{"investigation":{"slug":"pumpfun","entity_name":"pump.fun","trust_score":8,"severity_base":null,"score_modifier":0,"confidence":1,"status":"published","content_type":"investigation","summary":"pump.fun (operated by Baton Corporation Ltd., also listed on AVOID.NET as 'pumpdotfun') is a Solana-based meme token launchpad that launched in January 2024 and rapidly became one of the most-used token creation platforms in crypto, generating over $800 million in cumulative revenue and more than 11.9 million tokens. The platform is subject to an active RICO class action lawsuit in the SDNY alleging up to $5.5 billion in retail losses, a UK FCA regulatory ban, a $1.9 million insider flash loan exploit, documented use by North Korea's Lazarus Group for money laundering, and independent research classifying 98.6% of its tokens as rug pulls or fraud.","sections":[{"content":"pump.fun is a Solana-based meme token launchpad that allows anyone to create and trade tokens within seconds, requiring no coding knowledge. It launched in January 2024 and is operated by Baton Corporation Ltd., a UK-registered company. Co-founders are Alon Cohen (COO), Dylan Kerler (CTO), and Noah Bernhard Hugo Tweedale (CEO), who met in Oxford, England. The platform uses a bonding curve mechanism: every new token begins on a price curve that adjusts automatically based on buy and sell pressure, providing instant liquidity without a traditional order book. When a token reaches approximately $69,000 in market capitalization, it 'graduates' to broader trading. From March 2025 onward, graduated tokens migrate to PumpSwap, pump.fun's proprietary AMM, which replaced Raydium as the destination for graduated tokens. The platform removed its 0.02 SOL token creation fee in August 2024, further lowering barriers to entry. By early 2025, the platform had generated over $800 million in cumulative revenue and accounted for up to 71% of all daily token launches on Solana. A PUMP governance token was launched via a $1.3 billion ICO in July 2025. The platform and its duplicate AVOID.NET listing 'pumpdotfun' refer to the same entity.","heading":"Platform Overview","sources":[],"severity":"medium"},{"content":"A May 2025 report by crypto surveillance firm Solidus Labs analyzed more than 7 million tokens deployed on pump.fun between January 2024 and March 2025 and classified 98.6% as rug pulls or pump-and-dump schemes. Of all tokens with at least five trades, only approximately 97,000 retained more than $1,000 in liquidity. The largest single rug pull identified was worth $1.9 million and was related to a token called MToken. pump.fun disputed the Solidus Labs findings. The platform's bonding curve model limits some traditional liquidity rug pull vectors, but social manipulation and coordinated pump-and-dump operations remain structurally possible and common. Solidus Labs separately found that approximately 93% of pools on Raydium, the prior graduation destination for pump.fun tokens, exhibited soft rug pull characteristics. Independent blockchain investigators, including ZachXBT, documented a pattern of compromised social media accounts (McDonald's, Usher, Kabosu Owner, Andy Ayrey, Wiz Khalifa, SPX 6900, and others) being used to launch pump.fun meme coins, resulting in an estimated $3.5 million stolen through coordinated rug pulls.","heading":"Rug Pull Facilitation and Fraud Statistics","sources":[],"severity":"medium"},{"content":"On May 16, 2024, pump.fun suffered a $1.9 million exploit perpetrated by Jarett Dunn, a former employee known online as STACCOverflow. Dunn allegedly used his privileged access to a 'withdraw authority' service account to extract liquidity from bonding curves before it could be migrated to Raydium. The attack was executed using flash loans sourced from MarginFi, a Solana lending protocol: Dunn borrowed SOL via flash loan, manipulated pump.fun's contract through the compromised service key to withdraw bonding curve liquidity, repaid the flash loan, and distributed some remaining funds to holders of various Solana tokens. Approximately 12,300 SOL (roughly $1.9 million at the time) was stolen. pump.fun paused trading, upgraded its smart contracts, and stated that no user funds remained at risk. Dunn was arrested by London Metropolitan Police approximately seven hours after the exploit at the Middle