stated in the past tense the incident stays unresolved. The 2022 precedent, where Raydium did see compensation through, counts in its favour but does not replace verification.

   ↗ source

verified on Oct 2, 2026