.jpg)
Solana-based automated market maker Aquifer has lost roughly $2.5 million in an exploit involving wallets on Solana and Ethereum, with the protocol offering the attacker a 20% bounty for returning most of the funds.
Blockchain security monitoring service Defimon reported the attack on Aug. 31, identifying separate Solana and Ethereum addresses controlled by the suspected exploiter. Aquifer later sent an on-chain whitehat offer seeking the return of at least 80% of the assets linked to the incident.
Whitehat Offer Gives Attacker Until Sept. 3
The offer gives the attacker until Sept. 3 at 14:00 UTC to transfer the assets, or their equivalent value, to recovery addresses provided by Aquifer. The person controlling the wallets may retain up to 20% of the funds as a whitehat bounty if the conditions are met. Aquifer said it would not pursue civil claims arising from the exploit if the attacker complies with the terms, subject to applicable law. The agreement would not bind law enforcement agencies, regulators, sanctions authorities or other government bodies.
Aquifer operates as a proprietary automated market maker on Solana, where its liquidity is used to facilitate token swaps. DefiLlama describes the protocol as a prop AMM and currently lists its total value locked at around $2.8 million. The addresses identified after the exploit show activity spanning Solana and Ethereum, with the Solana address 7fTe9pvrwXJRBHq9MaSyVPR4PgEuhqLiA93Dxf4gRk7J and Ethereum address 0x2Dfe9e969796e2797278b02761dd9Ad6aE922746 linked to the attacker.
Point of Compromise Remains Unclear
Public information has not yet established exactly how the wallets were compromised. No technical post-mortem has been released explaining whether private keys, administrator credentials or another part of Aquifer's operational infrastructure was exposed. Available information similarly does not establish that Aquifer's smart contract code was exploited. The use of addresses across Ethereum and Solana provides a trail for investigators tracking the assets, but does not by itself identify how access to the affected funds was obtained.
The incident follows several Solana-related attacks this year where the point of compromise was outside the underlying blockchain. In June, five legacy liquidity pools belonging to Raydium lost roughly $1.3 million after an attacker targeted retired AMM infrastructure. On-chain investigator Specter said the Raydium attacker used a fake mint address to bypass validation checks in an older AMM program. A separate July incident involving Across Protocol produced losses of less than $4 million after an attacker fabricated Solana deposit events.
Wallet Access Has Become a Major Attack Route
Stablecoin payments company Triple-A confirmed in July that unauthorized access to its treasury wallets resulted in the theft of company-owned digital assets. On-chain researchers tracked suspicious withdrawals across Ethereum, Solana, TRON and TON, with estimated losses at roughly $11.8 million. Triple-A said client funds remained unaffected because customer assets were segregated from the compromised treasury infrastructure.
Private key and wallet compromises have accounted for a substantial portion of crypto thefts in 2026. CertiK reported in July that digital asset losses reached $1.32 billion during the first half of the year, down 46.8% from the same period in 2025. Despite the lower total, the security firm said wallet compromises became the largest attack method during the second quarter, replacing phishing as the main source of losses. Another Solana project, Step Finance, shut down after an attack targeted devices used by members of its executive team, with losses near $40 million. Investigators determined that Step Finance's smart contracts were not the point of entry. Read more about August crypto hack losses and network security responses.
