Five-Year-Old Code Comes Back to Bite Raydium for $1.34M 🦷

Raydium, a Solana-based decentralized exchange, confirmed on June 10, 2026, that an attacker drained approximately $1.34 million from five deprecated liquidity pools on its legacy AMM V3 program, a smart contract that had been phased out in 2021. Pseudonymous Raydium contributor 0xInfra posted on X that "No current users of Raydium are affected by this exploit or would have been able to interact with these pools through the UI since their deprecation," and said the firm would repay losses using its treasury. The exploit removed roughly $900,000 in USDC, about $357,000 in SOL, and $86,000 worth of the exchange's native RAY token from the affected pools.

The attacker, using a Solana address ending in "Bq33QVk," bypassed validation logic in the deprecated program by creating a fake SPL token mint and using a single counterfeit LP token to withdraw each pool's entire reserves. The five pools drained were Sollet USDT–RAY, Sollet ETH–RAY, SRM–RAY, USDC–RAY, and RAY–SOL, yielding approximately 150,177 RAY, 5,603 SOL, and 893,700 USDC. After draining the pools, the exploiter bridged the funds from Solana to Ethereum and deposited them into Tornado Cash to obscure the transaction trail. 0xInfra described the issue as "a self-contained logic flaw" and stated that it was not "a key compromise or authority-level issue," adding that Raydium's existing mainnet programs prevent this type of vulnerability.

The incident extends a string of recent DeFi and crypto security failures. In April, KelpDAO and Solana-based Drift Protocol each suffered exploits affecting just shy of $300 million in funds, according to earlier reporting. Last week, privacy network Zcash saw its native token fall more than 40% in 24 hours after developers disclosed that a security researcher used Anthropic's Claude Opus 4.8 to identify a four-year-old vulnerability in one of its privacy pools. The Raydium exploit occurred one day after Anthropic released an upgraded version of its cybersecurity-focused model called Mythos, alongside a publicly available version named Claude Fable 5. Analysts told Decrypt in May that AI is transforming exploit discovery by "automating what skilled auditors do," though no evidence has linked AI tools to the Raydium attack.