Pump.fun itself is legitimate and reasonably safe as a platform: it is a registered company, its fees are published, and its one contract exploit (May 2024, by a former employee) was made good for users within a day. What is not safe is most of what trades on it: the large majority of Pump.fun coins go to zero, many are bundled or dumped by insiders, and fake Pump.fun sites drain wallets.
Risk notice: Crypto trading is high risk and memecoins can go to zero in minutes. Trading bots and wallet connections use hot wallets. This page is not financial advice; only trade what you can afford to lose.
Facts on this page were checked October 23, 2026, from Pump.fun's own docs and the sources linked below. This is a research-based review built from published docs, not a hands-on trial. For fees and our verdict, see the full Pump.fun review.
What we checked
| Check | What we found |
|---|---|
| Operator | Baton Corporation Ltd., registered in the UK (Decrypt) |
| Custody | Web: your own wallet. App: wallet created on Privy at sign-up (Decrypt) |
| Platform incidents | May 2024 insider exploit, about $1.9M, reversed; February 2025 X account hijack |
| Coin risk | 98.6% of tokens classed as rugs or pump-and-dumps by Solidus Labs (disputed) |
| Legal | RICO claims proceeding against Baton and its co-founders in New York (August 31, 2026 ruling) |
| Regulators | UK users blocked since December 2024 after an FCA warning |
| Phishing | Many documented fake Pump.fun sites and "claim" pages |
Who runs Pump.fun and how custody works
Pump.fun is operated by Baton Corporation Ltd. Its co-founders, named in court filings, are Noah Tweedale, Alon Cohen and Dylan Kerler (Protos). It is the biggest launchpad on Solana, with $63.86 million in 30-day fees on DefiLlama on October 23, 2026 (DefiLlama).
Custody depends on how you use it:
- Website: you connect your own Solana wallet, such as Phantom. Pump.fun never holds your keys; you approve each transaction.
- Mobile app: signing up with email or Google creates a Solana wallet for you on Privy's wallet infrastructure (Decrypt). That makes your email or Google account part of your wallet security, so turn on two-factor authentication there.
Either way it is a hot wallet. Keep only trading money in it.
The hacks and incidents
May 2024 insider exploit. A former employee used privileged withdrawal access and a flash loan to push tokens to the end of their bonding curves, then pulled about $1.9 million (about 12,300 SOL) of curve liquidity, affecting 1,882 wallets. Pump.fun halted trading, redeployed its contracts, seeded the affected pools with equal or greater SOL within 24 hours and waived fees for a week (Helius). The ex-employee, Jarett Dunn, was sentenced in London to six years in prison in December 2025 (Decrypt).
February 2025 X account hijack. On February 26, 2025, attackers took over Pump.fun's X account and promoted a fake governance token and scam memecoins (The Block). Anyone who bought from those posts lost money, even though the platform itself wasn't breached.
Livestream moderation. Pump.fun halted livestreaming in November 2024 after harmful streams and restored it for all users on April 11, 2025 with new content rules (ForkLog). Streams are still a common way to hype coins, so treat a livestream as marketing, not research.
We found no theft of user funds from Pump.fun's contracts after May 2024, as of October 23, 2026.
Rugs and scams on the platform
Free coin creation means anyone can launch, including scammers.
- Most coins fail. Solidus Labs found only about 97,000 of more than 7 million Pump.fun tokens kept $1,000 in liquidity and classed 98.6% as rug pulls or pump-and-dumps. Pump.fun rejected the label (CoinDesk).
- Soft rugs, not hard rugs. Graduated pools burn their LP tokens, so liquidity can't be pulled, but a dev or insider holding a big share of supply can still dump on buyers.
- Bundles. GMGN cites research across 41,470 Pump.fun launches finding coordinated wallets held 36.5% of supply on average (GMGN).
- Snipers. Bots buy in the first seconds; late buyers are often their exit.
Our how to spot a rug pull on Solana guide walks through holder concentration, dev wallets and bundles, and how to use RugCheck shows how to run a coin through a checker in under a minute.
Fake Pump.fun sites and "claim" pages
Phishing is the most likely way to lose everything at once. PCrisk documented fake Pump.fun sites in March 2026 advertising a "PUMP sale event," on domains such as pump-cashbacks[.]fun, pumpfunairdrops[.]fun and pump-sale[.]live; connecting a wallet signs a drainer contract. PhishDestroy lists more look-alikes, including fake "claim" pages.
Per Pump.fun's fee page, accrued cashback is claimed inside the real app and Holder Rewards are paid automatically from a vault, and the PUMP sale ended in July 2025. Any site offering a PUMP sale, airdrop, cashback claim or "fee refund" is a scam. Never connect a wallet to it.
Legal cases and regulators
- RICO case. In Aguilar v. Baton Corporation, filed in January 2025, Judge Colleen McMahon ruled on August 31, 2026: the unregistered-securities claims failed, Solana Labs and the Solana Foundation were dismissed, but RICO claims by two plaintiffs alleging wire fraud, illegal gambling and unlicensed money transmission proceed against Baton and its three co-founders (Protos). No trial or finding has happened.
- UK. Pump.fun blocked UK users on December 6, 2024, three days after the FCA warned it may be offering financial services without permission (Decrypt). A lawsuit doesn't put your wallet funds at risk directly, since Pump.fun doesn't hold them on the web. It is a business risk: features, fees or access could change if the case goes badly.
How to use Pump.fun safely
- Type pump.fun yourself and bookmark it. Don't follow links from ads, DMs or replies.
- Use a separate trading wallet with only what you'd accept losing.
- Never connect to "sale," "airdrop," "cashback" or "refund" sites. Real rewards live in the official app.
- Check every coin before buying: holders, dev wallet, bundles and creator history, using RugCheck.
- Read what you sign. A plain message to "verify" or accept "terms" from a site you didn't expect is a red flag.
- Know the fees. Trades in the Pump.fun app now include a 0.45% platform fee on top of the 1.25% curve fee (Pump.fun fees); see Pump.fun fees explained.
- Using a bot? Read are Solana trading bots safe? and pick from our safest Solana trading bot list.
- Withdraw profits often to a wallet you never connect to trading sites.
Our verdict
Our editorial view: Pump.fun is safe enough to use with a small, separate wallet, and it is more transparent than most launchpads. It is not a safe place to put money you can't lose, because the typical coin on it goes to zero and the platform's operator faces live fraud allegations. If you want a cheaper or different model, compare Bonk.fun, Bags and the others in Pump.fun alternatives. New to the platform? Start with what is Pump.fun.