(a) Problem the project solves

Launching a token on Solana previously required contract deployment, upfront capital to seed a liquidity pool, and trust that the creator would not withdraw that liquidity after launch. Pump.fun removes all three requirements. Any user creates a coin through a browser form at zero SOL creation cost, and every coin begins life on a bonding curve that custodies its own liquidity inside the program, so no creator can withdraw it. When a coin's bonding curve reaches its completion threshold the liquidity migrates automatically into a PumpSwap pool and the resulting LP tokens are burned, which permanently removes the liquidity-withdrawal attack that dominated Solana token launches before the platform existed. (Source: Pump.fun Bonding Curve, Pump.fun Fees, Pump Program Docs)

(b) Operational priorities

Pump.fun operates four product lines. The launchpad and its bonding-curve program issue new coins on Solana. PumpSwap is the platform's own constant-product AMM, which receives coins that complete their curve. Terminal is the multichain trading front end acquired with Padre in October 2025 and now covers Solana, Ethereum, Base, and BNB Chain. Livestreaming lets coin creators broadcast to their holders. The company has grown by acquisition, buying Kolscan in July 2025, Padre in October 2025, and Vyper in February 2026. Since 28 April 2026 the company's stated priority for PUMP is the programmatic buyback and burn, which directs 50 percent of net platform revenue into open-market purchases of PUMP that are then destroyed. (Source: Pump.fun April 28 Announcement, PUMP Token, Pump.fun Fees)

(c) High-level project overview

Pump.fun is a token launchpad and trading platform on Solana operated by Baton Corporation Ltd, a private limited company incorporated in England and Wales on 20 March 2023 under company number 14743013. The platform went live in January 2024. Its bonding-curve program at 6EF8rrecthR5Dkzon8Nwu78hRvfCKubJ14M5uBEwF6P mints each new coin with a fixed supply of 1,000,000,000 tokens and prices trades against synthetic reserves on a constant-product curve. Coins that complete their curve migrate to the PumpSwap AMM at pAMMBay6oceH9fJKBRHGP5D4bD4sWpmSwMn52FMfXEA. The native token PUMP launched on 12 July 2025 at mint pumpCmXqMfrsAkQ5r49WcJnRayYRqmXz6ae8H7H9Dfn under the Solana Token-2022 program, with a fixed maximum supply of 1,000,000,000,000 tokens. (Source: Companies House Filing 14743013, PUMP Token, Pump Program Docs, PUMP on CoinGecko)

(d) Primary token functions

PUMP performs three functions. It is the asset acquired by the programmatic buyback, which since 28 April 2026 applies 50 percent of net revenue from the bonding curve, PumpSwap, and Terminal to open-market purchases followed by burns, with the 5,000 basis point rate written into the buyback_basis_points field of the onchain Global config account at 4wTV1YmiEkRvAtNtsSGPtUrqRYQMe5SKy2uB4Jjaxnjf. It was the instrument of the July 2025 ICO, through which the company sold 33 percent of maximum supply for $1.32 billion. It is the denomination of platform cashback, which the Global config enables through the is_cashback_enabled flag. PUMP confers no governance rights, no equity, no debt claim, no dividend, and no redemption right over platform revenue or assets, which pump.fun states directly in its own disclosure. (Source: Pump.fun April 28 Announcement, PUMP Token, Pump.fun ICO Result, Pump Program IDL)

(e) Control surface reliance

The PUMP mint carries no live token-level control surface. Its mint authority, freeze authority, and Token-2022 metadata update authority all read null onchain, so no party can issue new PUMP, freeze a holder's balance, or alter the token's onchain metadata. The Token-2022 transfer hook extension points to authority DMdBa812dBW1CHVhmTyUyVcrBnSbZbfoFC7U14k4riH1, which is owned by program 333UA891CYPpAJAthphPT3hg1EkUBLhNFoP9HoWW3nug. That program's programData account at J97GHGFf2Dvf6bAEpkXbZTc4XkXprpqQG63j8dZVJMWK carries a null upgrade authority, and its published source declares an empty module containing no instructions, so no party can ever install a transfer hook on PUMP. The control that does exist sits at the platform layer rather than the token layer. The bonding-curve program and the PumpSwap program share a single upgrade authority at 7gZufwwAo17y5kg8FMyJy2phgpvv9RSdzWtdXiWHjFr8, and the Global config authority FFWtrEQ4B4PKQoVuHYzZq8FabGkVatYzDpEVHsK5rrhF controls 40 administrative instructions including set_params, update_global_authority, update_buyback_config, toggle_mayhem_mode, toggle_cashback_enabled, add_quote_mint, and set_virtual_quote_reserves. Pump.fun has not publicly disclosed the signer composition or approval threshold of either address. (Source: PUMP on Solscan, Transfer Hook Authority Source, Pump Program IDL, PumpSwap Docs)

(a) IP ownership & control

Pump.fun does not have a DAO or onchain governance mechanism, so no DAO owns or controls any intellectual property. The platform's terms define Pump IP as all intellectual property owned or licensed by the Pump Entities, and define Pump Entities as Baton Corp., Bracket Ltd., and other affiliated entities behind the Pump Platform and Services. Ownership and control of the brand, the front end, the trademarks, and the program code sit with those companies, and the trademark guidelines reserve the Pump.fun name and marks to the company. (Source: Pump.fun Terms and Conditions, Pump.fun Trademark Guidelines)

