OAK — OnChain Attack Knowledge

Worked example · 2024-20

Pump.fun bonding-curve memecoin rug-pull cohort — Solana — 2024-2025

Loss
aggregate cohort loss is structurally diffuse but at the platform-level scale. Solidus Labs' 2025 Rug Pull Report documented that 98.6% of Pump.fun-deployed tokens collapsed into pump-and-dump or rug-pull outcomes, across approximately 7M tokens deployed since Pump.fun's January 2024 launch through early 2025. Only ~97,000 tokens (~1.4%) maintained ≥$1,000 in liquidity. On the downstream Raydium DEX, Solidus Labs further documented that 93% of Raydium liquidity pools (~361,000 pools, dominated by Pump.fun-graduated tokens) exhibited soft rug-pull characteristics. The largest single rug pull identified by Solidus Labs over the period was approximately $1.9M (MToken). Aggregate cohort retail loss is reported in subsequent litigation (the Pump.fun / Solana / Jito / Jito Foundation RICO class-action filed 2025-02 and amended 2025-07-22) at $4-5.5B in extracted retail value across the Pump.fun "Pump Enterprise." Pump.fun's daily revenue at platform scale exceeded $1M / day and reached $2.16M / day at peak, indicating the platform-side fee-extraction layer is itself the load-bearing economics of the cohort.
OAK Techniques observed
OAK-T3.001 (Sybil-Bundled Launch) — the canonical T3.001 cohort-anchor at v0.1: pump.fun's bonding-curve mechanic plus open-source bundler tooling (Jito-bundled atomic launch + buy of up to ~16-25 deployer-funded wallets in the same slot as initialize_pool) produces the funder-graph-cluster pattern T3.001 enumerates as its detection surface. The "Rug Republic" twelve-cluster cohort identified by Solidus Labs orchestrated ~82% of cohort liquidity drains across ~20% of cohort token creations — funder-graph cluster recurrence at scale. OAK-T2.004 (Initial-Liquidity Backdoor) — the bonding-curve launchpad model embeds creation-time LP-control retention via the deployer-controlled pre-graduation curve; LP supply on the pre-Raydium-migration leg is structurally retained by the deployer cluster rather than constrained by an LP-token-burn flow. OAK-T5.001 / T5.002 (LP drains) chain after bonding-curve graduation. Proposed v0.x candidates: T5.x sub-class for bonding-curve-launchpad-as-extraction-substrate (the launchpad's bonding-curve mechanic structurally produces the rug-pull cohort outcome at scale; the platform-side fee model is downstream-aligned with high-volume launch flow regardless of per-token outcome). See TAXONOMY-GAPS.md. The case also chains with OAK-T6 (defense evasion via the launchpad's no-KYC / no-allowlist deployment surface) and with the broader Solana ecosystem's MEV-extraction substrate (Jito Labs, per the SDNY RICO complaint).
Attribution
inferred-strong at platform-cohort level. Solidus Labs published the cohort-aggregate analysis with documented methodology and substantiated statistics. The SDNY RICO class-action (Aguilar et al. v. Pump.fun et al., February 2025; amended 2025-07-22) names Pump.fun, Solana Labs, Solana Foundation, Jito Labs, and Jito Foundation as defendants in an alleged $4-5.5B "Pump Enterprise." A whistleblower-supplied 5,000-message internal-chat corpus was disclosed in the December 2025 amended complaint (Judge Colleen McMahon, SDNY). Multiple independent on-chain investigative outlets (CryptoBriefing, The Defiant, CryptoPotato, BIM, ChainCatcher) have published cohort analyses corroborating the platform-cohort framing. No US criminal proceedings public at v0.1 cutoff; civil RICO proceedings ongoing. The "Rug Republic" twelve-cluster cohort identified by Solidus Labs is operator-cluster-fingerprinted but no individual operator identifications public at v0.1 cutoff.
OAK-Gnn
unattributed at v0.1; the "Rug Republic" twelve-cluster cohort is a candidate seed for a future OAK-G entry covering bonding-curve-launchpad operator-cluster patterns. The Pump.fun platform-operator cohort (executives named in SDNY litigation) is a separate candidate seed; the platform-operator cohort is structurally distinct from the per-launch operator clusters.
Key teaching point
Pump.fun is OAK's canonical 2024-2025 worked example of bonding-curve-launchpad-as-extraction-substrate at platform scale. The case is structurally distinct from per-token celebrity-endorsement examples in three important ways: the platform-fee model is downstream-aligned with cohort throughput regardless of per-token outcome; the operator-cluster reuse is documented at cohort scale (Rug Republic) rather than at per-named-operator scale (Hayden Davis / Kelsier); and the MEV-extraction layer (Jito Labs per SDNY RICO complaint) is part of the cohort substrate.

