The 1-Click Memecoin Factory: pump.fun, the $1.9M Insider Exploit, and Livestream Mayhem

The market arrives before the liquidity pool

pump.fun’s consequential idea was not a new kind of token. It was a new sequence for bringing one to market. The official Pump program documentation says an SPL coin can become immediately tradable on a bonding curve without its creator first seeding a conventional liquidity pool. A name, symbol, metadata link, and creator address enter the creation instruction; trading can begin against program-managed inventory rather than capital deposited by the issuer.^[1]

That changes who can launch, but it does not guarantee what happens after launch. Earlier descriptions often collapsed ‘no creator-seeded pool’ into ‘rug-proof.’ The two claims are not equivalent. The architecture reduces the familiar risk of a creator withdrawing an initial DEX pool, while leaving smart-contract authorities, account permissions, social manipulation, concentrated holdings, and ordinary price collapse as separate risks.^[1][2]

The pricing engine uses synthetic token and SOL reserves. The documentation says its formula is based on Uniswap V2: when buyers add SOL, the virtual and real SOL reserves rise while token reserves fall; a sale reverses those movements. Scarcer curve inventory therefore costs more. The important point is mechanical, not promotional: the program quotes against changing reserves instead of waiting for matching limit orders.^[1]

“The bonding curve formula is based on Uniswap V2 and uses synthetic x and y reserves to ensure that there is liquidity for the coin.”^[1]

— Pump program documentation

Completion is a state transition, not a safety certificate

A curve begins with real token inventory and no real SOL reserve. Each purchase moves those balances until the real token reserve reaches zero. At that point the program marks the curve complete. Current documentation describes a permissionless migration instruction that transfers completed liquidity to PumpSwap, pump.fun’s automated market maker, and burns the liquidity-provider tokens received from the new pool.^[1]

That current PumpSwap flow should not be pasted backward onto every period in the platform’s history. The same documentation calls an older withdraw instruction deprecated and says it previously let an authority migrate completed liquidity to Raydium from an off-chain server. The design evolved. A precise account therefore dates a mechanism or identifies it as current instead of presenting one threshold, venue, and fee schedule as timeless.^[1]

The documented global account also showed a 100-basis-point fee transferred to a fee-recipient account on buys and sells. One hundred basis points equals 1%, but that snapshot is not permission to label every historical or current charge 1%. Fee allocation has changed, and DefiLlama now separates user-paid fees from pump.fun’s protocol-revenue share, graduation fees, creator allocations, and other components.^[1][3]

That accounting distinction corrects the old story’s largest rhetorical shortcut. Fees are amounts paid by users; protocol revenue is the portion retained under a stated methodology; profit would require costs. A live analytics dashboard can document scale, but its changing totals cannot be silently relocated to an earlier date or renamed ‘pure profit.’ Dated figures and definitions are part of the claim, not editorial clutter.^[3]

The $1.9 million test of the control plane

On May 16, 2024, the control plane failed. pump.fun alleged that a former employee used a privileged position to access a withdraw authority and compromise internal systems. According to the platform account reported by Cointelegraph, flash-loan-funded purchases pushed selected coins to the end of their curves, after which the attacker accessed curve liquidity and repaid the borrowed SOL.^[2]

The reported window was narrow: 15:21 to 17:00 UTC. Approximately 12,300 SOL, then valued at about $1.9 million, left the contracts. Those reported facts support an insider-access story; they do not support the earlier draft’s invented confession, motive, named identity, arrest timeline, or sentencing claims.^[2]

Trading was temporarily paused and later resumed. pump.fun said affected users would receive “100% of the liquidity” they had before the incident within 24 hours. That is an exact platform promise preserved by the report, not independent proof that every reimbursement settled exactly as planned. The wording matters because a post-incident commitment and a verified completion record answer different questions.^[2]

“100% of the liquidity”^[2]

— pump.fun, May 16, 2024 incident statement as quoted by Cointelegraph

When every token page became a stage

The launch machine did not remain merely financial. Livestreaming let creators place video beside a coin and its market, joining performance, distribution, and speculation in one interface. The mechanism rewarded attention immediately: a broadcast could attract viewers, viewers could trade, and the moving curve could feed the next round of attention. The same low friction that accelerated issuance also accelerated the platform’s moderation burden.^[4]

By late November 2024, reporting described livestreamed material ranging from animal cruelty to proposed self-harm. Those are the supported categories; lurid lists from recycled articles should not be embellished. Co-founder Alon acknowledged legitimate concerns and framed moderation as a platform responsibility even while defending expression. That position recognized that permissionless trading does not require permissionless promotion by a hosted interface.^[4]

“although we strongly stand for free speech and expression, it's our responsibility to ensure that users don't see clearly repulsive/dangerous content and that bad actors aren't given a platform to act as they wish.”^[4]

— Alon, pump.fun co-founder, November 22, 2024 statement quoted by Decrypt

On November 25, pump.fun chose a hard boundary. It said livestreaming would be paused for an indefinite period until moderation infrastructure could cope with heightened activity. The statement did not claim the underlying tokens or contracts had been disabled. It removed a distribution feature, illustrating the layered nature of the system: on-chain markets, a web interface, and a media product can each have different controls.^[4]

Scale, litigation, and the discipline of attribution

By March 25, 2025, a Bankless interview summary reported more than 9 million tokens created and more than 15 million unique addresses interacting with pump.fun since January 2024. It also attributed $600 million in revenue to the bonding-curve model. These are dated, publisher-framed measurements, not eternal dashboard readings and not a claim of $600 million in profit.^[5]

Legal scrutiny followed the platform’s scale. A federal court filing dated April 13, 2026 confirms an active Southern District of New York case, Aguilar v. Baton Corporation, No. 1:25-cv-00880-CM-BCM. The caption lists three plaintiffs and Baton Corporation Ltd. doing business as pump.fun among multiple defendants. A docket proves litigation exists; it does not prove the complaint’s allegations or establish liability.^[6]

Document 183 supplies an unusually relevant editorial warning. Plaintiffs’ counsel acknowledged that quotation marks had remained around text converted into paraphrase and that several citations required correction. The filing says the errors did not change the substantive arguments, but its procedural status is beside the broader lesson: quotation marks assert exact language, while paraphrase transfers responsibility to the writer.^[6]

pump.fun’s story is therefore neither a frictionless triumph nor a single scandal. Its bonding curve removed the need for creator-seeded liquidity and helped issuance reach extraordinary scale. The exploit exposed privileged access; the livestream pause exposed moderation limits; the lawsuit records contested claims still awaiting adjudication. Each layer demands its own evidence, date, and vocabulary. Simplicity at the launch button never meant simplicity everywhere else.^{[1][2][4][5][6]}