Raydium exploit analysis

Raydium's long-deprecated AMM V3 program on Solana was drained of about $1.34 million in late May 2026 after an attacker produced fake LP tokens that the old contract accepted as legitimate. The exploit was confirmed by Raydium core contributor Infra, and The Defiant reported that the protocol would compensate affected users from the treasury.

What the contract accepted

The AMM V3 program had been phased out in 2021, but funds remained in the liquidity pools that the contract still controlled. The attacker deployed contracts that produced LP-token receipts the old AMM V3 treated as valid, allowing them to call the contract's withdrawal function and pull pool assets out. The validation gap in the legacy program is what made this possible: the program did not check the source of the LP tokens it was given, so any contract that returned a well-formed receipt could trigger a payout. PeckShield traced the laundering through KuCoin, a Solana-to-Ethereum bridge, Tornado Cash and FixedFloat.

Why current users were unaffected

The current Raydium AMM is a separate program that does not share the legacy validation logic. The drain touched only the pools governed by the deprecated V3 code. Infra's statement confirmed that no current user positions were at risk and that the treasury would cover the full loss.

Where it sits in the corpus

Raydium is the fourth project in 2026 to lose funds to a deprecated contract whose code could not be retired. Aztec Connect was hit twice in three days using a similar attack surface, and DxSale's locker drained $7.3 million the same month. The shared pattern is that "deprecated" in DeFi usually means "immutable, with whatever flaws it had on day one." The protocol can move on; the contract cannot.