(b) Contract/admin powers

No DAO holds any contract or administrative power over the Pump.fun programs, because no DAO exists. Every administrative power is held by keys the company controls. The Global config authority FFWtrEQ4B4PKQoVuHYzZq8FabGkVatYzDpEVHsK5rrhF sets fee rates, buyback configuration, quote mints, creator assignment, and feature flags. The upgrade authority 7gZufwwAo17y5kg8FMyJy2phgpvv9RSdzWtdXiWHjFr8 can replace the executable code of both the bonding-curve program and the PumpSwap AMM. The withdraw authority 39azUYFWPz3VHgKCf3VChUwbpURdCHRxjWVowf5jUJjg and the admin set-creator authority UqN2p5bAzBqYdHXcgB6WLtuVrdvmy9JSAtgqZb3CMKw hold further privileged roles. None of these roles is subject to a token holder vote or a timelock. (Source: Pump Program IDL, Pump Program Docs, PumpSwap Docs)

(c) Locked-token rights (conditional)

(conditional)

No DAO exists, so locked PUMP carries no voting, delegation, or proposal rights at any stage of its vesting. The 330,000,000,000 PUMP allocated to the team and to existing investors sat under a 12-month lockup from the 12 July 2025 TGE and now vests linearly to July 2029, and throughout both the lockup and the vest those tokens confer no governance rights, no staking rights, and no claim on protocol revenue. Unlocked PUMP carries the same absence of rights. (Source: Pump.fun Terms and Conditions, PUMP July 2026 Unlock, PUMP Token)

(d) Value accrual & holder rights

Value accrues to PUMP through supply reduction rather than through any distribution to holders. Since 28 April 2026 an irreversible onchain program applies 50 percent of net revenue from the bonding curve, PumpSwap, and Terminal across Solana, Ethereum, Base, and BNB Chain to open-market purchases of PUMP that are burned, with the rate fixed at 5,000 basis points in the Global config. Pump.fun reports 162.72 billion PUMP purchased and burned under the buyback program, and the onchain supply delta from the original 1,000,000,000,000 maximum supply to the current 837,083,069,757 total supply is 162,916,930,243 PUMP, or 16.29 percent of maximum supply. Holders receive no dividend, no fee share, and no redemption right. Pump.fun states that PUMP does not represent equity, a debt instrument, or any right to revenues, profits, dividends, distributions, or any other cash flow, and that PUMP is not redeemable for platform revenues, assets, or any other property. Pump.fun further states that the buyback program creates no obligation, commitment, or undertaking to purchase PUMP except to the extent that purchases are executed automatically by smart contract code deployed onchain prior to 28 April 2026. (Source: Pump.fun April 28 Announcement, PUMP Token, Pump Program IDL, PUMP on CoinGecko)

(e) Dissolution authority

No DAO exists, so no DAO can be dissolved and no token holder vote can wind down the project. Dissolution authority sits with the shareholders and directors of Baton Corporation Ltd under the laws of England and Wales. Noah Bernhard Hugo Tweedale holds more than 75 percent of the company's voting rights, which is the threshold required to pass a special resolution, so he can resolve to wind up the company without the agreement of the other shareholders. The programs would continue to execute onchain after any corporate dissolution, because the buyback contract is irreversible and the transfer hook authority program is non-upgradeable. (Source: Companies House Filing 14743013, Class Action Complaint, Case 1:25-cv-00880 (S.D.N.Y.), Pump.fun April 28 Announcement)

(a) Entity

Pump.fun states that a Pump Foundation exists and that Baton Corporation Ltd is its development company. Pump.fun has not disclosed the foundation's legal name, its jurisdiction of incorporation, or its date of formation, and no registry record confirming it has been identified. Pump.fun has not stated whether the foundation existed at the 12 July 2025 TGE or what role, if any, it played in the issuance of PUMP. The July 2025 allocation reserves 2 percent of maximum supply under the label "foundation", and pump.fun has not confirmed that the Pump Foundation is the recipient or administrator of that allocation. The Glass Full Foundation announced on 8 August 2025 is a liquidity initiative that deployed 2,022 SOL into ten ecosystem coins on 9 August 2025 from wallets pump.fun labeled itself, and pump.fun disclosed neither an incorporating jurisdiction, nor officers, nor the source of its capital, nor the selection criteria for recipients. (Source: PUMP Token, Glass Full Foundation Launch, Pump.fun Terms and Conditions)

(b) IP ownership & control

Pump.fun has not disclosed any intellectual property owned or controlled by the Pump Foundation. All Pump IP is owned or licensed by the Pump Entities, which the terms define as Baton Corp., Bracket Ltd., and other affiliated entities, and the terms name no foundation among them. (Source: Pump.fun Terms and Conditions, Pump.fun Trademark Guidelines)

(c) Powers over DAO, treasury, protocol-controlled resources, and token administration

Pump.fun has not disclosed any power held by the Pump Foundation over a DAO, a treasury, a protocol-controlled resource, or a token administration function. No DAO exists. Every treasury and token administration power visible onchain sits with the company through the Global config authority FFWtrEQ4B4PKQoVuHYzZq8FabGkVatYzDpEVHsK5rrhF, the withdraw authority 39azUYFWPz3VHgKCf3VChUwbpURdCHRxjWVowf5jUJjg, and the fee recipient accounts set in the Global config. (Source: Pump Program IDL, Pump Program Docs)

(d) Powers over DevCo

Pump.fun describes Baton Corporation Ltd as the development company for the Pump Foundation and has not disclosed what powers the foundation holds over it. The Companies House register records no foundation as a shareholder or as a person with significant control. Control of the company rests with its three founder shareholders, and Noah Bernhard Hugo Tweedale holds more than 75 percent of the voting rights. (Source: Companies House Filing 14743013, Class Action Complaint, Case 1:25-cv-00880 (S.D.N.Y.))

