Did the Raydium exploit expose hidden risks in
Published 6/11/2026, 12:08:22 AM
Answer
Yes, the Raydium exploits exposed genuine hidden risks in deprecated DeFi pools. The evidence shows two distinct incidents — a December 2022 exploit ($4.4–5.5M) and a June 2026 exploit ($1.34M) — both targeting legacy infrastructure that remained live on-chain despite being officially deprecated. The core risk: "deprecated" status in a UI does not equate to disabled or secure smart contracts.
Claim Resolution
| Claim | Status | Notes |
|---|---|---|
| c1: Raydium exploit involved deprecated/old pools | Partially supported | Multiple sources confirm the June 2026 exploit targeted legacy AMM V3 pools deprecated since 2021. However, the specific technical mechanism (LP mint validation flaw) is not independently confirmed. |
| c2: Exploit exposed hidden risks in deprecated pools | Supported | The pattern is clear: abandoned contracts retained executable functionality with real assets still locked inside. |
| c3: Broader implications for DeFi security | Supported | Confirmed by The Block, Crypto Briefing, and Cryptopolitan. |
Key Exploit Incidents
| Date | Amount Lost | Root Cause | Affected Pools |
|---|---|---|---|
| December 16, 2022 | $4.4–5.5M | Private key compromise (trojan malware) | 8 constant product pools |
| June 10, 2026 | $1.34M | Logic flaw in deprecated AMM V3 | 5 retired pools (Sollet USDT-RAY, Sollet ETH-RAY, SRM-RAY, USDC-RAY, RAY-SOL) |
How Deprecated Pool Risks Contributed
The June 2026 exploit is the clearest case study in deprecated pool risks:
-
Abandoned but Executable Contracts: The AMM V3 program was deprecated in 2021 during Raydium's migration to newer versions (V4/V5). While pools became inaccessible via the SDK and front-end UI, the underlying Solana programs remained live on-chain with real assets still locked inside.
-
LP Mint Validation Flaw: The deprecated contract failed to properly verify LP mint addresses. The attacker created a fraudulent LP mint with a supply of just 1 unit, bypassing security checks and withdrawing entire pool balances as if they were a legitimate liquidity provider. [Note: This specific technical detail is not independently confirmed.]
-
No Automatic Migration or Termination: When Raydium upgraded to newer programs, there was no explicit contract termination or automatic asset recovery for legacy pools. Real funds remained in dormant contracts for years.
-
Incomplete Deprecation: "Deprecated" status only removed UI/SDK access — not executable functionality. This is a systemic DeFi risk where protocol upgrades leave behind exploitable legacy code.
The December 2022 Exploit: Admin Key Risks
The earlier $4.4–5.5M incident exposed a different but related risk: centralized admin control over legacy pools:
- A single compromised admin key (
HggGrUeg4ReGvpPMLJMFKV69NTXL1r4wQ9Pk9Ljutwyv) controlled thewithdrawPNL()function across 8 constant product pools - The attacker manipulated
SyncNeedTakeparameters to inflate fee withdrawal values without actual trading volume - ~$2M was bridged to Ethereum and laundered through Tornado Cash
- RAY token dropped ~8% to $0.16; TVL fell 27% to $34.73M
Key lesson: Deprecated pools retained excessive admin privileges that were never revoked, creating a single point of failure.
Protocol Response & Remediation
| Action | Details |
|---|---|
| Treasury Compensation | Raydium committed to full compensation for June 2026 losses [VERIFIED: Confirmed by The Block, Crypto Briefing, and Cryptopolitan] |
| AMM V4 Upgrade (Dec 2022) | Removed vulnerable admin parameters (SyncK, SyncNeedTake, MinSize, SyncLp, SetLpSupply) |
| Multi-sig Migration | All admin control moved to Squads multisig |
| Security Review | Comprehensive audit of all mainnet programs underway |
| Virtual Supply Adoption | Newer programs use virtual supply mechanisms with stricter account verification |
Broader Implications for DeFi Risk Management
The Raydium incidents reveal several systemic patterns in deprecated pool risks:
- Legacy Code Persistence: Smart contracts remain exploitable years after deprecation if not explicitly terminated
- Incomplete Upgrades: Protocol migrations that only remove UI access leave hidden attack surfaces
- Privilege Accumulation: Old pools often retain admin controls that should be revoked during upgrades
- Asset Locked in Abandoned Contracts: Real value can remain in deprecated pools indefinitely
Current Raydium status: ~$797M TVL, ~$5.15M 30-day fee revenue, >$1.1B 7-day DEX volume. Current CLMM and newer AMM pools are unaffected. The $1.34M lost represents less than 0.2% of TVL.
What Remains Unverified
- The specific LP mint validation flaw mechanism
- The exact pool names and their Serum protocol association
- Attacker tracing to KYC'd exchange (KuCoin)
- The June 2026 date (appears to be a future date relative to current context)
Conclusion
The Raydium exploits definitively exposed hidden risks in deprecated DeFi pools: incomplete deprecation leaves live contracts with real assets that remain exploitable long after UI access is removed. The systemic lesson is that protocol upgrades must include explicit contract termination or asset recovery — not just UI removal. What remains open: the full technical details of the LP mint validation flaw and comprehensive metrics on how many deprecated pools across DeFi remain active with locked assets.
Suggested Next Steps
-
Deep dive on deprecated pool exposure: Run a scan across major DeFi protocols to identify how many pools remain live with assets but no active UI/SDK access — quantify the total value at risk across the ecosystem.
-
Monitor Raydium's security review completion: The protocol's comprehensive audit of all mainnet programs is ongoing; schedule a follow-up check to review findings and verify remediation of legacy contract risks.