Ex-Pump.fun Dev Confesses to $2M Solana Exploit—Crypto’s ’Trustless’ Myth Takes Another Hit

Solana's ecosystem reels as a rogue developer cops to a seven-figure smart contract heist—just another day in decentralized finance.

Inside the $2M exploit: How one engineer turned DeFi's 'permissionless' dream into a personal ATM.

While VCs preach 'code is law,' this case proves humans remain the weakest link in crypto's security stack—ironic for an industry obsessed with eliminating middlemen.

Bail Violations Landed Him Back in Custody

Although Dunn initially pleaded guilty in 2023, he later tried to withdraw that plea in court. That effort didn’t work. His legal team stepped away, and the case stalled for months. Things got worse when Dunn moved to Liverpool while still under bail restrictions. Authorities tracked him down and arrested him again, transferring him to HMP Pentonville, where he remains as he awaits sentencing.

FORMER https://t.co/m6lUwKZ35U EMPLOYEE STOLE $2M: PLEADS GUILTY IN COURT!

In May 2024, Jarrett Dunn, a former developer at the Solana-based memecoin platform, carried out a flash loan attack — taking out a loan, manipulating the bonding curve, and draining ~12,300 SOL…

— 21Borov (@21_borv) August 15, 2025

Sentencing Around the Corner, Penalties Could Be Severe

Dunn is expected to be sentenced within two weeks. The charges he faces are serious enough to land him behind bars for seven years or more if classified as a top-tier offense. The broader impact on Pump.fun has been significant. The team estimates it lost as much as $12.8 million in damages, not just from the stolen funds but also from trading downtime, reputation damage, and reduced platform activity.

Mental Health Adds Complexity to the Case

Court documents show Dunn has a long history of mental health challenges, including diagnoses of schizoaffective bipolar disorder, panic disorder, and ADHD. He also struggled with substance use and had been off medication at the time of the theft. When police first arrested him, he was reportedly unfit for questioning. He later spent two weeks under hospital care, which may be considered during sentencing.

Inside Job Exposed Launchpad Risks

Dunn had been at Pump.fun for just six weeks before he used his developer access to quietly extract SOL from bonding curve contracts. After moving the funds, he scattered them across multiple wallets, which made recovery nearly impossible. His actions suggested he may have viewed it as some vigilante stunt, but that didn’t shield him from criminal charges. The breach highlighted the risks crypto startups face when internal controls are loose or rushed.

Despite the Scandal, Pump.fun Hasn’t Slowed Down

Surprisingly, the platform has only grown since the incident. Pump.fun bounced back with a $600 million token launch, rolled out its own PUMP token, and has crossed $770 million in all-time revenue. It now holds a leading spot in Solana’s growing memecoin ecosystem. While the scandal could have derailed the project, it seems to have accelerated its rise in some ways.

Dunn’s case is a reminder of how fast things can spiral in crypto. One person with access and a troubled past managed to shake up a multi-million dollar platform. Now, the court will decide whether mental health, remorse, and cooperation will weigh heavily enough to impact his sentence, or whether the industry uses this as a cautionary tale about what can go wrong when trust is misplaced.

Key Takeaways

• Former Pump.fun developer Jarett Dunn has pleaded guilty to stealing nearly $2 million in SOL and is now awaiting sentencing in London.
• Dunn’s bail violations and failed attempt to withdraw his plea landed him in HMP Pentonville, where he remains in custody.
• The charges could bring a sentence of over seven years, with Pump.fun estimating total damage from the incident at $12.8 million.
• Mental health issues and past substance use may influence sentencing, as Dunn was reportedly unfit for police questioning at the time.
• Despite the scandal, Pump.fun has grown rapidly, crossing $770 million in revenue and launching its own PUMP token.