Eight Hotel in London's Covent Garden. He was charged with alleged theft from employer of $2 million with conspiracy involving an alleged additional $80 million. He was released on bail with conditions including returning for a Criminal Investigation Department interview on August 16, 2024, and refraining from involvement with pump.fun. Dunn publicly acknowledged his role in the exploit on social media.","heading":"Insider Flash Loan Exploit (May 2024)","sources":[],"severity":"medium"},{"content":"On December 3, 2024, the UK's Financial Conduct Authority (FCA) published an official warning stating that pump.fun is not authorized or registered by the FCA and 'may be providing or promoting financial services or products without our permission.' The FCA's warning explicitly noted that users engaging with the platform have no access to the Financial Ombudsman Service or Financial Services Compensation Scheme protections, making recovery of lost funds unlikely if the firm fails. pump.fun responded by updating its terms of service on December 6, 2024, implementing a geoblock to restrict UK users from accessing the platform. The FCA warning remains publicly listed on the FCA's official website.","heading":"UK Financial Conduct Authority Regulatory Ban","sources":[],"severity":"medium"},{"content":"pump.fun (Baton Corporation Ltd.) faces an active class action lawsuit in the United States District Court for the Southern District of New York (Case No. 1:25-cv-00880, Aguilar v. Baton Corporation Ltd. d/b/a Pump.Fun), which has been expanded via an amended complaint into a RICO racketeering case. The initial complaint was filed on January 30, 2025, by law firms Wolf Popper LLP and Burwick Law, consolidating with a related case (Carnahan). The amended complaint, filed July 22, 2025, expanded defendants to include Solana Labs, the Solana Foundation, and Solana co-founders Anatoly Yakovenko and Raj Gokal, as well as Jito Labs (later voluntarily dismissed September 30, 2025). The amended complaint alleges that pump.fun operated as a 'coordinated racketeering enterprise designed to simulate the functions of a digital casino operated illegally under the guise of meme coin creation and trading.' Core allegations include: that the platform generated $722.85 million in fees between early 2024 and January 2025; that 99.6% of profits were captured by a small group of sophisticated insiders while retail users absorbed losses estimated at $4 billion to $5.5 billion; and that Solana's mempool infrastructure and Jito's MEV tooling were allegedly used to extract retail losses via automated pump-and-dump schemes. If successful under RICO, treble damages could reach approximately $16.5 billion. Plaintiffs' counsel obtained over 5,000 private messages allegedly showing Solana Labs and pump.fun engineers discussing the alleged scheme. On December 11, 2025, Judge Colleen McMahon approved filing of a second amended complaint. The case remains pending.","heading":"RICO Class Action Lawsuit (SDNY)","sources":[],"severity":"medium"},{"content":"In late 2024, pump.fun's integrated livestreaming feature became the subject of widespread public controversy after users broadcast violent, self-harm, and exploitative content to promote meme coin price movements. Documented incidents included: a user threatening suicide if their memecoin failed to reach a target market cap; a user firing a gun from a window as their token's price increased; a child threatening family members over token performance; and users making threats of school violence tied to coin price movements. Decrypt and CoinTelegraph documented these incidents based on community reports and direct observation. pump.fun suspended livestreaming indefinitely in response to community backlash. Five months later, the feature was reintroduced to a limited 5% of users with updated moderation policies prohibiting violence, harassment, sexual exploitation, child endangerment, and illegal activity. Streams containing graphic violence, threats, glorification of violent acts, or content promoting self-harm are now subject to immediate termination under the updated policy.","heading":"Content Moderation Failures and Self-Harm Livestreams","sources":[],"severity":"medium"},{"content":"In February 2025, following the approximately $1.5 billion hack of Bybit