A Pump.fun employee used the platform’s withdraw authority, flash-borrowed SOL, and bought coins until their curves filled. About 12,300 SOL, near $1.9 million, moved. Trading stopped the same day.
Pump.fun said on X that a former employee took the withdraw authority at 15:21 UTC.
Jarett Dunn, known on X as Stacc, said he did it. He later pleaded guilty in London to fraud by abuse of position and transfer of criminal property.
The court heard about 14,716 SOL. Pump.fun said it would refill liquidity for the coins that were hit.
Six days into the TruthOrDare coin, the dev Mikol Ayala stood in a Florida parking lot, got doused in alcohol, and had fireworks shot at him on a livestream. He caught fire and took third-degree burns across about a third of his body.
He had been streaming stunts all week to pump $DARE: drinking bong water, smashing his TV. The fire was a dare from the chat.
The coin climbed to about $2 million combined value the next day while he was in a trauma center. He kept promoting it from the hospital bed.
Months later he quit the project and said he had been taken advantage of.
Over one weekend, X accounts for Caitlyn Jenner, Rich the Kid, Soulja Boy, and others pushed Pump.fun coins. Investigator Roxo said the rugs, other than Jenner’s, traced to Sahil Arora.
Rich the Kid posted a video saying his page was hacked, a coin was promoted by Sahil, and the supply was dumped.
Jenner and her manager said her own account was not hacked and that $JENNER was real. Arora then posted that her team had cut him off.
Cointelegraph reported Roxo’s wallet links. Treat the Jenner launch as disputed, and the other five as reported rugs.
A 19-year-old streaming as Trevv passed out from fentanyl on a Pump.fun livestream for his coin CHD, and viewers thought he had died. A trader called Beaver says he then paid him over $2,000 to fake his death, with staged screenshots and a video of his supposed mother grieving.
The fake death took CHD to a peak near $200,000. The next day he came back with a coin called I’m Alive.
He told Decrypt the influencers running the streams kept most of the money. A third coin with his girlfriend peaked near $680,000.
Protos reported doubts that the drugs on the later stream were what they were claimed to be.
A boy launched Gen Z Quant on Pump.fun, bought about 5% of supply for roughly $350, livestreamed the run, then sold it all in about eight minutes for near $30,000 and flipped off the camera. The price crashed.
He then ran the same play on two more coins, im sorry and my dog lucy, for more than $50,000 in a night. WIRED calls it a soft rug pull.
Traders doxxed the boy, reported to be 13, and his family, and launched coins named after his relatives with their photos.
In revenge, buyers pushed QUANT to about $85 million within hours. The stash he sold would have been worth over $4 million if he had held.
A streamer in a wig and fake beard stood under a noose and said he would hang himself unless his coin pumped. He appeared to do it on a Pump.fun livestream. It was staged.
Viewers saw him still moving while friends “saved” him. The promoter later said it was fake and that the point was to get Pump.fun livestreams taken down.
The outrage, with the earlier animal-abuse and self-harm streams, is why Pump.fun pulled livestreams that same day.
Pump.fun paused livestreams after creators used them to push coin prices with dangerous and illegal acts. The company posted the notice on X the same day.
Daily streams had jumped more than 100x in under a week. The team said it was already taking down hundreds a day.
The pause was indefinite, until moderation could keep up. Livestreams returned in April 2025 for about 5% of users, with a written ban on violence and illegal acts.
ZachXBT posted a thread tying a run of hacked X and Instagram accounts to Pump.fun launches. He estimated more than $3.5 million taken across 16 coins.
Named accounts included McDonald’s, Usher, Wiz Khalifa, the Kabosu owner, Andy Ayrey, and SPX6900.
Ayrey’s account was the largest, about $2.2 million across six tokens. The McDonald’s GRIMACE post cleared about $690,000. USHER was about 4,868 SOL.
He linked the coins by funding between wallets and by cash-outs into the same casino deposit addresses.
After CZ posted his dog, a BROCCOLI coin on Pump.fun ran to a quoted $9.57 billion market cap. A cluster of new wallets held about 79% and sold it down in two clips.
Sahil Arora told Decrypt he controlled the cluster and used the same wallet that deployed $JENNER. He called it his most successful scam.
TrenchRadar counted 15 fresh wallets and 79.31% of supply. Bubblemaps confirmed a large rug and said the two dumps were about $3.3 million of sales, less than the $6.5 million Arora claimed.
The quoted market cap was inflated by thin liquidity. The coin later sat near a $96,000 market cap.
