Raydium Retired AMM Exploit Drained Five Inactive Pools

Raydium said that a retired automated market maker program was exploited on 2026-06-10, producing a loss event on Solana that affected legacy liquidity infrastructure rather than currently described active pools.^[1] The documented loss was roughly $1.34 million, and the affected set consisted of five inactive Raydium liquidity pools.^[2][3] On the present record, the incident is best understood as a smart-contract failure involving residual exposure in a retired system, although the dossier does not establish the exact bug, privilege path, or state transition that permitted the drain.

The earliest pivotal fact established in the record is Raydium’s statement that the retired AMM program itself was exploited on 2026-06-10.^[1] That framing matters because it places the incident in the category of legacy-contract compromise rather than a front-end issue, governance action, or market-manipulation event. The brief does not indicate that the affected pools were active at the time; instead, it identifies five inactive liquidity pools as the assets impacted by the exploit.^[3] In practical terms, the event appears to have involved code or permissions that remained capable of moving value even after the relevant pools were no longer in ordinary use, but the present record does not establish whether that capability arose from an unrevoked authority, an accounting flaw, or another contract-level defect.

The second pivotal fact is the scale and concentration of the loss. Public reporting cited in the brief stated that roughly $1.34 million was drained, and that this amount came from five inactive Raydium liquidity pools.^[2][3] No transaction hashes, attacker addresses, or pool-by-pool balances are provided in the dossier, so the sequence by which the funds were extracted cannot be reconstructed here at transaction level. It has therefore not been established, as of 2026-06-15, whether the exploit was executed in a single transaction or across multiple calls, whether the pools shared a common administrative dependency, or whether the same flaw could have affected additional dormant contracts that happened not to hold material balances. What is documented is narrower: a retired AMM program was the locus of compromise, five inactive pools were affected, and the resulting loss was roughly $1.34 million.^[1][2][3]

The available chronology also indicates that the protocol’s immediate public response focused on loss coverage rather than technical disclosure. Raydium said impacted users would be compensated, and the treasury said it would cover the losses.^[4][5] That statement established an intended financial remediation path at the protocol level, but it did not by itself establish execution details such as eligibility criteria, timing, claims mechanics, or whether compensation had already been distributed. The distinction is material: a stated intent to compensate is not the same as a completed reimbursement process. As of the present record, the compensation plan has been announced, but the dossier does not document completed payouts, a recovery percentage, or any return of funds from the exploiter address set.^[4][5]

From a mechanism perspective, the incident illustrates a recurrent failure mode in decentralized-finance systems: software or authorities associated with retired components can remain economically live after operational retirement. Here, the protocol statement tied the exploit specifically to a retired AMM program, while the drained assets were located in inactive liquidity pools.^[1][2][3] That combination suggests that deprecation did not fully eliminate extractable value from the affected contract environment. The brief’s pattern labels identify single_point_of_control and absence_of_withdrawal_monitoring as relevant lessons, but the dossier does not provide enough technical detail to determine exactly how those patterns manifested in this case. It has not been established whether a single privileged key, a retained upgrade path, a stale authority, or a contract logic edge case was the operative control weakness. Likewise, the record does not establish whether monitoring failed to detect anomalous withdrawals in real time or whether the event was identified only after funds had already left the pools.

The lack of technical specificity also constrains interpretation of the term “retired.” In protocol operations, retirement can mean that a contract is no longer routed to by the front end, no longer recommended for use, or no longer expected to receive new deposits; it does not necessarily mean that all authorities have been revoked or that all balances have been withdrawn. The documented facts here are consistent with that broader operational distinction: the affected pools were inactive, yet still held enough value for roughly $1.34 million to be drained when the retired AMM program was exploited.^[2][3] Without contract-level disclosures, however, it remains unverified whether the exploit depended on dormant balances being left in place, on a permissions model that remained valid after retirement, or on some other latent condition in the legacy deployment.

The documented consequences were primarily financial and operational. The immediate material impact was the loss of roughly $1.34 million from five inactive liquidity pools tied to the retired AMM program.^[1][2][3] The principal announced resolution measure was that impacted users would be compensated and that treasury resources would cover the losses.^[4][5] The present dossier does not document litigation, regulatory action, law-enforcement involvement, technical patch notes, or any on-chain recovery. It therefore establishes the occurrence of the exploit and the stated compensation commitment, but not a completed legal or technical resolution.