(e) Contract/admin powers

No address disclosed as a Pump Foundation address holds contract or administrative power over the PUMP mint or the Pump.fun programs. The PUMP mint has null mint, freeze, and metadata update authorities, and every program-level administrative role belongs to company-controlled keys. Pump.fun has not disclosed the signer composition of those keys, so whether the foundation is a signer on either one cannot be determined from public record. (Source: PUMP on Solscan, Pump Program IDL)

(f) Current economic arrangements and distribution policies

Pump.fun has not disclosed any economic arrangement or distribution policy operated by the Pump Foundation, and has not disclosed any funding flow between the foundation and Baton Corporation Ltd. Pump.fun has not disclosed a wallet address, a release schedule, or a spending policy for the 2 percent foundation allocation, and has not reported any distribution from it. (Source: PUMP Token, PUMP on CoinGecko)

(a) Entity

The primary DevCo is Baton Corporation Ltd, a private limited company incorporated in England and Wales on 20 March 2023 under company number 14743013, with its registered office at 82a James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE, and SIC code 47910. The company is Active on the Companies House register, and its accounts are overdue with the next accounts due on 30 June 2026. Baton Corporation Ltd owns and operates Pump.fun, and pump.fun describes the company as the development company for the Pump Foundation. The platform's terms name a second entity, Bracket Ltd., as a Pump Entity alongside Baton Corp., and pump.fun has not disclosed Bracket Ltd.'s jurisdiction of incorporation. The terms select the law of the British Virgin Islands as governing law and require arbitration in Tortola, British Virgin Islands, under the BVI Arbitration Act 2013 before a single arbitrator in English, with a class action waiver and batching of mass arbitrations at 25 or more claims. (Source: Companies House Filing 14743013, Class Action Complaint, Case 1:25-cv-00880 (S.D.N.Y.), Pump.fun Terms and Conditions)

(b) IP ownership & control

The Pump Entities own or license all Pump IP, defined in the terms as all intellectual property owned or licensed by the Pump Entities related to the Pump Platform and Services. That covers the Pump.fun brand and marks, the front end, the livestreaming product, Terminal, and the program source. The trademark guidelines reserve the Pump.fun name, logo, and marks to the company and restrict third-party use. The company publishes its program IDLs and integration documentation openly at the pump-fun/pump-public-docs repository and publishes the transfer hook authority program source at pump-fun/transfer-hook-authority, and neither publication transfers ownership of the underlying intellectual property. (Source: Pump.fun Terms and Conditions, Pump.fun Trademark Guidelines, Pump Program Docs, Transfer Hook Authority Source)

(c) Powers over DAO, treasury, protocol-controlled resources, and token administration

No DAO exists, so the company holds no power over one. The company holds every power over the treasury, the protocol-controlled resources, and token administration. The Global config authority FFWtrEQ4B4PKQoVuHYzZq8FabGkVatYzDpEVHsK5rrhF can change fee rates, rewrite the buyback configuration through update_buyback_config, reassign the seven fee recipients and seven reserved fee recipients, reassign the eight buyback fee recipients, add and remove quote mints, toggle Mayhem Mode and cashback, and transfer its own authority through update_global_authority. The withdraw authority 39azUYFWPz3VHgKCf3VChUwbpURdCHRxjWVowf5jUJjg controls protocol fee withdrawal. The upgrade authority 7gZufwwAo17y5kg8FMyJy2phgpvv9RSdzWtdXiWHjFr8 can replace the code of the bonding-curve program and the PumpSwap AMM. Token administration on the PUMP mint itself is closed, because the mint, freeze, and metadata update authorities are null and cannot be restored. (Source: Pump Program IDL, Fee Recipients Docs, PUMP on Solscan)

(d) Powers over Foundation

Pump.fun states that Baton Corporation Ltd is the development company for the Pump Foundation. Pump.fun has not disclosed the terms of that relationship, including any development or service agreement, any board seat, any appointment right, or any funding flow in either direction. The company controls the wallets it labeled as Glass Full Foundation wallets and directed their 2,022 SOL deployment on 9 August 2025, and pump.fun has not stated whether the foundation was involved. (Source: Glass Full Foundation Launch, PUMP Token)

(e) Contract/admin powers

Baton Corporation Ltd holds the upgrade authority over both core programs and the authority over the Global config account, and the company has not disclosed whether either address is a single keypair or a multisignature vault, nor any approval threshold or timelock. The company holds no administrative power over the PUMP mint, because the mint authority, freeze authority, and Token-2022 metadata update authority are all null onchain. The company also holds no power to install a transfer hook on PUMP, because the transfer hook authority is owned by a non-upgradeable program at 333UA891CYPpAJAthphPT3hg1EkUBLhNFoP9HoWW3nug whose published source contains no instructions. (Source: PUMP on Solscan, Transfer Hook Authority Source, Pump Program IDL)

(f) Current economic arrangements and distribution policies

The company earns revenue from three fee streams defined in its fee documentation, a protocol fee, a creator fee, and an LP fee. On the bonding curve the Global config sets the protocol fee at 95 basis points and the creator fee at 5 basis points. Coin creation costs 0 SOL and 0 USDC, and the pump.fun front end charges no additional fee. PumpSwap canonical pool fees vary with the SOL-denominated or USDC-denominated market cap of the coin. Creator fees have applied to all coins on the bonding curve and on PumpSwap since 13 May 2025, and USDC pairing has been available to creators since 21 May 2026. Pump.fun states that it can change these fees at any time without notice. Since 28 April 2026 the company directs 50 percent of net revenue, calculated across the bonding curve, PumpSwap, and Terminal on Solana, Base, Ethereum, and BNB Chain, net of referral fees and cashbacks and exclusive of Mayhem Mode, into the programmatic PUMP buyback and burn for a one-year term. The team holds 20 percent of maximum supply under a vesting schedule running to July 2029. Pump.fun has not disclosed dividends, salaries, or any other distribution policy of the company. (Source: Pump.fun Fees, Pump Program IDL, PUMP Token, Pump.fun April 28 Announcement)

