{"investigation":{"slug":"aquifer-amm","entity_name":"Aquifer AMM","trust_score":28,"severity_base":null,"score_modifier":0,"confidence":0.72,"status":"published","content_type":"investigation","summary":"Aquifer is a Solana-based automated market maker that lost approximately $2.47-2.5 million in tokens on August 31, 2026, when an attacker drained 18 of its 45 token vaults in roughly 40 minutes. Reports disagree on the root cause, with some outlets citing a compromised wallet and an on-chain investigation attributing the loss to a program that accepted forged balance data without verifying the source. Aquifer offered the attacker a 20% whitehat bounty for returning funds by September 3, 2026; no public source has confirmed any funds were returned, and the project has not published a technical post-mortem.","sections":[{"content":"On August 31, 2026, an attacker drained roughly $2.47 million to $2.5 million in assets from Aquifer, a Solana automated market maker, according to multiple crypto news outlets and an on-chain investigation by Bitquery. KuCoin's flash report and Capwolf both state the hack occurred on August 31, 2026, and put the loss at approximately $2.5 million. Bitquery's on-chain investigation puts the figure more precisely at $2,469,729 (valued at September 1 prices), spread across 18 of Aquifer's 45 token vaults, with stablecoins (USDC and USDT) making up roughly 70% of the total. The investigation documents 212 successful attacker transactions over about 40 minutes, beginning around 03:41 UTC and ending around 04:21 UTC, with the first profitable trade executed at 04:18 UTC. Tokens drained included USDC ($1.28M), USDT (~$459,000), HYPE (~$184,000), cbBTC (~$136,000), and smaller amounts of CASH, Fartcoin, PUMP, WETH, and TRUMP. Stolen tokens were swapped into SOL via a fill service and Jupiter, then bridged to Ethereum, where Bitquery traced roughly 1,000.8 ETH sitting in a single address with no outgoing transactions as of September 1, 2026. Prior to the hack, DefiLlama reportedly listed Aquifer's total value locked at around $2.8 million; Capwolf reported that after the attack, aggregate vault holdings fell to approximately $70.","heading":"The August 31, 2026 Exploit","sources":[{"url":"https://bitquery.io/investigations/aquifer-solana-hack-2-5-million","name":"Bitquery on-chain investigation of the Aquifer hack","type":"research","credibility":2},{"url":"https://www.kucoin.com/news/flash/solana-amm-aquifer-hacked-losing-around-2-5m","name":"KuCoin: Solana AMM Aquifer Hacked, Losing Approximately $2.5M","type":"news_article","credibility":2},{"url":"https://capwolf.com/solana-aquifer-exploit-2-5m-loss-and-whitehat-bounty/","name":"Capwolf: Solana Aquifer Exploit: $2.5M Loss And Whitehat Bounty","type":"news_article","credibility":3},{"url":"https://en.coinotag.com/aquifer-exploit-drains-2-5m-solana-sol-ecosystem-amm","name":"Coinotag: Aquifer Exploit Drains $2.5M From Solana (SOL) Ecosystem AMM","type":"news_article","credibility":3}],"severity":"critical"},{"content":"Reporting on the cause of the exploit is inconsistent and, as of the sources reviewed, unconfirmed by Aquifer itself. Several outlets, including a crypto.news report sourced to the analytics firm Defimon, describe the incident as stemming from a compromised wallet, stating that the point of compromise is unclear, that wallet access is the main focus of scrutiny, and that there is no evidence Aquifer's smart contracts themselves were exploited. Other coverage frames the cause as an unconfirmed choice between a leaked private key and misuse of administrative privileges. By contrast, Bitquery's on-chain investigation attributes the loss to a program-logic flaw rather than a stolen key: it alleges the Aquifer program read a token balance without verifying the account's owner and accepted a caller-supplied token program, which let the attacker substitute a fake program of his own. According to this account, the attacker deployed an immutable fake token program at 03:35:56 UTC that accepted transfer-shaped instructions and always returned success, then created forged 165-byte \"token accounts\" with a fabricated balance of 18,446,744,073,709,551,615 units (described as over 2,000 times the actual circulating supply of USDC), and used them to make Aquifer release real tokens from its vaults while believing it had been paid. Bitquery also notes the program had not been upgraded since August 11, 2026, and the vulnerable code remained live and exploitable after the attack. Because no independent, confirmed technical post-mortem from Aquifer has been located, this discrepancy between a wallet-compromise narrative and an input-validation/logic-flaw narrative remains unresolved, and both explanations should be treated as alleged rather than established.","heading":"Root Cause: Disputed Explanations","sources":[{"url":"https://bitquery.io/investigations/aquifer-solana-hack-2-5-million","name":"Bitquery