cryptocurrency exchange — attributed to North Korea's Lazarus Group — blockchain investigators documented that stolen funds were laundered through pump.fun. The Lazarus Group deployed a meme coin called QinShihuang on the pump.fun platform to launder approximately $26 million from the Bybit theft. The laundering methodology involved bridging stolen Ethereum to Binance Smart Chain, distributing funds across more than 30 wallets, routing them back to Solana through intermediaries, and then using pump.fun token launches to generate over $42 million in artificial trading volume by mixing legitimate trader activity with illicit funds. pump.fun removed the QinShihuang token from its front-end interface after the connection was reported. The use of pump.fun for state-sponsored money laundering by a sanctioned actor (Lazarus Group is designated by the US Treasury OFAC) represents a critical platform-level compliance failure.","heading":"Lazarus Group Money Laundering","sources":[],"severity":"medium"},{"content":"On February 26, 2025, pump.fun's official X account (@pumpdotfun) was compromised by an unidentified threat actor who posted a fraudulent announcement promoting a fake 'PUMP' governance token, including a fabricated Solana contract address. The fraudulent post reached a $5 million market cap before collapsing rapidly; blockchain data showed two wallets controlling over 60% of the fake token's supply. The threat actor subsequently promoted a second fake token called 'GPT-4.5' and threatened to delete the pump.fun account if it reached a $100 million market cap. On-chain investigator ZachXBT publicly connected the pump.fun account breach to prior X account compromises of Jupiter DAO and DogWifCoin, and assessed that the attacker was likely social engineering X employees using fraudulent documentation or exploiting an internal panel.","heading":"Official X Account Hack and Fake Token Promotion","sources":[],"severity":"medium"},{"content":"On March 20, 2025, pump.fun launched PumpSwap, a proprietary automated market maker (AMM) built on Solana, replacing Raydium as the destination for tokens graduating from pump.fun's bonding curves. PumpSwap uses a Uniswap V2-style model with a 0.25% trading fee, allocating 0.20% to liquidity providers and 0.05% to the protocol. The migration from Raydium eliminated the prior 6 SOL migration fee and made token graduation instant. Within days of launch, PumpSwap became the second-largest Solana AMM by volume, capturing approximately 18% market share versus Raydium's 50%. The launch was significant because Raydium had previously derived approximately 41% of its swap fees from pump.fun-graduated tokens. Raydium responded by announcing its own competing launchpad product, LaunchLab.","heading":"PumpSwap AMM Launch","sources":[],"severity":"medium"},{"content":"pump.fun is operated by Baton Corporation Ltd., a UK-registered company with three co-founders: Alon Cohen (COO), Dylan Kerler (CTO), and Noah Bernhard Hugo Tweedale (CEO). All three are named in the SDNY class action complaint. The founders have maintained significant anonymity; co-founder Tweedale cited personal safety as the reason, stating that managing large crypto assets makes them targets for blackmail and physical attack. Alon Cohen's online presence is reportedly minimal, with no verifiable social media history, mentions, or educational records beyond his role in the Baton Corporation filings. The founders are reported to have met in Oxford, England, and have prior experience trading meme coins including Dogecoin. The near-total anonymity of key principals is a structural risk factor given the scale of retail funds processed by the platform.","heading":"Founder Anonymity and Corporate Structure","sources":[],"severity":"medium"}],"timeline":[{"date":"2024-01-19","event":"pump.fun launches on Solana as a meme token launchpad with a bonding curve mechanism.","source":"","source_url":"https://www.21shares.com/en-us/insights/pump-fun-101-the-meme-coin-platform-powering-solana"},{"date":"2024-05-16","event":"Former employee Jarett Dunn (STACCOverflow) exploits pump.fun via MarginFi flash loans, stealing approximately $1.9 million (12,300 SOL) using a privileged service account key.","source":"","source_url":"https://www.theblock.co/post/294959/solana-token-launcher-pump-fun-suffers-flash-loan-exploit"},{"date":"2024-05-17","event":"Jarett