(a) Launch supply totals

Pump.fun minted the full maximum supply of 1,000,000,000,000 PUMP at the 12 July 2025 TGE and issued no PUMP after that date. Of the launch supply, 330,000,000,000 PUMP, or 33 percent, was sold through the ICO and delivered to purchasers at TGE. As of 28 August 2026 total supply onchain stands at 837,083,069,757 PUMP and circulating supply stands at 396,954,735,322 PUMP, giving a market capitalization of $1.86 billion at a price of $0.004684 and a fully diluted valuation of $3.92 billion. (Source: PUMP on CoinGecko, PUMP Tokenomics Announcement, Pump.fun ICO Result)

(b) Recipient categories & use of funds

Pump.fun divided the 1,000,000,000,000 PUMP maximum supply across eight categories. The ICO took 33 percent, community and ecosystem 24 percent, the team 20 percent, existing investors 13 percent, livestream incentives 3 percent, liquidity and exchanges 2.6 percent, the ecosystem fund 2.4 percent, and the foundation 2 percent. The ICO raised $1.32 billion in total, $720 million from the private tranche and $600 million from the public tranche. Pump.fun has not published a line-item budget for the ICO proceeds. The company's disclosed uses of capital since the raise are the acquisitions of Kolscan in July 2025, Padre in October 2025, and Vyper in February 2026, the Glass Full Foundation liquidity deployment of 2,022 SOL on 9 August 2025, and the PUMP buyback and burn program, into which pump.fun reports 162.72 billion PUMP has been purchased and destroyed. (Source: PUMP Tokenomics Announcement, Pump.fun ICO Result, PUMP Token, Glass Full Foundation Launch)

(c) Initial price per token (if applicable)

(if applicable)

The initial price was $0.004 per PUMP in both ICO tranches, which set a fully diluted valuation of $4 billion across the 1,000,000,000,000 token maximum supply. The private tranche sold 180,000,000,000 PUMP at that price for $720 million, and the public tranche sold 150,000,000,000 PUMP at that price for $600 million. (Source: Pump.fun ICO Result, Pump.fun Public Sale at $4B FDV, PUMP Tokenomics Announcement)

(d) Ticker / market symbol

The ticker is PUMP. The Token-2022 metadata extension on mint pumpCmXqMfrsAkQ5r49WcJnRayYRqmXz6ae8H7H9Dfn records the name "Pump" and the symbol "PUMP" with six decimals, and its update authority is null so the symbol cannot be changed. Hyperliquid lists the asset under the symbol UPUMP against USDC. (Source: PUMP on Solscan, PUMP on CoinGecko)

(e) Total supply & supply regime

The supply regime is fixed and deflationary. Maximum supply is 1,000,000,000,000 PUMP and can never increase, because the mint authority is null onchain and cannot be restored. Total supply has fallen to 837,083,069,757 PUMP as of 28 August 2026, a reduction of 162,916,930,243 PUMP or 16.29 percent of maximum supply. Pump.fun reports 162.72 billion PUMP of that reduction as buyback burns, and the remainder of the supply delta is not attributed to a named program in pump.fun's own reporting. Supply continues to fall for as long as the buyback contract runs, which under the 28 April 2026 commitment is a one-year term applying 5,000 basis points of net revenue. (Source: PUMP on CoinGecko, PUMP Token, Pump.fun April 28 Announcement, Pump Program IDL)

(f) Initial vesting / release schedules

ICO purchasers received fully unlocked PUMP at the 12 July 2025 TGE with no cliff and no vest, covering 33 percent of maximum supply. The team allocation of 20 percent and the existing investor allocation of 13 percent, together 330,000,000,000 PUMP, were locked for 12 months from 12 July 2025 and then vest linearly over three years to July 2029. The first cliff released 82,500,000,000 PUMP on 12 July 2026, worth approximately $125 million at the time, split as 50,000,000,000 PUMP to the team and 32,500,000,000 PUMP to existing investors, and leaving 247,500,000,000 PUMP locked. On 15 July 2026 pump.fun distributed 57,279,000,000 PUMP worth approximately $86.49 million across 121 wallets. Linear vesting proceeds at 6,875,000,000 PUMP per month, and the first monthly tranche released on 12 August 2026. Pump.fun has not published release schedules for the community and ecosystem, livestream incentive, liquidity and exchange, ecosystem fund, or foundation allocations. (Source: PUMP July 2026 Unlock, PUMP Vesting Begins, PUMP 6.875B Unlock, PUMP Tokenomics Announcement)

Executed airdrop

No target user segment and no allocation method exist for a TGE airdrop, because no TGE airdrop was conducted or is planned. The one executed distribution covered a single segment, holders of the PADRE token at the 24 October 2025 snapshot, and pump.fun allocated PUMP to that segment in proportion to PADRE holdings at the snapshot. Pump.fun has not published a per-address allocation file, Dune table, Merkle dump, repository file, or RPC endpoint for that distribution. (Source: PUMP Token, Pump.fun Terms and Conditions)

No airdrop planned or conducted

Pump.fun has never conducted a community airdrop of PUMP and does not plan to execute one. The company said on 9 July 2025 that an airdrop was coming, and Chief Operating Officer Alon Cohen said the following day that no airdrop would happen in the immediate future. No eligibility criteria, snapshot date, allocation formula, or claim process has been published since. The only PUMP distribution the company has executed outside the ICO was compensation to holders of PADRE following the Padre acquisition, which used a snapshot dated 24 October 2025 and a claim window that closed on 30 December 2025. (Source: PUMP Token, Pump.fun ICO Result)

