Odaily News Wintermute research director Lgor Lamberdiev posted on the X platform that pump.fun was attacked due to suspected private key leakage, and the attacker stole a total of 2,000 SOL and a large number of meme coins. Lamberdiev also said that the service account address 5PXxuZ signed txs in a certain way, transferring funds to the attacker and random addresses instead of deploying the Raydium pool. This move can prove that it is very likely that pump.fun was leaked and caused the attack.