Pond.fun hacked by insider; Chainalysis and Elliptic tapped to block funds’ withdrawal

Pond.fun, the meme coin launchpad hosted on Linea, has been hacked by the project’s chief software engineer.

According to Pond.fun’s official disclosure on X, Pond.fun has been hacked this morning, with the initial on-chain and off-chain evidence pointing to a software engineer on Pond.fun’s team. The platform told users to avoid interacting with pond.fun in any capacity, including the efrogs and croak websites, but assured that Discord and Telegrams are still secure.

1️⃣ https://t.co/nEexigW8vL has been hacked this morning. Do not interact with https://t.co/Lrt9ct9mtG in any capacity. It appears the exploiter is a software developer on the https://t.co/Lrt9ct9mtG team. Because of this, the efrogs and croak website are also at risk, pending…

— pond.fun (@ponddotfun) March 5, 2025

The attacker stole liquidity from Pond.fun’s smart contract and transferred the tokens to the privacy protocol Railgun, a privacy protocol that allows users to shield their transactions on the blockchain. The platform published a list of mainnet addresses that received and deposited the stolen assets. The total amount transferred was 64.8 Ethereum (ETH).

You might also like: Infini founder reaffirms 20% bounty and legal immunity to Infini hacker for return of stolen funds

Pond.fun has tapped Chainalysis and Elliptic, blockchain analytics firms that track illicit crypto transactions, to help prevent the stolen funds from passing proof of innocence—since some centralized exchanges and other “serious” offramps require users to provide POI under Railgun. Failure to pas POI checks will ensure that the hacker cannot withdraw the funds from Railgun.

The situation echoes the recent hack of stablecoin bank Infini because it was also done by an insider. Specifically, the developer who helped set up the smart contract retained admin rights and then used these rights to drain the funds through Tornado Cash (TORN). Infini is still working to recover the stolen assets. The hack drained almost $50 million from Infini’s wallet and was identified as the second biggest loss in Feb. by Certik.

You might also like: Crypto losses reached $1.53B in february, led by Bybit, Infini and zkLend exploits: Certik

Source