Pump.fun exploiter arrested: ‘Team alleges I stole $2m in ill-gotten gains’

The alleged mastermind behind the Solana memecoin protocol pump.fun exploit has been apprehended in London. 

According to Blockworks, citing sources familiar with the operation, British authorities arrested Jarett Dunn, a former contractor known online as @STACCoverflow, in the early hours of May 18.

The arrest is said to have come following a meticulous 26-hour intelligence operation initiated by a third-party stakeholder who had hired a private intelligence firm. The operation leveraged social media posts and other publicly available information to track Dunn’s whereabouts in London.

Local operatives, or “auxiliaries,” were reportedly deployed in a massive search that eventually led them to the Middle Eight Hotel in Covent Garden. Dunn was found in a room at the hotel and taken into custody seven hours later. 

Interestingly, the timing of his arrest coincided with his last social media post on X, where he hinted at his identity with the username @STACCoverflow, a play on the French phrase “j’arrête” (meaning “I’m done”) and his real name, Jarett.

After his arrest, Dunn was released on bail, according to his own post on X and confirmation from the intelligence firm.

He is expected to remain in the UK until his court appearance, reportedly scheduled for August.

The pump.fun platform, which simplifies token launches on the Solana (SOL) network, was exploited on May 16, resulting in a loss of over 12,300 SOL valued at approximately $2 million at the time. 

The attacker used flash loans from Raydium, a Solana lending protocol, to carry out the exploit. Flash loans are decentralized finance (defi) tools that allow users to borrow large amounts of capital.

In this case, the attacker manipulated the pump.fun bonding curves, a mechanism that sets token prices based on supply.

By reaching 100% on these curves, the hacker accessed and withdrew liquidity meant for Raydium, then repaid the flash loan, making off with substantial profits.

Following the incident, pump.fun started working with law enforcement to investigate the breach.