Pump.fun has not disclosed any market maker agreement, and no allocation or loan of PUMP to a market maker has been disclosed. No token allocation, loan, option, call, or retainer involving PUMP and a named market maker appears in the company's tokenomics disclosure, its terms, its April 2026 announcement, or its ICO materials. The only public signal is an onchain investigator's report of a 10 PUMP test transfer to a wallet linked to Wintermute around the token launch, which is not an agreement and carries no disclosed terms. (Source: PUMP Token, Pump.fun ICO Result, Pump.fun Terms and Conditions)

• Exchange Name: Bybit, Kraken, KuCoin, Bitget, Gate.io, MEXC (ICO distribution venues, 12 July 2025)

  • Token Allocation Committed: 150,000,000,000 PUMP, or 15 percent of maximum supply, sold across the six venues in aggregate. Per-venue allocations are not publicly disclosed.
  • Term Duration: Single sale event completed 12 July 2025 in 12 minutes. No listing lockup or incentive term is publicly disclosed.
  • Native Token Listing Fees: Pump.fun has not disclosed any listing fee paid in PUMP.

• Exchange Name: Binance, Binance US, Coinbase Exchange, OKX, Upbit, Bithumb, Gemini, Crypto.com, BingX, Bitrue, Bitvavo, Backpack, Bitkub, Mercado Bitcoin, WhiteBIT, Bybit EU (secondary spot listings)

  • Token Allocation Committed: Pump.fun has not disclosed any token allocation committed to these listings.
  • Term Duration: Pump.fun has not disclosed any listing lockup, liquidity, or incentive term.
  • Native Token Listing Fees: Pump.fun has not disclosed any listing fee paid in PUMP.

• Exchange Name: Hyperliquid (UPUMP/USDC)

  • Token Allocation Committed: Pump.fun has not disclosed any token allocation committed to this listing.
  • Term Duration: Pump.fun has not disclosed any listing lockup, liquidity, or incentive term.
  • Native Token Listing Fees: Pump.fun has not disclosed any listing fee paid in PUMP.

• Exchange Name: PumpSwap, Meteora, Orca, Raydium CLMM, Byreal, PancakeSwap V3 (Solana) (DEX pools)

  • Token Allocation Committed: Pump.fun has not disclosed the PUMP committed to any specific pool. The 2.6 percent of maximum supply allocated to liquidity and exchanges covers both centralized and decentralized venues.
  • Term Duration: No lockup or incentive term is publicly disclosed for any pool.
  • Native Token Listing Fees: No listing fee applies.

• Exchange Name: Pump.fun distributed the public ICO tranche through six centralized exchanges on 12 July 2025 and PUMP has since been listed on a wide set of venues.

  (Source: PUMP on CoinGecko, Pump.fun ICO Result, PUMP Tokenomics Announcement)

  • Token Allocation Committed: Pump.fun allocated 2.6 percent of maximum supply, or 26,000,000,000 PUMP, to the combined liquidity and exchanges category, and sold a further 15 percent of maximum supply through the six ICO venues. Pump.fun has not disclosed how the 2.6 percent liquidity and exchanges allocation was divided between individual centralized exchanges and decentralized pools. (Source: PUMP Tokenomics Announcement, Pump.fun ICO Result)
  • Term Duration: The ICO distribution was a single event that opened and sold out within 12 minutes on 12 July 2025, and ICO tokens carried no lockup. Pump.fun has not disclosed any listing lockup, liquidity commitment period, or exchange incentive program term for PUMP on any venue. (Source: Pump.fun ICO Result, Pump.fun Public Sale at $4B FDV)
  • Native Token Listing Fees: Pump.fun has not disclosed any listing fee paid in PUMP to any centralized or decentralized venue, and has not disclosed any recipient, vesting term, or lock term tied to an exchange partnership. (Source: PUMP Token, Pump.fun Terms and Conditions)

• Series Name: PUMP ICO, private tranche, direct token sale
  • Date Of Sale: July 2025, in the week preceding 12 July 2025
  • Number of tokens sold: 180,000,000,000 PUMP, 18 percent of maximum supply, at $0.004 for $720 million
  • Vesting Schedule: Fully unlocked at the 12 July 2025 TGE. No cliff and no vest.
• Series Name: PUMP ICO, public tranche, direct token sale
  • Date Of Sale: 12 July 2025
  • Number of tokens sold: 150,000,000,000 PUMP, 15 percent of maximum supply, at $0.004 for $600 million
  • Vesting Schedule: Fully unlocked at the 12 July 2025 TGE. No cliff and no vest.
• Series Name: Existing investor allocation, pre-ICO equity investors
  • Date Of Sale: Allocated at the 12 July 2025 TGE
  • Number of tokens sold: 130,000,000,000 PUMP, 13 percent of maximum supply
  • Vesting Schedule: 12-month lockup from 12 July 2025, then three-year linear vest to July 2029. Cliff of 32,500,000,000 PUMP released 12 July 2026.

