{"investigation":{"slug":"aquifer-solana-amm","entity_name":"Aquifer (Solana AMM)","trust_score":22,"severity_base":null,"score_modifier":0,"confidence":0.55,"status":"published","content_type":"investigation","summary":"Aquifer, a proprietary automated market maker operating on Solana, lost approximately $2.5 million on August 31, 2026 to an exploit that drained wallets on both Solana and Ethereum. Aquifer's team believes the incident stemmed from compromised wallet access rather than a smart-contract vulnerability, and offered the attacker a 20% white-hat bounty in exchange for returning at least 80% of the funds by September 3, 2026. As of the most recent reporting, no return of funds has been publicly confirmed, no technical postmortem establishing the root cause has been released, and it is unclear whether law enforcement has become formally involved.","sections":[{"content":"On August 31, 2026, blockchain security monitor Defimon flagged attacker-controlled wallets draining approximately $2.5 million from Aquifer, a proprietary automated market maker (AMM) operating on Solana. The theft involved coordinated activity across two chains: a Solana attacker address (7fTe9pvrwXJRBHq9MaSyVPR4PgEuhqLiA93Dxf4gRk7J) and an Ethereum attacker address (0x2Dfe9e969796e2797278b02761dd9Ad6aE922746). Reported loss figures for the incident have varied slightly across outlets, ranging from approximately $2.47 million to $2.5 million.","heading":"The Exploit","sources":[{"url":"https://crypto.news/solana-amm-aquifer-hit-by-2-5-million-exploit-offers-20-bounty/","name":"Solana AMM Aquifer hit by $2.5 million exploit, offers 20% bounty (crypto.news)","type":"news_article","credibility":2},{"url":"https://shattered.io/aquifer-solana-exploit-white-hat-bounty-2026/","name":"Aquifer Exploit Drains $2.5M as August Hacks Hit 50 [2026]","type":"news_article","credibility":3},{"url":"https://coindesk.cc/solana-amm-aquifer-hit-by-2-5-million-exploit-offers-20-bounty-108352.html","name":"Solana AMM Aquifer hit by $2.5 million exploit, offers 20% bounty (CoinDesk mirror)","type":"news_article","credibility":2}],"severity":"high"},{"content":"As of the most recent reporting, no technical postmortem has been published establishing how the affected wallets were compromised. According to crypto.news, \"available information has not established that Aquifer's smart contracts were exploited,\" leaving compromised wallet access — for example a leaked or stolen private key or upgrade authority credential — as the primary working theory rather than a confirmed finding. Aquifer itself has stated it believes the incident stemmed from compromised wallet access rather than a contract bug, but this characterization has not been independently verified through a disclosed audit or forensic report. This should be treated as an alleged, unconfirmed root cause.","heading":"Unresolved Root Cause","sources":[{"url":"https://crypto.news/solana-amm-aquifer-hit-by-2-5-million-exploit-offers-20-bounty/","name":"Solana AMM Aquifer hit by $2.5 million exploit, offers 20% bounty (crypto.news)","type":"news_article","credibility":2}],"severity":"high"},{"content":"Aquifer's Solana upgrade authority published and cryptographically signed an on-chain message addressed directly to the attacker's wallets, offering to let the attacker retain up to 20% of the stolen funds as a bounty in exchange for returning at least 80% of the assets to designated recovery addresses (a Solana address, 8af8RnAgyKzNt4fjDaP8w8pBekYVux1ja4AofavRyjox, and an Ethereum address, 0xb7EAA8cd5dFAD8021d9fB19c8a21613679f268F5) by September 3, 2026, 14:00 UTC. Per shattered.io, the on-chain message stated: \"Return at least 80% of the assets or equivalent value associated with the exploit to the designated recovery addresses no later than: 3 September 2026, 14:00 UTC.\" Aquifer said it would not pursue civil claims against the attacker if the terms were met, but explicitly stated the agreement would not bind \"law enforcement agencies, regulators, sanctions authorities or other government bodies\" — meaning the offer did not include a commitment to withhold law-enforcement cooperation, contrary to some early characterizations of the deal.","heading":"White-Hat Bounty Offer and Its Limits","sources":[{"url":"https://crypto.news/solana-amm-aquifer-hit-by-2-5-million-exploit-offers-20-bounty/","name":"Solana AMM Aquifer hit by $2.5 million exploit, offers 20% bounty (crypto.news)","type":"news_article","credibility":2},{"url":"https://shattered.io/aquifer-solana-exploit-white-hat-bounty-2026/","name":"Aquifer Exploit Drains $2.5M as August Hacks Hit 50 [2026]","type":"news_article","credibility":3}],"severity":"medium"},{"content":"The September 3, 2026 bounty deadline has passed. As of the most recent available reporting (early-to-mid September 2026), no public source — including the original reporting outlets or Aquifer's own communications discoverable via web search — has confirmed that the attacker returned any portion of the stolen funds, accepted the bounty terms, or otherwise responded publicly. No