on-chain investigation of the Aquifer hack","type":"research","credibility":2},{"url":"https://crypto.news/solana-amm-aquifer-hit-by-2-5-million-exploit-offers-20-bounty/","name":"crypto.news: Solana AMM Aquifer hit by $2.5 million exploit, offers 20% bounty","type":"news_article","credibility":2},{"url":"https://phemex.com/news/article/solana-amm-aquifer-suffers-25-million-exploit-after-wallet-compromise-95161","name":"Phemex: Solana AMM Aquifer suffers $2.5 million exploit after wallet compromise","type":"news_article","credibility":3}],"severity":"critical"},{"content":"Aquifer responded to the exploit with an on-chain whitehat offer rather than a public statement through conventional channels. According to Bitquery and Capwolf, Aquifer's Solana upgrade authority posted an on-chain message (reported by Bitquery as sent at 16:43:27 UTC on August 31, 2026) addressed to the attacker's identified Solana and Ethereum wallets. The offer proposed that the attacker return at least 80% of the stolen assets, or their equivalent value, to designated recovery addresses by September 3, 2026, at 14:00 UTC, in exchange for keeping the remaining 20% (reported as worth up to roughly $500,000) as a bounty. Capwolf reports that Aquifer stated it would not pursue civil claims arising from the exploit if the terms were met, subject to applicable law, and that the agreement explicitly would not bind law enforcement, regulators, or sanctions authorities. As of the most recent reporting identified in this investigation, no source confirms that the attacker accepted the offer or that any funds were returned. Bitquery's investigation, published after the deadline, states that the designated Solana return address held only 0.98 SOL with no activity since February, and that all of Aquifer's vaults combined held only about $70 as of September 1, 2026, indicating the stolen funds had not been returned to the protocol.","heading":"Bounty Offer and Recovery Attempt","sources":[{"url":"https://bitquery.io/investigations/aquifer-solana-hack-2-5-million","name":"Bitquery on-chain investigation of the Aquifer hack","type":"research","credibility":2},{"url":"https://capwolf.com/solana-aquifer-exploit-2-5m-loss-and-whitehat-bounty/","name":"Capwolf: Solana Aquifer Exploit: $2.5M Loss And Whitehat Bounty","type":"news_article","credibility":3},{"url":"https://crypto.news/solana-amm-aquifer-hit-by-2-5-million-exploit-offers-20-bounty/","name":"crypto.news: Solana AMM Aquifer hit by $2.5 million exploit, offers 20% bounty","type":"news_article","credibility":2}],"severity":"high"},{"content":"The Aquifer exploit occurred during what PeckShield data, as reported by Coinpaper and cited in Yahoo Finance coverage, characterized as the worst month of 2026 by number of major crypto hacks. PeckShield recorded 50 major incidents in August 2026, the highest monthly count of the year, though total losses of approximately $136.3 million were down about 49.5% from July's roughly $270 million, with the average loss per incident falling to about $2.7 million from roughly $9 million in July. The ten largest August incidents accounted for about $123.3 million of the month's total, led by a roughly $74 million exploit of the Cronos lending protocol Tectonic, whose chain state was later reportedly restored by validators. Other large August incidents cited include Moonwell (about $8.7 million) and Coinsbuy (about $7.9 million). Coinpaper's ranking of August's top incidents includes a listing for \"Aquifer\" as the tenth-largest incident of the month, though the article provides no further detail on the Aquifer figure beyond the ranking itself. This context indicates Aquifer's loss, while serious for the protocol itself, was roughly in line with the average-sized incident in an unusually high-frequency month for DeFi exploits generally.","heading":"Industry Context: August 2026 DeFi Security Environment","sources":[{"url":"https://coinpaper.com/35120/crypto-hacks-hit-2026-record-with-50-attacks-as-losses-fall-49-to-136m","name":"Coinpaper: Crypto Hacks Hit 2026 Record With 50 Attacks As Losses Fall 49% To $136M","type":"news_article","credibility":2},{"url":"https://finance.yahoo.com/markets/crypto/articles/august-broke-2026s-monthly-hack-074417261.html","name":"Yahoo Finance: August Broke 2026's Monthly Hack Record","type":"news_article","credibility":2}],"severity":"medium"},{"content":"Aquifer's public disclosure following the exploit has been limited. Reporting reviewed for this investigation found no evidence of a formal, team-authored technical post-mortem explaining how the attacker gained the access or exploited the mechanism used. crypto.news, citing Defimon, reports that Aquifer has not said how any wallet may have been compromised, including whether private keys or administrative credentials were exposed, or whether a single compromised account controlled multiple wallets. The