(Source: Pump.fun ICO Result, Pump.fun Public Sale at $4B FDV, PUMP Tokenomics Announcement, PUMP July 2026 Unlock)

Pump.fun raised equity from Alliance DAO, Big Brain Holdings, 6th Man Ventures, D1 Ventures, Delphi Ventures, Formulate Ventures, Lattice Capital, and Tioga Capital before the token launch, and those investors received the 13 percent existing investor allocation at TGE. Pump.fun has not disclosed the instrument used in those rounds, the amounts raised, or the valuations. Pump.fun has not conducted any OTC token sale or discounted market maker sale, and the company excluded residents of the United States and the United Kingdom from the public ICO tranche. A third party listed a $15 million secondary equity stake in the company on SecondLane at a $1.5 billion valuation, which was a shareholder sale rather than a sale by the project. (Source: Pump.Fun Company Profile, Pump.fun ICO Result, PUMP Tokenomics Announcement)

(a) Date & component affected

Incident 1. Bonding curve withdraw authority abuse, 16 May 2024

The attack ran on 16 May 2024 over roughly 100 minutes and affected the Pump.fun bonding-curve program on Solana. The PUMP token did not exist at the time, and no PUMP holder was affected. (Source: Pump.fun Bonding Curve Exploit, Pump.fun Flash Loan Exploit)

Incident 2. X account compromise, 26 February 2025

The compromise occurred on 26 February 2025 and affected the @pumpdotfun account on X. No Pump.fun program, contract, or wallet on Solana was affected. (Source: Pump.fun X Account Compromise, Pump.fun X Account Hack Advisory)

Incident 3. Instagram account compromise, April 2026

The compromise was disclosed on 19 April 2026 and affected the official Pump.fun Instagram account. No Pump.fun program, contract, or wallet was affected. (Source: Pump.fun Instagram Account Compromise)

(b) Exploit vector summary

Incident 1. Bonding curve withdraw authority abuse, 16 May 2024

A former Pump.fun employee retained access to the withdraw authority on the bonding-curve program. The attacker borrowed SOL through flash loans from a Solana lending protocol, used the borrowed SOL to buy coins up to the 100 percent completion point of their bonding curves, used the retained withdraw authority to take the resulting curve liquidity, and repaid the flash loans from the proceeds. The vector was insider key access combined with flash loan capital rather than a flaw in the curve mathematics. (Source: Pump.fun Flash Loan Exploit, Pump.fun Bonding Curve Exploit)

Incident 2. X account compromise, 26 February 2025

An external party gained control of the Pump.fun X account and posted a Solana contract address for a fraudulent token described as the official Pump.fun governance token, alongside further fraudulent tokens named HACKED, hackeddotfun, and GPT-4.5. Onchain investigator ZachXBT linked the compromise to the earlier Jupiter DAO and DogWifCoin account compromises and attributed the access to social engineering of the X platform rather than to a failure by the Pump.fun team. Pump.fun stated that it received no email, password, delegation, or two-factor authentication change confirmations. (Source: Pump.fun X Account Compromise, Pump.fun X Account Hack Advisory)

Incident 3. Instagram account compromise, April 2026

An external party gained control of the Pump.fun Instagram account and posted content from it. Pump.fun has not disclosed the access vector. (Source: Pump.fun Instagram Account Compromise)

(c) Quantified impact

Incident 1. Bonding curve withdraw authority abuse, 16 May 2024

The attacker took approximately 12,300 SOL, worth about $1.9 million at the time, from roughly $45 million of liquidity held in Pump.fun bonding curve contracts. The attacker then airdropped the proceeds to unrelated wallets rather than retaining them. (Source: Pump.fun Flash Loan Exploit, Pump.fun Bonding Curve Exploit)

Incident 2. X account compromise, 26 February 2025

No protocol funds and no user balances were lost. The fraudulent governance token reached a market capitalization of approximately $5 million before collapsing, and losses fell on buyers of that token rather than on Pump.fun or its users. (Source: Pump.fun X Account Compromise, Pump.fun X Account Hack Advisory)

Incident 3. Instagram account compromise, April 2026

No loss of protocol funds and no loss of user assets occurred. Pump.fun confirmed that its platforms remained safe and that all user assets on the platform were unaffected. (Source: Pump.fun Instagram Account Compromise)

(d) Remediation/response taken

Incident 1. Bonding curve withdraw authority abuse, 16 May 2024

Pump.fun paused trading, revoked the compromised access, upgraded the bonding-curve contracts so no further funds could be withdrawn, migrated to the new contracts, and committed that affected users would recover 100 percent or more of the liquidity in their coins at the time of the attack. (Source: Pump.fun Bonding Curve Exploit, Pump.fun Flash Loan Exploit)

Incident 2. X account compromise, 26 February 2025

Pump.fun warned users through its Telegram channel not to interact with the compromised account, with Chief Operating Officer Alon Cohen issuing the warning publicly, and regained full control of the account the same day. (Source: Pump.fun X Account Compromise, Pump.fun X Account Hack Advisory)

Incident 3. Instagram account compromise, April 2026

Pump.fun instructed users not to trust any post made from the official Instagram account until the compromise was resolved and directed users to its verified official channels for further updates. (Source: Pump.fun Instagram Account Compromise)

(e) Current status

Incident 1. Bonding curve withdraw authority abuse, 16 May 2024

Resolved. Pump.fun restored trading on the migrated contracts, the remaining protocol liquidity was confirmed safe, and the attacker publicly self-identified as Jarett Dunn under the handle STACCoverflow. The current programs no longer expose the withdraw path used in the attack. (Source: Pump.fun Flash Loan Exploit, Pump.fun Bonding Curve Exploit, Pump Program Docs)

Incident 2. X account compromise, 26 February 2025

Resolved. Pump.fun recovered the account on 26 February 2025 and the fraudulent posts were removed. (Source: Pump.fun X Account Compromise)

Incident 3. Instagram account compromise, April 2026

Resolved. Pump.fun confirmed that its platforms and user assets remained safe throughout, and the account is under company control. (Source: Pump.fun Instagram Account Compromise)

(f) References (optional)

Incident 1. Bonding curve withdraw authority abuse, 16 May 2024

Contemporaneous reporting on the incident is available from CoinDesk and The Block. (Source: Pump.fun Bonding Curve Exploit, Pump.fun Flash Loan Exploit)