Dunn is arrested by London Metropolitan Police at the Middle Eight Hotel, Covent Garden. He is charged with alleged theft from employer and released on bail.","source":"","source_url":"https://blockworks.co/news/pump-dot-fun-exploiter-arrest-london"},{"date":"2024-08","event":"pump.fun removes its 0.02 SOL token creation fee, further lowering barriers to token launches.","source":"","source_url":"https://phemex.com/academy/what-is-pump-fun-solana-meme-coin-launchpad-pump-token","date_original":"2024-08-01"},{"date":"2024-12-03","event":"UK Financial Conduct Authority (FCA) publishes official warning that pump.fun is unauthorized to operate in the UK.","source":"","source_url":"https://www.fca.org.uk/news/warnings/pumpfun"},{"date":"2024-12-06","event":"pump.fun updates its terms of service and implements a geoblock to ban UK users, in response to the FCA warning.","source":"","source_url":"https://cryptoslate.com/pump-fun-updates-terms-to-block-uk-users-days-after-fca-warning/"},{"date":"2025-01-16","event":"Initial class action lawsuit filed in SDNY over pump.fun's alleged securities violations, anchored to the $PNUT token.","source":"","source_url":"https://www.courtlistener.com/docket/69593359/aguilar-v-baton-corporation-ltd-dba-pumpfun/"},{"date":"2025-01-30","event":"Second class action complaint filed in SDNY (Aguilar v. Baton Corporation Ltd.), naming Baton Corporation and co-founders Cohen, Kerler, and Tweedale. Cases later consolidated.","source":"","source_url":"https://www.coindesk.com/policy/2025/01/30/pump-fun-hit-with-proposed-class-action-lawsuit-alleging-securities-violations"},{"date":"2025-02-26","event":"pump.fun's official X account (@pumpdotfun) is hacked; attackers promote a fraudulent 'PUMP' governance token that briefly reaches a $5 million market cap before collapsing. ZachXBT links the breach to prior X account hacks.","source":"","source_url":"https://decrypt.co/307857/pump-fun-x-account-hacked-solana-meme-coin"},{"date":"2025-02-26","event":"Lazarus Group, following the $1.5 billion Bybit hack, deploys a meme coin (QinShihuang) on pump.fun to launder approximately $26 million in stolen funds. pump.fun later removes the token from its front end.","source":"","source_url":"https://www.cryptopolitan.com/lazarus-group-meme-coin-launder-26m-bybit/"},{"date":"2025-03-20","event":"pump.fun launches PumpSwap, a proprietary Solana AMM that replaces Raydium as the graduation destination for bonding curve tokens. PumpSwap rapidly becomes the second-largest Solana AMM by volume.","source":"","source_url":"https://blockworks.com/news/pumpswap-large-amm-solana"},{"date":"2025-05-07","event":"Solidus Labs publishes report classifying 98.6% of pump.fun tokens as rug pulls or pump-and-dump schemes, based on analysis of over 7 million tokens. pump.fun disputes the findings.","source":"","source_url":"https://www.coindesk.com/business/2025/05/07/98-of-tokens-on-pump-fun-have-been-rug-pulls-or-an-act-of-fraud-new-report-says"},{"date":"2025-07-22","event":"Amended RICO complaint filed in SDNY, expanding defendants to include Solana Labs, Solana Foundation, Jito Labs, and senior executives. Estimated retail losses cited as $4–5.5 billion.","source":"","source_url":"https://cryptoslate.com/solana-labs-jito-labs-hit-with-rico-charges-in-amended-pump-fun-fraud-lawsuit/"},{"date":"2025-09-30","event":"Jito Labs, the Jito Foundation, and Jito leadership voluntarily dismissed from the RICO class action.","source":"","source_url":"https://www.wolfpopper.com/news/pumpfun-class-action-lawsuit-expands-with-consolidated-amended-complaint-adding-rico-allegations-and-new-defendants"},{"date":"2025-12-11","event":"Judge Colleen McMahon approves filing of second amended complaint after plaintiffs obtain over 5,000 private messages from Solana Labs and pump.fun engineers.","source":"","source_url":"https://yellow.com/news/judge-approves-expansion-of-solana-pumpfun-lawsuit-after-5000-internal-chats-surface"}],"sources_used":[],"source_tags":["defillama","zachxbt"],"addresses":[{"chain":"solana","label":"Pump (PUMP)","address":"pumpCmXqMfrsAkQ5r49WcJnRayYRqmXz6ae8H7H9Dfn"}],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet","created_at":"2026-05-04T02:54:32.367717+00:00","updated_at":"2026-08-29T01:35:07.665+00:00"}}