Raydium Exploited Through Deprecated Smart Contract Left Live for Five Years
What You Need to Know
- Raydium lost $1.34 million when attackers exploited deprecated smart contract code holding dormant liquidity pools.
- Attacker created fraudulent LP token with supply of one to trick legacy contract into releasing full pool balance.
- Stolen funds bridged to Ethereum and laundered through Tornado Cash within hours of the exploit.
- CertiK recorded 60 security incidents in May 2026 totaling $68.3 million, with code vulnerabilities causing majority of losses.
Raydium lost $1.34 million when an attacker exploited a logic flaw in smart contract code the Solana-based DEX had deprecated in 2021, generating fraudulent LP tokens to drain five liquidity pools that had been sitting dormant and inaccessible through the platform’s interface for years.
The mechanics matter here. The attacker fabricated an LP token with a supply of one, submitted a withdrawal request against the legacy AMM V3 program, and the old contract released the full pool balance because it had no way to distinguish that token from a legitimate claim. The funds were bridged to Ethereum via deBridge and most of the roughly 810 ETH landed in Tornado Cash within hours, a laundering path that has become almost procedurally standard since Tornado’s OFAC designation in 2022 failed to meaningfully deter its use. Raydium has been here before: in December 2022, a private key compromise cost the protocol $4.4 million, and that incident triggered a similar post-mortem cycle of audits and reassurances. The pattern of legacy code retaining live balances long after deprecation is a known category of risk, and this exploit is a clean example of why “deprecated” and “empty” are not synonyms.
Raydium holds $796 million in TVL and processed over $1.1 billion in DEX volume in the past week. The $1.34 million loss is noise against those numbers, but the reputational cost of a second breach in three years is harder to denominate.
The broader context is less comfortable. CertiK logged 60 confirmed security incidents in May 2026 alone, totaling $68.3 million in losses, with code vulnerabilities accounting for more than $45 million of that figure. Cumulative exploit losses through May approached $1.3 billion for the year, with bridge attacks making up $340.7 million of that total. For DeFi protocols sitting on significant TVL, the operational question is no longer whether to conduct legacy code reviews but how to explain to liquidity providers why those reviews happen reactively. Raydium’s announcement of a security review across all mainnet programs is the right response, though it arrives after the fact.
Raydium has committed to full compensation from its treasury but has not specified a timeline or distribution mechanism, which means affected liquidity providers are currently waiting on details the team has not yet disclosed.
0 Comments