
pump.fun|Feb 26, 2025 18:12
we've regained access to this account. Based on current information, the extent of the compromise was limited to this X account.
TL:DR: the security protocols taken by the team to secure the X account were thorough, relied on industry best-practices, and focused on minimizing the risk of such an event occurring. the attack that led to this compromise is unknown, but it's unlikely that the team is at fault.
here are the facts:
- we were notified of the account compromise at ~15:20 UTC (February 26th 2025)
- no messages were sent to the email that is connected to the X account regarding any email/password/delegation/two-factor authentication (2fa) changes. usually when critical account information is changed, confirmation messages are sent to the account holder's email
- the email account connected to the X account was secured with 2fa (google 2fa app, unsynced with any email addresses)
- email logs confirm that no external actors ever had access to the email that is connected to the X account
- no delegations were made by the X account
- no phone numbers were connected to the X account
- the X account wasn't connected to any third-party apps
- 2fa was turned on for the X account. In particular, a physical security key and google 2fa (unsynced with any email addresses)
- the password to the X account has been changed regularly, and is managed by a secure password manager which can only be accessed with another password
- 2fa backups were physically written down and stored in a secure location. The people safeguarding this location confirmed that no one had access
- all passwords were complex, with sufficient length and using numbers, letters, and symbols
- at the time of the account compromise, only one person had access to the X account. this person did not click, interact, or engage with any suspicious links that could have led to this compromise
- onchain evidence compiled by @zachxbt suggests that the perpetrator of this attack was behind several other, similar attacks, like Jupiter and WIF. From his Telegram channel: "Notably for these attacks it is likely not the fault of either the Pump Fun or Jupiter teams. I suspect a threat actor is social engineering employees at X with fraudulent documents / emails or a panel is being exploited."
we will continue to monitor the situation and analyze any scenarios that could have taken place and report if there are any updates.
a big thank you to @zachxbt and the @X team for the rapid responses and support!
final reminder: @pumpdotfun or anyone affiliated with the brand (e.g. @a1lon9) would NEVER post a CA, a wallet address, or anything of that sort. Make sure to double check any information that you see with various sources before making any decisions.
stay safe out there!
Share To
Timeline
HotFlash
APP
X
Telegram
CopyLink