team's only documented communication identified in this investigation is the on-chain whitehat bounty message sent through its Solana upgrade authority, rather than a blog post, audit disclosure, or social media statement from an official account. Bitquery's independent on-chain research further notes that, as of its publication, Aquifer's program had not been upgraded since August 11, 2026, meaning the code implicated in its proposed exploitation mechanism remained deployed and unpatched after the incident. The combination of an unresolved, publicly disputed root cause, no confirmed fund recovery, and the absence of a detailed public post-mortem represents a significant transparency gap for users evaluating the protocol's current risk.","heading":"Transparency and Disclosure Assessment","sources":[{"url":"https://crypto.news/solana-amm-aquifer-hit-by-2-5-million-exploit-offers-20-bounty/","name":"crypto.news: Solana AMM Aquifer hit by $2.5 million exploit, offers 20% bounty","type":"news_article","credibility":2},{"url":"https://bitquery.io/investigations/aquifer-solana-hack-2-5-million","name":"Bitquery on-chain investigation of the Aquifer hack","type":"research","credibility":2}],"severity":"medium"}],"timeline":[{"date":"2026-08-31","event":"Attacker drains approximately $2.47-2.5 million from 18 of Aquifer's 45 token vaults in 212 transactions over roughly 40 minutes.","source":"KuCoin / Bitquery","source_url":"https://bitquery.io/investigations/aquifer-solana-hack-2-5-million","date_evidence":"A Solana-based AMM, Aquifer, was hacked on August 31, 2026, with approximately $2.5 million in assets stolen."},{"date":"2026-08","event":"Aquifer's Solana upgrade authority posts an on-chain whitehat bounty offer addressed to the attacker's identified wallets.","source":"Capwolf / Bitquery","source_url":"https://capwolf.com/solana-aquifer-exploit-2-5m-loss-and-whitehat-bounty/","date_evidence":"an incident that security monitors flagged on August 31","date_original":"2026-08-31"},{"date":"2026-09","event":"Crypto news outlets, including crypto.news (citing Defimon) and Bitquery, publish initial and on-chain analysis of the exploit; Bitquery traces roughly 1,000.8 ETH held in a single address linked to the attacker.","source":"crypto.news / Bitquery","source_url":"https://bitquery.io/investigations/aquifer-solana-hack-2-5-million","date_original":"2026-09-01"},{"date":"2026-09","event":"Deadline for Aquifer's whitehat bounty offer passes; no public source confirms the attacker returned funds.","source":"Capwolf / Bitquery","source_url":"https://capwolf.com/solana-aquifer-exploit-2-5m-loss-and-whitehat-bounty/","date_evidence":"Return at least 80% of the assets, or the equivalent value, to designated recovery addresses by September 3 at 14:00 UTC.","date_original":"2026-09-03"}],"sources_used":[{"url":"https://bitquery.io/investigations/aquifer-solana-hack-2-5-million","name":"Bitquery on-chain investigation of the Aquifer hack","type":"research","credibility":2},{"url":"https://www.kucoin.com/news/flash/solana-amm-aquifer-hacked-losing-around-2-5m","name":"KuCoin: Solana AMM Aquifer Hacked, Losing Approximately $2.5M","type":"news_article","credibility":2},{"url":"https://capwolf.com/solana-aquifer-exploit-2-5m-loss-and-whitehat-bounty/","name":"Capwolf: Solana Aquifer Exploit: $2.5M Loss And Whitehat Bounty","type":"news_article","credibility":3},{"url":"https://en.coinotag.com/aquifer-exploit-drains-2-5m-solana-sol-ecosystem-amm","name":"Coinotag: Aquifer Exploit Drains $2.5M From Solana (SOL) Ecosystem AMM","type":"news_article","credibility":3},{"url":"https://crypto.news/solana-amm-aquifer-hit-by-2-5-million-exploit-offers-20-bounty/","name":"crypto.news: Solana AMM Aquifer hit by $2.5 million exploit, offers 20% bounty","type":"news_article","credibility":2},{"url":"https://phemex.com/news/article/solana-amm-aquifer-suffers-25-million-exploit-after-wallet-compromise-95161","name":"Phemex: Solana AMM Aquifer suffers $2.5 million exploit after wallet compromise","type":"news_article","credibility":3},{"url":"https://coinpaper.com/35120/crypto-hacks-hit-2026-record-with-50-attacks-as-losses-fall-49-to-136m","name":"Coinpaper: Crypto Hacks Hit 2026 Record With 50 Attacks As Losses Fall 49% To $136M","type":"news_article","credibility":2},{"url":"https://finance.yahoo.com/markets/crypto/articles/august-broke-2026s-monthly-hack-074417261.html","name":"Yahoo Finance: August Broke 2026's Monthly Hack Record","type":"news_article","credibility":2}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-code-investigator","created_at":"2026-09-16T23:26:15.557237+00:00","updated_at":"2026-10-27T00:16:48.247+00:00"},"source_quality":{"total":8,"tier1":0,"tier2":0,"tier3":0,"unrated":8},"follower_count":null,"content_updated_at":"2026-10-27T00:16:48.641Z","last_fact_checked_at":null,"fact_check_next_allowed_at":null,"update_next_allowed_at":"2026-11-03T00:16:52.868Z"}