Summary

Pump.fun, launched January 2024, is a Solana-based memecoin launchpad that lets any user deploy a token via a bonding-curve mechanism with no KYC, no allowlist, and minimal pre-deployment friction. By early 2025, the platform had reached ~5,300 token launches per day on average through 2024 with the average climbing further in early 2025. Solidus Labs' 2025 Rug Pull Report (published May 2025) documented that 98.6% of Pump.fun-deployed tokens collapsed into pump-and-dump or rug-pull outcomes; only ~97,000 of ~7M tokens maintained ≥$1,000 in liquidity. On Raydium (the downstream Solana DEX where Pump.fun-graduated tokens migrate after bonding-curve completion), 93% of liquidity pools exhibited soft rug-pull characteristics.

Solidus Labs further identified a "Rug Republic" cohort of twelve wallet clusters that orchestrated approximately 82% of liquidity drains across approximately 20% of token creations on Pump.fun, extracting an estimated $4.2M in attributable exit-scam profits at the cohort level. The platform-level economics — Pump.fun's daily revenue exceeded $1M / day and reached $2.16M / day at peak — indicate the platform-side fee-extraction layer is downstream-aligned with high-volume launch flow regardless of per-token outcome.

A class-action lawsuit (Aguilar, Carnahan, Okafor v. Pump.fun et al.) was filed in February 2025 in SDNY alleging that Pump.fun operated an illegal exchange for unregistered securities. A consolidated amended complaint filed 2025-07-22 named Pump.fun, Solana Labs, Solana Foundation, Jito Labs, and Jito Foundation as defendants in an alleged $4-5.5B "Pump Enterprise" under RICO framing. In December 2025, Judge Colleen McMahon granted plaintiffs permission to amend the complaint with whistleblower-supplied internal-chat corpus (~5,000 messages) documenting alleged technical and business coordination among Pump.fun, Solana Labs, and Jito Labs. The RICO framing characterises the platform stack as Pump.fun (front-end casino) + Solana (infrastructure) + Jito Labs (MEV-extraction optimisation), with retail traders as the structural counter-party.

ZachXBT also publicly identified the Pump.fun-operator-X-account compromise pattern (February 2025) where the Pump.fun X account was hijacked to issue fake memecoin announcements, demonstrating a related-but-distinct attack-surface within the Pump.fun ecosystem.

Why this is structurally novel

The Pump.fun cohort is OAK's canonical worked example of bonding-curve-launchpad-as-extraction-substrate at platform scale. Three structural features distinguish this cohort from the per-token celebrity-endorsement examples (LIBRA, HAWK, etc.):

  1. The platform-level fee model is downstream-aligned with cohort outcome. Pump.fun's daily revenue at $1-2.16M / day across the 2024-2025 launch cycle is structurally insensitive to per-token outcomes; the platform extracts fees from issuance and transaction volume regardless of whether individual tokens succeed or rug. The platform-level economics therefore align with maximising launch-flow throughput, which structurally produces a high cohort-rate of rug-pull outcomes. This is a different structural class from the per-token celebrity-endorsement extraction — the platform is not a passive substrate but a fee-aligned participant in the cohort flow. The OAK Technique class needs to name platform-fee-aligned-rug-cohort as a discrete sub-pattern.