Incident 2. X account compromise, 26 February 2025

Contemporaneous reporting on the incident is available from The Block and BleepingComputer. (Source: Pump.fun X Account Compromise, Pump.fun X Account Hack Advisory)

Incident 3. Instagram account compromise, April 2026

Contemporaneous reporting on the incident is available from The Crypto Times. (Source: Pump.fun Instagram Account Compromise)

(a) Regulatory, Legal & Tax Risks

Impact of Regulatory Change on TGE and Listings

The TGE completed on 12 July 2025 and all ICO tokens were delivered at that date, so no future regulatory change can prevent token delivery to ICO purchasers. Regulatory change can still remove PUMP from trading venues. Pump.fun excluded residents of the United States and the United Kingdom from the public ICO tranche, and its own April 2026 buyback communication states that it is not directed at, or intended for use by, persons in the United Kingdom, which shows the company already treats those markets as restricted. PUMP now trades on more than twenty centralized exchanges across many jurisdictions, and each of those venues can delist PUMP unilaterally in response to a licensing requirement, an enforcement action, or a change in the classification of the token in its market. A determination by a securities regulator that the July 2025 ICO constituted an unregistered securities offering would create delisting pressure across the venues that distributed it. (Source: Pump.fun April 28 Announcement, Pump.fun ICO Result, PUMP on CoinGecko, Pump.fun Terms and Conditions)

Entity-Level Regulatory Impact

Baton Corporation Ltd is a single operating company incorporated in England and Wales. Pump.fun states that a Pump Foundation exists with the company as its development company, and has disclosed no legal name, jurisdiction, officers, or assets for it, so no disclosed entity stands ready to absorb regulatory pressure or to continue the project independently of the company. No DAO exists. Concentration is severe at both the corporate and the key level. Three founders hold all the shares, one founder holds more than 75 percent of the voting rights, and the same company controls the upgrade authority over the bonding-curve program and the PumpSwap AMM and the authority over the Global config account. An enforcement action, a licensing requirement, or a court order against Baton Corporation Ltd therefore reaches the entire project. The company faces a consolidated putative class action in the United States District Court for the Southern District of New York, Aguilar v. Baton Corporation Ltd, case number 1:25-cv-00880, filed 30 January 2025 and consolidated with case 1:25-cv-00490 before Judge Colleen McMahon. The second amended consolidated complaint, filed 7 January 2026, names the company, its three founders, Solana Labs, Inc., the Solana Foundation, individual Solana executives, and 25 anonymous key opinion leader defendants, and asserts federal securities claims alongside claims under the Racketeer Influenced and Corrupt Organizations Act. The defendants moved to dismiss the second amended complaint in March 2026, arguing that it fails to establish jurisdiction and fails to demonstrate that the tokens at issue are securities. Company filings compound the exposure, because the Companies House record shows the company's accounts are overdue with the next accounts due on 30 June 2026. The company also structures its user relationship under British Virgin Islands law with mandatory arbitration in Tortola and a class action waiver, and a court that declines to enforce that clause would expose the company to collective proceedings it has contracted to avoid. (Source: Companies House Filing 14743013, Aguilar v. Baton Docket, Burwick Law Case Page, Pump.fun Terms and Conditions, Pump Program IDL)

Tokenholder Tax Treatment

Pump.fun publishes no tax guidance for PUMP holders, and the tax treatment of the token is unsettled in most jurisdictions. Tax authorities differ on whether acquiring PUMP in the ICO, receiving vested PUMP, disposing of PUMP, or receiving platform cashback denominated in PUMP creates a taxable event, and on whether gains are treated as income or as capital. The buyback and burn mechanism creates a further open question, because it raises the value of remaining tokens without any distribution to holders, and jurisdictions treat that pattern inconsistently. Tokenholders are solely responsible for determining and meeting their own tax obligations in their own jurisdictions, and should obtain independent tax advice rather than relying on this filing or on any Pump.fun material. (Source: Pump.fun Terms and Conditions, Pump.fun April 28 Announcement, PUMP Token)

Jurisdictional & User Access Restrictions

Pump.fun prohibits access by residents of Russia, Cuba, Iran, North Korea, and Syria, and by any person identified as sanctioned under measures prescribed by the United States of America, the United Kingdom, the European Union, or the United Nations, including persons on the sanctions lists maintained by the United States Office of Foreign Assets Control. The terms further prohibit the use of VPNs, proxies, geolocation spoofing, burner identities, linked social accounts, or other technical means to evade jurisdictional, sanctions, fraud, or platform-integrity controls. Pump.fun excluded residents of the United States and the United Kingdom from the July 2025 public ICO tranche, and its April 2026 buyback communication is expressly not directed at persons in the United Kingdom. Users who breach these restrictions risk losing access to their accounts and to any assets held through the platform, and users in permitted jurisdictions risk losing access if their jurisdiction is added to the restricted list. The project carries the mirror risk, because access controls that rely on residency declarations and IP geolocation are evaded in practice, and the company remains exposed to sanctions and licensing liability for users who evade them. (Source: Pump.fun Terms and Conditions, Pump.fun Privacy Policy, Pump.fun April 28 Announcement, Pump.fun ICO Result)