Pump.fun’s X account was taken over and used to post a fake “official governance” PUMP token with a contract address. It was heavily bundled. It still cleared a $5 million market cap before it crashed.
Co-founder Alon Cohen said the account was compromised and told people not to interact. He suspected the problem came from inside X.
ZachXBT tied it to the same wave that hit Jupiter DAO and the dogwifhat account, and said it likely was not the teams’ fault.
Bubblemaps flagged the bundling in real time. The hacker went on to push coins called HACKED and hackeddotfun. No real Pump.fun token existed yet.
Solidus Labs counted tokens launched on Pump.fun from January 2024 through March 2025. Of those with at least five trades, 98.6% later sat under $1,000 of liquidity.
The count was about 7 million tokens, with about 97,000 still above $1,000 liquidity. Coins that graduated to Raydium were left out of the dead pile.
Solidus called that a pump-and-dump pattern. Pump.fun rejected reading every dead coin as fraud. CoinDesk ran both sides.
A separate 2026 paper on Solana rugs, not only Pump.fun, marked 76,469 rug tokens in the first half of 2025 across Orca, Raydium, and Meteora.
COPE was sold as the story of a dev who kept going for 17 months until the community rewarded him. A KOL posted “a real success story… Don’t $cope later.” It ran up about 489% to near $17 million in a day and lost almost all of it by the end of the month.
The class action uses COPE as its main case study. It alleges insiders bought first, tier by tier, before the public got the contract address.
It also alleges the dev had launched and sold earlier versions of COPE and was told to delete the posts so it would look like one long-suffering project.
These are a complaint’s allegations as the court summarized them. The dev is not named and is not a party.
The coin showed a clean wallet as its creator on Pump.fun. The wallet that actually deployed and controlled it was a different one, and it was a bundle wallet. Near 30% of supply was sniped and dumped in about five minutes.
The gap between the face wallet and the real authority is the LARP pattern: a safe-looking front, a hidden operator.
This one is a scanner’s worked example, not a newsroom report. Treat it as a pattern to check, not a headline.
The class action Aguilar v. Baton Corp., filed January 30, 2025, calls Pump.fun a rigged “digital casino” and estimates retail losses of $4 to $5.5 billion. On August 31, 2026, a New York federal judge let the racketeering claims against Pump.fun and its three founders go forward.
The same ruling dismissed every claim against Solana Labs, the Solana Foundation, and their executives, and threw out the securities claims.
Jito and its executives had already been dropped from the case in September 2025, with no payment.
Surviving a motion to dismiss is not a finding of guilt. The claims still have to be proven.
On the night of Oct 20, Pump.fun said a trader known as Kimchi would help shape the product. In the same minute a new KIMCHI coin filled its own bonding curve. X called it a LARP and an insider launch. The chain shows a closed curve and a 75% wallet. It does not show who owns that wallet.
At 23:00:15 UTC the coin CSocnzcRpgSCr1naKcNTieWZUxb6rABe45j844m7pump was created. The deployer bought 793 million of 1 billion tokens for 85 SOL, about $9,073, and filled the curve. The first outside buyer paid 3.8 times that price.
Fifty-seven seconds later, 750 million tokens moved to one wallet. Bitquery says X flagged that wallet as the trader’s. Bitquery did not verify it. Larpcheck says the Pump.fun profile links it to @kimchi1x, and that the account had not posted the coin.
Three wallets that have paid each other since January dumped an older KIMCHI and bought the new one inside a minute. Bitquery counted about $104,000 out in nine minutes. The old coin fell from about $5.35 million to about $875,000 of fully diluted value in 15 minutes. Bitquery found no transfer tying that cluster to the deployer, and wrote that the ledger cannot show what anyone knew.
The same deployer had launched 33 Pump.fun coins since July 23, including four test coins that afternoon. Pump.fun and the trader had not, as of Oct 21, answered the insider posts.
Copies kept launching. On Oct 22 a coin named Aura Final Boss (Kimchi), 9vnf1JQEx6DVdbbDicr3hckf6LAigkxMPeoQBBZupump, fell about 99% from its peak within roughly an hour. CoinUFO flagged the creator as a serial launcher. There are more than a thousand other coins using the ticker.
Today, we feel scammed by pump.fun, and we're fighting back.
Send the receipts. A person reads every file before it goes up and sets its $PUMP bounty. Paid bounties show on the file, with the transaction. Stick to what you can show: posts, transactions, wallets. No home addresses, no family members.