  2. Operator-cluster reuse is documented at cohort scale. Solidus Labs' "Rug Republic" twelve-cluster cohort orchestrating 82% of liquidity drains across 20% of creations is the cohort-scale fingerprint of operator-cluster reuse. This is structurally adjacent to the Hayden Davis / Kelsier cluster (LIBRA, MELANIA, M3M3, WOLF, etc.) but at higher magnitude — the Davis cluster is named-operator across 15+ launches; the Rug Republic is unnamed-cluster across thousands of launches. The cohort-fingerprint methodology (wallet-cluster analysis + LP-drain pattern correlation) is the same; the magnitude difference is structurally informative for the defender — bonding-curve launchpads compress the operator-cluster fingerprint into a more easily-identifiable wallet-cluster topology than off-launchpad token launches.

  3. The MEV-extraction layer is part of the cohort substrate. The SDNY RICO complaint's framing (Pump.fun front-end + Solana infrastructure + Jito Labs MEV-extraction optimisation) is the cohort's first publicly-litigated articulation of the MEV-extraction-as-substrate sub-pattern within bonding-curve launches. Jito Labs' MEV-extraction tooling is not exclusively used in the Pump.fun cohort, but the cohort's high-volume bonding-curve flow + the MEV-extraction overlay produces a structurally-aligned extraction substrate that operates upstream of any individual operator-cluster's launch decision. This is a different structural surface from per-token operator-cluster extraction; the OAK Technique class needs to record the MEV-extraction layer as a separate sub-pattern.

Timeline (UTC)

When Event OAK ref
2024-01 Pump.fun platform launches on Solana with bonding-curve mechanic, no KYC, no allowlist (platform genesis)
2024 (through year) ~5,300 token launches per day on average; cohort-rate of rug-pull / pump-and-dump outcomes accumulates T1 / T5.x candidate (cohort substrate)
2024-late → 2025-early Cohort-rate accelerates; platform daily revenue exceeds $1M / day; peaks at $2.16M / day (platform-fee-extraction surface)
2025-02 Aguilar et al. v. Pump.fun et al. class-action filed in SDNY alleging illegal exchange for unregistered securities (US civil litigation — initial)
2025-02-27 ZachXBT publishes thread on Pump.fun X-account compromise issuing fake memecoin announcements (related-attack-surface within ecosystem)
2025-05 Solidus Labs 2025 Rug Pull Report published: 98.6% of Pump.fun tokens are pump-and-dump / rug-pull; "Rug Republic" twelve-cluster cohort orchestrates 82% of drains across 20% of creations; ~$4.2M attributable exit-scam profits (cohort forensic surface)
2025-07-22 Consolidated amended complaint filed in SDNY naming Pump.fun, Solana Labs, Solana Foundation, Jito Labs, Jito Foundation as defendants in alleged $4-5.5B "Pump Enterprise" under RICO framing (US civil litigation — RICO)
2025-12-09 Judge Colleen McMahon (SDNY) grants plaintiffs permission to amend complaint with whistleblower-supplied ~5,000-message internal-chat corpus (litigation-discovery surface)
Continuing RICO civil proceedings ongoing; no US criminal proceedings public at v0.1 cutoff; cohort-rate of new launches has declined sharply from 2025 peak as Pump.fun activity tapered (attribution state)

What defenders observed

  • Pre-event: the bonding-curve launchpad mechanic was publicly documented at Pump.fun launch; the no-KYC / no-allowlist deployment surface was publicly visible. The pre-event detection signal was at the platform-policy level (platform did not operate per-launch allowlist, audit gating, or sniper-protection mechanism); no major launchpad operator at v0.1 operates such a regime. The pre-event signal for individual token launches was the cluster-fingerprint of the deployer wallet — the Rug Republic-class operator-cluster signature is detectable at deploy-time via wallet-funding-source analysis but is not surfaced through the platform's own UI.
  • At-event: the Solidus Labs methodology (cohort-aggregate analysis at scale) is the load-bearing detection surface. The methodology — clustering of LP-drain patterns across cohort + wallet-cluster correlation across cohort + per-launchpad / per-DEX cohort framing — is the v0.x detection primitive that should generalise to other bonding-curve launchpads (Meteora, OverHere, etc.). For individual launches, the at-event detection signal is the seconds-window-acquisition pattern (% of supply acquired within K seconds of deploy by clusterable-upstream wallets); this is the same signal that recurs in HAWK, LIBRA, MELANIA, and the broader cohort.
  • Post-event: the public-record forensic surface combined Solidus Labs' cohort-aggregate analysis, the SDNY litigation discovery process (including the December 2025 whistleblower-supplied internal-chat corpus), CryptoBriefing / The Defiant / CryptoPotato / BIM cohort coverage, and the broader DL News / Decrypt / CoinDesk reporting. The litigation-discovery surface is structurally significant — the whistleblower-supplied internal-chat corpus is the cohort's first publicly-litigated articulation of alleged platform-operator coordination with MEV-extraction infrastructure.

