Yes, pump.fun is a real, working memecoin launchpad on Solana. But legit platform does not mean safe coins. Anyone can launch a token on it in minutes, and research on more than seven million pump.fun tokens linked 98.6% of them to rug pulls or pump-and-dump patterns.

Has pump.fun been hacked?

Yes, once. On May 16, 2024, a former employee used his access to drain about $2 million in SOL from pump.fun's bonding curve contracts. Pump.fun paused trading and upgraded the contracts. In December 2025 a London court sentenced him to six years in prison.

What percentage of pump.fun coins graduate?

Very few, and the number moves a lot. Reported rates were about 0.92% in summer 2025. After the BOOST change, the rate averaged 4.7% over four days in late July 2026 and hit 6.7% on one day. In any period, most tokens never leave the bonding curve.

Can you lose all your money on pump.fun?

Yes. A memecoin can go to zero in minutes if the creator or a group of early wallets sells. Only trade money you can afford to lose, and check each coin before you buy.

Is pump.fun available in the UK?

No. Pump.fun blocked UK users in December 2024, three days after a warning from the UK Financial Conduct Authority. Check the pump.fun terms for the current list of restricted countries.

Is Pump.fun Safe? Platform Risks vs Coin Risks (2026)

"Is pump.fun safe?" has two answers. One is about the platform: can it lose your money? The other is about the coins on it: can the people who launch them take your money? The second risk is much bigger. This page covers both, then gives you a checklist to use before every buy.

Nobody on our team did hands-on testing of pump.fun for this page. Every fact below comes from the linked sources.

Is the pump.fun platform safe?

Security history: the May 2024 exploit

On May 16, 2024, pump.fun paused trading and said its bonding curve contracts were compromised. About $2 million in SOL was taken. Pump.fun said it upgraded the contracts so the attacker could not take more funds (Decrypt, May 2024).

The attacker was Jarett Dunn, a former senior developer at pump.fun. He sent the funds to thousands of random wallets. In December 2025 a London court sentenced him to six years in prison for fraud by abuse of position and transfer of criminal property (Decrypt, December 2025).

We found no other exploit of the pump.fun contracts in the sources we checked.

Legal actions and regional blocks

Lawsuit: In July 2025, Burwick Law and Wolf Popper filed an amended complaint in a US lawsuit against pump.fun. It adds Solana and Jito executives as defendants, and it includes RICO claims based on illegal gambling, wire fraud and unlicensed money transmission (The Block). These are allegations, not court findings.
UK block: The UK Financial Conduct Authority warned about pump.fun in early December 2024. Three days later, pump.fun blocked UK users (Decrypt).

If you live in a restricted country, do not use a VPN to get around the block. It can break the terms of service and put your funds at risk.

Platform verdict

The platform works as designed. It had one serious exploit, which came from an insider, and the contracts were upgraded after it. That is not zero risk, but it is not the main risk for a buyer.

Are pump.fun coins safe?

Mostly, no. The data is clear on this.

Most tokens collapse. Solidus Labs studied more than seven million pump.fun tokens launched up to January 2025. It linked 98.6% of them to rug pulls or pump-and-dump schemes. Only about 97,000 kept more than $1,000 in liquidity (Forklog, May 2025).
Few tokens graduate. A token "graduates" when it fills its bonding curve and moves to PumpSwap, pump.fun's own exchange. The graduation rate was about 0.92% in summer 2025, based on Dune data (Cryptopolitan). After the BOOST launch change, it averaged 4.7% over four days in late July 2026 and hit 6.7% on one day (The Block). Even on that peak day, more than 93 of every 100 tokens did not graduate.

Graduation is not a safety check. A graduated token can still be dumped by its creator or by a group of early wallets.

Common pump.fun scams

Rug pulls. The creator, or wallets linked to the creator, buy early and sell into the first wave of buyers. The price falls to near zero. Read our rug pull guide for how this works.
Bundled supply. The creator uses many wallets to buy in the same block as the launch. The chart looks like real demand, but one person controls a large part of the supply. Signs are several wallets funded from the same source, buys in the same block, and similar buy amounts (Mobula docs).
Snipers set by the creator. Fresh wallets buy in the first few blocks, then sell together. Mobula describes a launch where snipers hold 50% or more of supply as highly likely to see a coordinated dump.
Fake socials. A coin links to an X account or Telegram group made the same day, or it copies the name of a real project or a news story. The coin has no link to the real thing.
Copycat sites. Phishing sites copy the pump.fun design on lookalike domains, ask you to connect your wallet, then drain it. Type the address yourself or use a bookmark. For the trading tools we cover, use our official links page.

How to check a pump.fun coin before you buy

The thresholds in these steps come from Mobula's detection guide. They are rules of thumb, not guarantees. A coin can pass every check and still go to zero.

1
Check the holder distribution
Open the token on a Solana explorer or a charting tool and look at the top 10 holders. Leave out the bonding curve or liquidity pool address. If the top 10 hold more than 50% of supply, that is a red flag. Under 30% is healthier.
2
Find the dev wallet and watch what it does
Find the wallet that created the token. If it holds a large share, or it already sold, be careful. A dev that holds under 5% and does not sell is a better sign.
3
Look for bundles and snipers
Check the first buys after the launch. Many fresh wallets that bought in the same block, with similar amounts and the same funding source, point to a bundled launch. Avoid a coin where snipers together hold more than 20% of supply.
4
Check the liquidity
On the bonding curve, see how far the curve is from full. After graduation, check the pool size. Low liquidity means a small sell can move the price a lot, and you may not be able to exit at the price you see.
5
Check the socials
Open every link on the token page. Check the age of the X account and the Telegram group, and look for real activity. A copied name with a brand-new account is a warning sign.
6
Run a contract check
Paste the token address into a token-safety checker. Confirm that the mint authority and the freeze authority are revoked, so nobody can create new tokens or freeze your wallet.
7
Size the trade for a total loss
Buy only an amount you can lose in full. Decide your exit before you buy.

How to trade more safely

Platform risk and coin risk are not the only risks. How you trade also matters.

Use a separate wallet with only trading money in it. Keep long-term funds in a different wallet.
Use self-custody tools that let you export your private key, so a tool cannot lock you out of your funds.
Turn on MEV protection where your tool has it. It lowers the risk of sandwich attacks on your buys.

BasedBot is a multi-chain trading bot that supports Solana. It is self-custody with private key export, and it has built-in MEV protection on buys (our BasedBot review). Locke works with BasedBot. For other options, see our list of the best memecoin trading platforms.

Try BasedBot (self-custody, MEV protection)

No tool makes a bad coin safe. Do the checklist first.

Changelog

2026-10-11: first version published.