The 1-Click Memecoin Factory: pump.fun, the $1.9M Insider Exploit, and Livestream Mayhem

The market arrives before the liquidity pool

pump.fun’s consequential idea was not a new kind of token. It was a new sequence for bringing one to market. The official Pump program documentation says an SPL coin can become immediately tradable on a bonding curve without its creator first seeding a conventional liquidity pool. A name, symbol, metadata link, and creator address enter the creation instruction; trading can begin against program-managed inventory rather than capital deposited by the issuer.^[1]

That changes who can launch, but it does not guarantee what happens after launch. Earlier descriptions often collapsed ‘no creator-seeded pool’ into ‘rug-proof.’ The two claims are not equivalent. The architecture reduces the familiar risk of a creator withdrawing an initial DEX pool, while leaving smart-contract authorities, account permissions, social manipulation, concentrated holdings, and ordinary price collapse as separate risks.^[1][2]

The pricing engine uses synthetic token and SOL reserves. The documentation says its formula is based on Uniswap V2: when buyers add SOL, the virtual and real SOL reserves rise while token reserves fall; a sale reverses those movements. Scarcer curve inventory therefore costs more. The important point is mechanical, not promotional: the program quotes against changing reserves instead of waiting for matching limit orders.^[1]

“The bonding curve formula is based on Uniswap V2 and uses synthetic x and y reserves to ensure that there is liquidity for the coin.”^[1]

— Pump program documentation

Completion is a state transition, not a safety certificate

A curve begins with real token inventory and no real SOL reserve. Each purchase moves those balances until the real token reserve reaches zero. At that point the program marks the curve complete. Current documentation describes a permissionless migration instruction that transfers completed liquidity to PumpSwap, pump.fun’s automated market maker, and burns the liquidity-provider tokens received from the new pool. That instruction is permissionless in the documented snapshot; the same documentation identifies enable_migrate as a Global field and says the Global authority can update every Global field except the authority field itself.^[1]

That current PumpSwap flow should not be pasted backward onto every period in the platform’s history. The same documentation calls an older withdraw instruction deprecated and says it previously let an authority migrate completed liquidity to Raydium from an off-chain server. The design evolved. A precise account therefore dates a mechanism or identifies it as current instead of presenting one threshold, venue, and fee schedule as timeless.^[1]

The documented global account also showed a 100-basis-point fee transferred to a fee-recipient account on buys and sells. One hundred basis points equals 1%, but that snapshot is not permission to label every historical or current charge 1%. Fee allocation has changed, and DefiLlama now separates user-paid fees from pump.fun’s protocol-revenue share, graduation fees, creator allocations, and other components.^[1][3]

That accounting distinction corrects the old story’s largest rhetorical shortcut. Fees are amounts paid by users; protocol revenue is the portion retained under a stated methodology; profit would require costs. A live analytics dashboard can document scale, but its changing totals cannot be silently relocated to an earlier date or renamed ‘pure profit.’ Dated figures and definitions are part of the claim, not editorial clutter.^[3]

The $1.9 million test of the control plane

On May 16, 2024, the control plane failed. pump.fun alleged that a former employee used a privileged position to access a withdraw authority and compromise internal systems. According to the platform account reported by Cointelegraph, flash-loan-funded purchases pushed selected coins to the end of their curves, after which the attacker accessed curve liquidity and repaid the borrowed SOL.^[2]

Cointelegraph reported that the incident took place on May 16 between 15:21 and 17:00 UTC, with approximately 12,300 SOL, then worth about $1.9 million, taken from the contracts. Its account attributed the use of privileged access to pump.fun’s statement about a former employee; the platform had not named that person in the statement reported by the article.^[2]

Trading was temporarily paused and later resumed. pump.fun said affected users would receive “100% of the liquidity” they had before the incident within 24 hours. That is an exact platform promise preserved by the report, not independent proof that every reimbursement settled exactly as planned. The wording matters because a post-incident commitment and a verified completion record answer different questions.^[2]

“100% of the liquidity”^[2]

— pump.fun, May 16, 2024 incident statement as quoted by Cointelegraph

When every token page became a stage

The launch machine did not remain merely financial. Decrypt reported that livestreaming enabled users to stream a video feed alongside the creation of a meme coin, with the feed embedded on the coin’s Pump.fun page. Bringing video into the hosted token page also created a moderation burden that the platform later said had outgrown its infrastructure.^[4]

By late November 2024, Decrypt was reporting livestreams involving animal cruelty and threats of self-harm. On November 22, co-founder Alon acknowledged concerns about the broadcasts and said the platform was responsible for keeping dangerous content and abusive actors away from users, even while defending expression. Open token trading and the decision to promote a broadcast on a hosted page thus involved different responsibilities.^[4]

“although we strongly stand for free speech and expression, it's our responsibility to ensure that users don't see clearly repulsive/dangerous content and that bad actors aren't given a platform to act as they wish.”^[4]

— Alon, pump.fun co-founder, November 22, 2024 statement quoted by Decrypt

On November 25, pump.fun chose a hard boundary. It said livestreaming would be paused for an indefinite period until moderation infrastructure could cope with heightened activity. The statement did not claim the underlying tokens or contracts had been disabled. It removed a distribution feature, illustrating the layered nature of the system: on-chain markets, a web interface, and a media product can each have different controls.^[4]

Scale, litigation, and the discipline of attribution

By March 25, 2025, a Bankless interview summary reported more than 9 million tokens created and more than 15 million unique addresses interacting with pump.fun since January 2024. It also attributed $600 million in revenue to the bonding-curve model. These are dated, publisher-framed measurements, not eternal dashboard readings and not a claim of $600 million in profit.^[5]

On August 31, 2026, the SDNY court ruled on the motions to dismiss in Aguilar v. Baton Corporation, No. 1:25-cv-00880-CM-BCM. Counts I and II, for substantive RICO and RICO conspiracy, remain pending only for Kendall Carnahan and Michael Okafor against Baton Corporation Ltd., Alon Cohen, Dylan Kerler, and Noah Tweedale. The court dismissed every claim by Diego Aguilar against the defendants who filed the motions, and every claim against the Solana defendants. The unidentified, unserved Lead KOL Doe defendants 1–25 were outside the motions decided that day. It dismissed Counts III and IV for FRED and GRIFFAIN on the merits under Rule 12(b)(6), with prejudice, and for the other eighteen Pump Tokens for lack of class standing, without prejudice; it also dismissed Count V under Rule 12(b)(6), with prejudice, against every moving defendant. Survival at the pleading stage is not a finding of liability.^[7]

Document 183 supplies an unusually relevant editorial warning. Plaintiffs’ counsel acknowledged that quotation marks had remained around text converted into paraphrase and that several citations required correction. The filing says the errors did not change the substantive arguments, but its procedural status is beside the broader lesson: quotation marks assert exact language, while paraphrase transfers responsibility to the writer.^[6]

pump.fun’s story is therefore neither a frictionless triumph nor a single scandal. Its bonding curve removed the need for creator-seeded liquidity and helped issuance reach extraordinary scale. The exploit exposed privileged access; the livestream pause exposed moderation limits; and the August 2026 order narrowed the lawsuit while leaving two plaintiffs’ RICO claims against four Pump.fun defendants unresolved. Each layer demands its own evidence, date, and vocabulary. Simplicity at the launch button never meant simplicity everywhere else.^{[1][2][4][5][7]}