announcement of a successful recovery, a revised deadline, or a formal law-enforcement referral (e.g., FBI, IC3, or a national equivalent) could be found. This leaves the disposition of the approximately $2.5 million, and the fate of any affected user or protocol funds, unresolved as of this writing. Given the ordinary pattern in similar DeFi exploits where white-hat deadlines lapse without publicized reporting on the outcome, this absence of confirmation should be read as inconclusive rather than as proof the funds were or were not recovered.","heading":"Deadline Passed Without Confirmed Resolution","sources":[{"url":"https://crypto.news/solana-amm-aquifer-hit-by-2-5-million-exploit-offers-20-bounty/","name":"Solana AMM Aquifer hit by $2.5 million exploit, offers 20% bounty (crypto.news)","type":"news_article","credibility":2},{"url":"https://shattered.io/aquifer-solana-exploit-white-hat-bounty-2026/","name":"Aquifer Exploit Drains $2.5M as August Hacks Hit 50 [2026]","type":"news_article","credibility":3}],"severity":"high"},{"content":"The Aquifer incident occurred during a reported spike in DeFi exploits during August 2026. According to shattered.io, August 2026 saw 50 major hacking incidents, a 67% increase from July's reported 30, though aggregate losses for the month were reported at approximately $136.3 million — a decrease from July's roughly $270 million — with the largest single incident (TectonicFi, ~$74 million) accounting for more than half of the monthly total. Other secondary sources cited a higher aggregate figure (~$159.5 million) for the same period; this discrepancy could not be resolved from available sourcing and the loss totals for the broader August 2026 hack wave should be treated as approximate and low-to-medium confidence, independent of the Aquifer-specific $2.5 million figure which is corroborated by multiple outlets.","heading":"Context: August 2026 DeFi Hack Wave","sources":[{"url":"https://shattered.io/aquifer-solana-exploit-white-hat-bounty-2026/","name":"Aquifer Exploit Drains $2.5M as August Hacks Hit 50 [2026]","type":"news_article","credibility":3}],"severity":"low"}],"timeline":[{"date":"2026-08","event":"Attacker-controlled wallets drain approximately $2.5 million from Aquifer across Solana and Ethereum addresses; first flagged by blockchain monitor Defimon.","source":"crypto.news","source_url":"https://crypto.news/solana-amm-aquifer-hit-by-2-5-million-exploit-offers-20-bounty/","date_evidence":"Blockchain security monitoring service Defimon reported the attack on Aug. 31.","date_original":"2026-08-31"},{"date":"2026-09","event":"Aquifer's Solana upgrade authority publishes a cryptographically signed on-chain message offering the attacker a 20% white-hat bounty in exchange for returning at least 80% of stolen funds, setting a September 3, 2026, 14:00 UTC deadline; the offer explicitly excludes binding law enforcement, regulators, or sanctions authorities.","source":"crypto.news","source_url":"https://crypto.news/solana-amm-aquifer-hit-by-2-5-million-exploit-offers-20-bounty/"},{"date":"2026-09-03","event":"Bounty deadline (14:00 UTC) passes with no public confirmation that the attacker returned any funds or accepted the offer.","source":"shattered.io","source_url":"https://shattered.io/aquifer-solana-exploit-white-hat-bounty-2026/","date_evidence":"Return at least 80% of the assets or equivalent value associated with the exploit to the designated recovery addresses no later than: 3 September 2026, 14:00 UTC."},{"date":"2026-09","event":"As of the most recent available reporting, no technical postmortem disclosing the root cause of the compromise has been published, and no law-enforcement involvement has been publicly confirmed.","source":"crypto.news","source_url":"https://crypto.news/solana-amm-aquifer-hit-by-2-5-million-exploit-offers-20-bounty/"}],"sources_used":[{"url":"https://crypto.news/solana-amm-aquifer-hit-by-2-5-million-exploit-offers-20-bounty/","name":"Solana AMM Aquifer hit by $2.5 million exploit, offers 20% bounty (crypto.news)","type":"news_article","credibility":2},{"url":"https://coindesk.cc/solana-amm-aquifer-hit-by-2-5-million-exploit-offers-20-bounty-108352.html","name":"Solana AMM Aquifer hit by $2.5 million exploit, offers 20% bounty (CoinDesk mirror)","type":"news_article","credibility":2},{"url":"https://shattered.io/aquifer-solana-exploit-white-hat-bounty-2026/","name":"Aquifer Exploit Drains $2.5M as August Hacks Hit 50 [2026]","type":"news_article","credibility":3},{"url":"https://en.coinotag.com/aquifer-exploit-drains-2-5m-solana-sol-ecosystem-amm","name":"Aquifer Exploit Drains $2.5M From Solana (SOL) Ecosystem AMM (COINOTAG)","type":"news_article","credibility":2},{"url":"https://bitcoinethereumnews.com/tech/solana-amm-aquifer-hit-by-2-5-million-exploit-offers-20-bounty/","name":"Solana AMM Aquifer hit by $2.5 million exploit, offers 20% bounty (mirror)","type":"news_article","credibility":2}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-code-investigator","created_at":"2026-09-09T01:33:23.278667+00:00","updated_at":"2026-09-09T01:34:45.074+00:00"}}