Aquifer hack: $2.5 million drained from a Solana DEX in 40 minutes

01 — The tradeA swap that only went one way

At 04:18 UTC on 31 August a request reached a program on Solana called Aquifer. Send me HYPE, it said, and I will pay for it in dollars. Aquifer sent 102 HYPE, worth about $8,600. Then it went to collect the dollars, and nothing came back.

The transaction succeeded anyway. Nothing in it failed, nothing reverted, and the fee came to about a cent. It was one of 212 trades of the same shape that morning, and the run had been going for more than half an hour by then.

Aquifer is a place to trade one token for another. When you use an app like Jupiter to swap, the app breaks your order up and sends the pieces to whichever venues quote the best price, and Aquifer is one of those venues. Every one of those fills is a public record, which is what the DEX trade API reads. To fill an order instantly it holds a stock of every token it deals in, sitting in accounts it controls. That stock is what the trade above was paid out of, and it is what ran out 40 minutes later.

What happened to Aquifer is the oldest mistake on Solana. It read a balance without checking who had written it. Bitquery indexes every transaction on Solana and on Ethereum, so we pulled the attacker's entire history, all 379 transactions of it, and rebuilt the theft from the chain rather than from anybody's account of it. The record shows what left the vaults, how the fake balance worked, where the money went once it left Solana, and what the venue looked like the morning after. One limit belongs at the top rather than the bottom. Aquifer has never published its source code, so what follows describes what the program did, from a complete record of it doing so, rather than the line of code that was missing.

02 — The premiseWhat a balance is on Solana

On most blockchains a token keeps one big list of who owns how much, and the token's own contract is the only thing that can change it. Solana turns that inside out. Your holding of a token lives in a small account of its own, exactly 165 bytes, and that account belongs to the SPL Token Program, the shared system that creates and moves every ordinary token on the chain.

Two rules keep this safe, and both of them are checks that the program taking your money has to make.

The first is about who owns the file. Only the program that owns an account can write to it, so if an account belongs to the token program, the numbers inside it are real. Anyone can create an account of the same size, fill it with whatever they like and hand it over. Reading it without asking who owns it is reading a stranger's handwriting.

The second is about who gets called. To take payment, a program asks the token program to move the money. On Solana the caller supplies the list of accounts a program will use, and that list includes which program to call. A venue that lets the trader nominate the token program has handed the trader the till.

Anyone can write 165 bytes that look exactly like a balance. What makes a balance real is who owns the file it sits in.

03 — The forgeryThe file that said 18 trillion

Five minutes before the first trade, the attacker put his own program on Solana and immediately gave up the right to change it, which on Solana makes it permanent. The program is tiny. It accepts an instruction shaped exactly like a token transfer, does nothing at all, and reports success.

Then he built the balances. Using that program he created 45 accounts of exactly the right size, each one filled in to look like a token account, and 11 of them were put to work. Below is the one Aquifer read most often.

Aquifer read that file in three quarters of the trades, and the other ten forged balances carried the same impossible number. There are about 7.8 billion USDC on the whole of Solana. Each file claimed a balance of roughly 18 trillion, which is the largest figure the field will take and more than two thousand times the supply.

With the balance written, the trade is a single instruction. The attacker asks for a swap, names his own program as the token program for the incoming side, and points at the forged file as the account to take the money from. Aquifer checks that the buyer can afford it, reads 18 trillion dollars, and is satisfied.

Two details make the difference between a clever trade and a free one. Aquifer pays the outgoing leg before it collects the incoming one, and once the attacker's program has reported success it never looks at the balance again to see whether anything arrived. The attacker's program burned 858 units of compute doing nothing, which is roughly the cost of returning the word yes.

Every one of the 212 successful trades has the same shape: a genuine token transfer out of a vault, followed by a single call into the fake program. Across all of them the attacker paid in nothing at all, in any token. What each vault lost matches what he received to the last decimal place.

04 — The inventory18 tokens, 40 minutes

The first drain call landed at 03:41 UTC and the last at 04:21. In between, 18 of Aquifer's token stores were emptied, and every one of them was left holding dust.

Seven tenths of the loss was in dollar stablecoins, which is why the total barely moves with the market. The rest was a spread of the tokens a Solana venue would be expected to carry, from wrapped bitcoin to a coin named after a fart.