What this example tells contributors writing future Technique pages

  • Bonding-curve-launchpad-as-substrate is a discrete v0.x Technique class. Future T5.x examples should record the launchpad-platform-level economics (daily revenue, fee-extraction model, platform-retained-stake vs. pure-fee-flow) as part of the structural-defect characterisation. Pump.fun's daily $1-2M revenue is the cleanest example; Meteora, OverHere, and other launchpads have analogous fee structures that should be enumerated where the cohort cases recur.
  • Operator-cluster-fingerprint methodology generalises across cohorts. The Solidus Labs "Rug Republic" methodology (cohort-aggregate wallet-cluster analysis + LP-drain pattern correlation) is the v0.x detection primitive for cohort-scale rug-pull pattern. Future cohort-aggregate writeups (Meteora, OverHere, etc.) should apply the same methodology and report the same metric set: % of creations / % of drains / wallet-cluster count / aggregate cohort loss.
  • The MEV-extraction layer is part of the cohort substrate. The SDNY RICO complaint's framing of Jito Labs MEV-extraction as part of the "Pump Enterprise" is the cohort's first publicly-litigated articulation. Future cohort cases should record the MEV-extraction substrate (Jito Labs on Solana; Flashbots / MEV-Boost on Ethereum; equivalent on other chains) as a separate sub-pattern within the broader cohort writeup.
  • Litigation-discovery is part of the post-event public-record forensic surface. The whistleblower-supplied internal-chat corpus is the cohort's strongest evidence for alleged platform-operator coordination. Future cohort cases that progress to litigation discovery should integrate the discovered evidence into the OAK record where the legal proceedings permit; the litigation-discovery surface is materially stronger than the on-chain artefact alone for platform-operator-cohort attribution.

Public references

Discussion

Pump.fun is OAK's canonical 2024-2025 worked example of bonding-curve-launchpad-as-extraction-substrate at platform scale. The case is structurally distinct from per-token celebrity-endorsement examples in three important ways: the platform-fee model is downstream-aligned with cohort throughput regardless of per-token outcome; the operator-cluster reuse is documented at cohort scale (Rug Republic) rather than at per-named-operator scale (Hayden Davis / Kelsier); and the MEV-extraction layer (Jito Labs per SDNY RICO complaint) is part of the cohort substrate.

The cohort's distinguishing analytical value is the cohort-aggregate methodology demonstrated by Solidus Labs. The methodology generalises across other bonding-curve launchpads — Meteora (M3M3, MELANIA, LIBRA), OverHere (HAWK), and others operating analogous fee structures. The methodology should be recorded as an OAK detection primitive at the v0.x revision; it is the cleanest cohort-scale detection surface for the broader memecoin-launch problem.

For OAK's broader cohort coverage, Pump.fun + the per-token celebrity-endorsement examples (LIBRA, HAWK, MELANIA / TRUMP) collectively establish the spectrum of structural patterns within the 2024-2026 memecoin cohort. Pump.fun is the platform-scale anchor; the per-token examples are the high-attention extreme cases. The v0.x sub-Technique proposals in TAXONOMY-GAPS.md need to cover both ends — the platform-scale cohort and the high-attention per-token cases — because the Mitigation surfaces are different (platform-policy regime for the cohort; pre-launch contractual disclosure regime for the per-token cases).

The SDNY RICO litigation against Pump.fun, Solana Labs, Solana Foundation, Jito Labs, and Jito Foundation is the cohort's first publicly-litigated articulation of platform-operator-substrate-as-organised-extraction-enterprise. The litigation outcome will materially affect the structural-attribution language available to future OAK examples covering bonding-curve-launchpad cohorts. At v0.1 cutoff, the litigation is ongoing and no judgment is public.

Techniques demonstrated (4)