(b) Protocol, Technology & Security Risks

Bugs and Design Flaws

The Pump.fun programs custody user funds directly. The bonding-curve program holds the SOL and USDC paid into every incomplete curve, and the PumpSwap AMM holds the reserves of every graduated pool, so a pricing, accounting, or authorization defect in either program puts those balances at risk. The May 2024 incident demonstrated this concretely, because a privileged withdraw path combined with flash loan capital drained roughly $1.9 million from bonding curve liquidity. The upgrade surface is the largest current risk. A single authority at 7gZufwwAo17y5kg8FMyJy2phgpvv9RSdzWtdXiWHjFr8 can replace the executable code of both programs at any time with no timelock and no token holder veto, so a compromise of that key converts into total loss of custodied funds. The Global config authority FFWtrEQ4B4PKQoVuHYzZq8FabGkVatYzDpEVHsK5rrhF presents a parallel risk, because it can reassign fee recipients and buyback fee recipients and rewrite the buyback configuration. The platform's multichain expansion into Ethereum, Base, and BNB Chain through Terminal adds cross-chain execution surface beyond the audited Solana programs. Recent protocol changes add further surface, including the virtual_quote_reserves field appended to the PumpSwap Pool account and the new buy_v2, sell_v2, and buy_exact_quote_in_v2 instructions, and integrators that price against raw vault balances rather than effective quote reserves will misquote pools that later carry a non-zero virtual reserve. The PUMP token itself carries materially less risk, because its mint, freeze, and metadata update authorities are null and its transfer hook can never be set. (Source: Pump Program Docs, PumpSwap Docs, Pump.fun Flash Loan Exploit, PUMP on Solscan)

Security Measures & Their Limitations

Pump.fun's disclosed security measures are architectural rather than procedural. The company removed the token-level control surface on PUMP by setting the mint, freeze, and metadata update authorities to null, and it permanently closed the transfer hook surface by assigning the hook authority to a non-upgradeable program at 333UA891CYPpAJAthphPT3hg1EkUBLhNFoP9HoWW3nug whose published source contains no instructions. The company enforces the buyback rate onchain through the buyback_basis_points field rather than by policy. It burns LP tokens on migration from the bonding curve to PumpSwap so migrated liquidity cannot be withdrawn. It publishes its program IDLs and integration documentation openly for independent review. After the May 2024 incident it revoked the compromised access and migrated contracts. Pump.fun has not published a security audit report for the bonding-curve program, the PumpSwap AMM, the fee program, or the buyback contract, and operates no public bug bounty program. These measures do not address the largest residual risks. Null token authorities do nothing to protect funds custodied by the programs. Open IDLs are not an audit, because they document interfaces rather than verifying implementation. Neither an audit nor a bounty would constrain the live upgrade authority, which can replace program code after any review. Every historical Pump.fun incident to date originated in credential control rather than in contract logic, covering an insider key in May 2024, an X account in February 2025, and an Instagram account in April 2026, and audits and formal verification do not detect that class of failure. (Source: PUMP on Solscan, Transfer Hook Authority Source, Pump Program Docs, Pump.fun Bonding Curve)

(c) Token Economics, Unlocks & Incentive Risks

Critical Economic Assumptions

PUMP's economics rest on one assumption above all others, that Pump.fun continues to generate substantial trading fee revenue. The token has no staking yield, no governance utility, no fee share, and no redemption right, so demand rests entirely on the buyback bid and on expectations of its continuation. That bid scales linearly with revenue, and Pump.fun's revenue is a direct function of memecoin trading volume, which is the most cyclical activity in crypto. Pump.fun's own history demonstrates the range, because daily revenue fell from more than $7 million at the January 2025 peak to roughly $200,000 by August 2025, a decline of more than 97 percent within seven months. The buyback carries a defined one-year term from 28 April 2026, so the mechanism expires in April 2027 unless the company renews it, and the company has made no commitment to renew. The company states directly that PUMP carries no right to revenues, profits, dividends, distributions, or any other cash flow, and that the buyback creates no obligation to purchase PUMP beyond what the deployed contract executes automatically. The second assumption is competitive, because Pump.fun's fee revenue depends on retaining launchpad market share against rival platforms on Solana and on the EVM chains Terminal now covers. If either assumption fails the burn rate falls toward zero, supply reduction stops, and PUMP retains no other source of value accrual. (Source: Pump.fun April 28 Announcement, PUMP Token, Glass Full Foundation Launch, Pump.fun Fees)

Governance Control over Monetary Policy & Rewards

Token holders exercise no control over monetary policy or rewards, because no DAO and no onchain governance mechanism exists. Pump.fun controls every parameter unilaterally through company-held keys. The Global config authority FFWtrEQ4B4PKQoVuHYzZq8FabGkVatYzDpEVHsK5rrhF can call set_params to change the 95 basis point protocol fee and the 5 basis point creator fee, update_buyback_config to change the buyback configuration, set_reserved_fee_recipients and the fee recipient setters to redirect where fees accrue, toggle_cashback_enabled to switch off cashback, toggle_mayhem_mode, add_quote_mint and remove_quote_mint to change accepted quote assets, and update_global_authority to transfer the role itself. The upgrade authority 7gZufwwAo17y5kg8FMyJy2phgpvv9RSdzWtdXiWHjFr8 can replace both programs outright. None of these actions requires a vote, a timelock, or notice, and the fee documentation states that Pump.fun can change fees at any time without notice. The 5,000 basis point buyback rate is the one parameter with a durable onchain commitment, and even that commitment runs for a defined one-year term. Supply overhang compounds the exposure, because 247,500,000,000 PUMP allocated to the team and existing investors remains locked and vests at 6,875,000,000 PUMP per month until July 2029, which is a continuing source of sell pressure that token holders cannot influence and that exceeds the monthly burn at low revenue levels. Pump.fun has not disclosed the signer composition or approval threshold of either administrative key, so holders cannot assess how many parties would need to act to change any of these terms. (Source: Pump Program IDL, Pump.fun Fees, Pump.fun April 28 Announcement, PUMP July 2026 Unlock)