Go to app

Did the Raydium exploit expose hidden risks in

Published 6/11/2026, 12:08:22 AM

Answer

Yes, the Raydium exploits exposed genuine hidden risks in deprecated DeFi pools. The evidence shows two distinct incidents — a December 2022 exploit ($4.4–5.5M) and a June 2026 exploit ($1.34M) — both targeting legacy infrastructure that remained live on-chain despite being officially deprecated. The core risk: "deprecated" status in a UI does not equate to disabled or secure smart contracts.

Claim Resolution

ClaimStatusNotes
c1: Raydium exploit involved deprecated/old poolsPartially supportedMultiple sources confirm the June 2026 exploit targeted legacy AMM V3 pools deprecated since 2021. However, the specific technical mechanism (LP mint validation flaw) is not independently confirmed.
c2: Exploit exposed hidden risks in deprecated poolsSupportedThe pattern is clear: abandoned contracts retained executable functionality with real assets still locked inside.
c3: Broader implications for DeFi securitySupportedConfirmed by The Block, Crypto Briefing, and Cryptopolitan.

Key Exploit Incidents

DateAmount LostRoot CauseAffected Pools
December 16, 2022$4.4–5.5MPrivate key compromise (trojan malware)8 constant product pools
June 10, 2026$1.34MLogic flaw in deprecated AMM V35 retired pools (Sollet USDT-RAY, Sollet ETH-RAY, SRM-RAY, USDC-RAY, RAY-SOL)

How Deprecated Pool Risks Contributed

The June 2026 exploit is the clearest case study in deprecated pool risks:

  1. Abandoned but Executable Contracts: The AMM V3 program was deprecated in 2021 during Raydium's migration to newer versions (V4/V5). While pools became inaccessible via the SDK and front-end UI, the underlying Solana programs remained live on-chain with real assets still locked inside.

  2. LP Mint Validation Flaw: The deprecated contract failed to properly verify LP mint addresses. The attacker created a fraudulent LP mint with a supply of just 1 unit, bypassing security checks and withdrawing entire pool balances as if they were a legitimate liquidity provider. [Note: This specific technical detail is not independently confirmed.]

  3. No Automatic Migration or Termination: When Raydium upgraded to newer programs, there was no explicit contract termination or automatic asset recovery for legacy pools. Real funds remained in dormant contracts for years.

  4. Incomplete Deprecation: "Deprecated" status only removed UI/SDK access — not executable functionality. This is a systemic DeFi risk where protocol upgrades leave behind exploitable legacy code.

The December 2022 Exploit: Admin Key Risks

The earlier $4.4–5.5M incident exposed a different but related risk: centralized admin control over legacy pools:

  • A single compromised admin key (HggGrUeg4ReGvpPMLJMFKV69NTXL1r4wQ9Pk9Ljutwyv) controlled the withdrawPNL() function across 8 constant product pools
  • The attacker manipulated SyncNeedTake parameters to inflate fee withdrawal values without actual trading volume
  • ~$2M was bridged to Ethereum and laundered through Tornado Cash
  • RAY token dropped ~8% to $0.16; TVL fell 27% to $34.73M

Key lesson: Deprecated pools retained excessive admin privileges that were never revoked, creating a single point of failure.

Protocol Response & Remediation

ActionDetails
Treasury CompensationRaydium committed to full compensation for June 2026 losses [VERIFIED: Confirmed by The Block, Crypto Briefing, and Cryptopolitan]
AMM V4 Upgrade (Dec 2022)Removed vulnerable admin parameters (SyncK, SyncNeedTake, MinSize, SyncLp, SetLpSupply)
Multi-sig MigrationAll admin control moved to Squads multisig
Security ReviewComprehensive audit of all mainnet programs underway
Virtual Supply AdoptionNewer programs use virtual supply mechanisms with stricter account verification

Broader Implications for DeFi Risk Management

The Raydium incidents reveal several systemic patterns in deprecated pool risks:

  1. Legacy Code Persistence: Smart contracts remain exploitable years after deprecation if not explicitly terminated
  2. Incomplete Upgrades: Protocol migrations that only remove UI access leave hidden attack surfaces
  3. Privilege Accumulation: Old pools often retain admin controls that should be revoked during upgrades
  4. Asset Locked in Abandoned Contracts: Real value can remain in deprecated pools indefinitely

Current Raydium status: ~$797M TVL, ~$5.15M 30-day fee revenue, >$1.1B 7-day DEX volume. Current CLMM and newer AMM pools are unaffected. The $1.34M lost represents less than 0.2% of TVL.

What Remains Unverified

  • The specific LP mint validation flaw mechanism
  • The exact pool names and their Serum protocol association
  • Attacker tracing to KYC'd exchange (KuCoin)
  • The June 2026 date (appears to be a future date relative to current context)

Conclusion

The Raydium exploits definitively exposed hidden risks in deprecated DeFi pools: incomplete deprecation leaves live contracts with real assets that remain exploitable long after UI access is removed. The systemic lesson is that protocol upgrades must include explicit contract termination or asset recovery — not just UI removal. What remains open: the full technical details of the LP mint validation flaw and comprehensive metrics on how many deprecated pools across DeFi remain active with locked assets.

Suggested Next Steps

  1. Deep dive on deprecated pool exposure: Run a scan across major DeFi protocols to identify how many pools remain live with assets but no active UI/SDK access — quantify the total value at risk across the ecosystem.

  2. Monitor Raydium's security review completion: The protocol's comprehensive audit of all mainnet programs is ongoing; schedule a follow-up check to review findings and verify remediation of legacy contract risks.