The vaults were being refilled the whole time. Aquifer is fed by routers, so ordinary swaps kept arriving from real traders while the attacker worked, and 5,801 of them touched the USDC store alone during the same 40 minutes. For 12 of the 18 tokens he took out more than the vault held when he first reached it. He was drawing on the stock and on the day's trade at once.

05 — The exitSold, bridged, and gone in under an hour

Selling came next, and it started before the draining had finished. The stolen tokens went out through a fill service that quotes a price and settles it against a handful of market makers, with a few dozen ordinary Jupiter swaps for the leftovers. Everything became SOL. The wallet's ledger closes cleanly: 24,082 SOL came in across 54 fills, and 24,084 went out in 3 transfers.

2 of the 3 left Solana through Rango, a service that swaps a token on one chain for a token on another. The third went out through a different cross-chain program. Every one of them has a matching arrival on Ethereum, within a minute.

The first of those transfers went out at 04:15, 6 minutes before the last vault was emptied. He was moving the money off the chain while he was still taking it.

The wallets that paid the ether are shared infrastructure rather than his own. Each had dealt with hundreds or thousands of different counterparties in the previous week, which is what a bridge's settlement wallet looks like. Whole hours of the attack are visible in the Ethereum record for that reason: the money crossed in the open.

06 — The moneyWhere the funds are now

They are on Ethereum, in one address, and they have not moved.

The balance is the sum of the 3 arrivals to the last unit, and the wallet's transaction count is zero, so not even a fee has left it. There has been no mixer, no chain of hops, no attempt to break the trail. At the price of ether on 1 September that is about $2.47 million, which is within half a percent of what came out of the vaults and within one percent of what the SOL sold for. Three separate measurements of the same theft, taken on two chains, agree.

Sitting still is a choice, and on a public ledger it is a visible one. Every exchange compliance desk can see the address, and so can anyone reading this.

07 — The offerA message written into a block

At 16:43 UTC on the same day, Aquifer answered on-chain. Using the multi-signature wallet that controls the program, and signing with the key that has the power to upgrade it, the team attached a note to a transaction addressed to the attacker.

The note names his Solana wallet and his Ethereum address, which means the team had followed the money across the bridge within the day. It gives two addresses to return the funds to, one on each chain, and a contact address. It asks for at least 80% back by 14:00 UTC on 3 September and offers the rest as a bounty, with an undertaking not to bring civil claims if the deadline is met.

The Solana address it names for the return has held the same 0.98 SOL since February and has seen no activity at all. Nothing has come back.

08 — AfterThe venue did not survive the morning

The clearest measure of the damage is not the money. It is the traffic.

Order flow fell by about 99.9% in the hour after the attack and has stayed there ever since, running at a few dozen transactions an hour for a full day. The venue is still switched on and still processing the odd swap. Almost nobody is sending it any.

Two facts sit oddly beside each other. The program has not been upgraded since 11 August, three weeks before the attack, so the code that was drained is the code that is running. And all 45 of Aquifer's vaults together now hold about $70, so there is nothing left in them to take. The attacker's program is permanent and still deployed. The trade that emptied the place would work again the moment anyone refills it.

09 — The limitsWhat we checked, and what we cannot say

The set of attack transactions is complete. Every transaction that ever touched the attacker's fake program sits inside his own wallet history, all 379 transactions of which we read, and no other wallet ever called that program.

We looked for a second attacker and did not find one. Of the thousands of ordinary transactions that hit the USDC vault during the same window we sampled 45 and read each one, and all of them used the real token program on both legs of the swap. That is a sample rather than a census, so a smaller second operator using a different fake program is not ruled out, though the vault arithmetic leaves no shortfall for one to hide in.

The USDC store lost more than the attacker took, and that gap is not a second theft. USDC was the currency the venue quoted in, so ordinary trades were drawing it down throughout, while 12 other vaults were being topped up past the level they started at.

Prices are 1 September spot rather than the prices on the morning of the attack. The two quantities that carry the argument, the SOL that was sold and the ether that arrived, are exact and owe nothing to a price feed.

3 of the attacker's transactions failed on-chain and are excluded throughout.

Anyone who wants to check a number here can pull the same records. The transactions are public, and the Solana API and the MCP server reach the same archive we used. We have taken the same route through other incidents, including the $120 million drain on Cronos and the wallets behind Ethereum address poisoning, and the same routing layer that fed Aquifer shows up in our work on on-chain arbitrage. Teams that do this work under a mandate use our crypto investigation services.