Raydium AMM V3 — Fake LP Token Exploit (Treasury Compensation)

Timeline: On June 10, 2026, an attacker exploited a logic flaw in Raydium's legacy AMM V3 program — a deprecated pool system that had been inactive since 2021 but whose deposited liquidity remained on-chain. The vulnerability stemmed from insufficient validation of the LP mint address: the program did not verify that the LP token used for withdrawal was the legitimate one, allowing the attacker to mint a custom token with supply=1 and use it to claim 100% of pool reserves in a single withdrawal call. The attacker funded their wallet from KuCoin at 11:28 UTC, drained all five vulnerable pools by 12:09 UTC, and completed Tornado Cash laundering by 13:41 UTC — under two hours from start to finish. Assets drained included ~150K RAY, ~5,600 SOL, and ~893K USDC across pools: Sollet USDT-RAY, Sollet ETH-RAY, SRM-RAY, USDC-RAY, and RAY-SOL. The exploited program was not accessible through the Raydium UI or SDK. No key compromise occurred — the bug was a self-contained logic flaw in the deprecated code. Raydium's current mainnet programs were not affected. Raydium treasury committed to full compensation of all affected LPs.