Skip to content

Podcast

152- Stacc Attack

Darknet Diaries

Source ↗ ← All highlights
  • Memecoin Value
    • Memecoins have no inherent value; their worth is driven by hype and jokes.
    • This reflects how stories and branding create value for even mundane items. Transcript: Jack Rhysider And it’s also a story I think a dozen people have told me to look into at this point. Have you heard of meme coins? They’re like jokes, but in the form of cryptocurrency, they’re really weird and nobody seems to understand why they have any value at all. Jarett Dunn Yeah, there’s no inherent value. The whole pitch is that there is no pitch. Jack Rhysider And you might say, oh, I would never buy something with no value. Oh, yeah? Then are you saying you never bought name brand clothes or food or medicine? The store brand, ibuprofen, has the exact same ingredients as the Advil brand. And it’s just as effective and is honestly the exact same product. Yet people still prefer the Advil brand, even though it costs twice as much. And that’s marketing for you. That’s storytelling for you. Stories alone give value and meaning to otherwise meaningless or valueless things. So anyway, people are buying cryptocurrencies simply as a joke. Almost like they’re laughing at themselves. Like they know they’re buying a meme coin and it’s a stupid idea, but they’re like, yeah, let’s do that. And then they feel stupid even after doing it. It’s very strange. Now, are you into, like, do you like crypto and NFTs or is this like something you’re just like poking at and making fun of and being like, what idiots are buying all this stupid stuff? (Time 0:05:46)
  • Bug Hunting
    • Jarrett Dunn enjoys finding bugs in cryptocurrency code.
    • He often reports these bugs but feels unheard, leading him to exploit them. Transcript: Jack Rhysider I found Solana, I kind of found a place for myself, I guess. So he’s contributed to the development of many cryptocurrency projects out there. And it was Solana, the fifth largest cryptocurrency that he felt most at home in. And he put his focus there. But one thing Jarrett just can’t help doing is looking for bugs in the code that can be exploited for money. Because if a bug is present in a crypto project, it could result in catastrophic losses for everyone involved. The bug hunting, I’m trying to get a square understanding of this because are you looking for bugs and then reporting them so they get fixed or are you looking for bugs and then exploiting Them? Jarett Dunn So I will tell you, I have in the past reported any number of bugs that have gone on deaf ears. Reported bugs all over the place. So I reported a bug to Radium and Orca Whirlpools at one point. Orca dismissed it as out of scope because they don’t support that particular program, I guess. I don’t know why. And then also Radium, they got all of me in the end and basically said, there’s nothing we could do to prevent good market behavior. So that’s that kind of wall you hit. In short, no, I usually try to report these things. In total, I’ve been paid, I think, two bulk bannies that are significant. Jarrett claims that he had information (Time 0:08:20)
  • Solana Attack
    • While grieving, Jarrett attacked the Solana network by queuing recursive transactions.
    • This resulted in large block sizes, clogging the network. Transcript: Jack Rhysider Solana is a type of cryptocurrency. It’s the fifth biggest coin in terms of market cap. It’s kind of a big deal. And Jarrett knew some of its weaknesses. So he started messing with it. Jarett Dunn I was out of my mind, always grieving, and I was trying to do as much as I could. So I was queuing as many recursive transactions as I possibly could. The validator is running Clockwork because they can optionally do this Geyser plugin and get additional money by running these threads. Clockwork is a scheduling software. The thing is, I figured out that you can do recursive transactions. So you actually have a transaction that calls another transaction in the same slot. Which obviously, if you have enough money to pay to pay Piper, that’s terrible for blockchains or any competing network. All went down again and a couple days later, I was asleep or in a coma, and the entire Salomon Hork went down on clockwork, and came back up. He (Time 0:12:27)
  • PumpFun as a Casino
    • PumpFun resembles a casino, fostering addictive behavior with its fast-paced memecoin trading.
    • The platform encourages a pump-and-dump strategy, creating a ruthless environment. Transcript: Jack Rhysider Fun. To research this episode, I actually created an account on there and used the site for a few days. And he’s absolutely right. It feels like a casino. And it’s pretty addictive because of that. And the meme coins I bought on there yesterday absolutely are the dumbest things I ever bought in my life. I kept finding myself lost in a daze, staring at the screen, watching my bags. Then suddenly waking up, realizing I’m betting on memes. And I say to myself, what in the world are you doing? So what PumpFun is, it’s a place that anyone could go to and make a meme coin on the Salon Network. It’s very easy and fast. And then others can buy your meme coin from you if they want on the site. The site looks a lot like 4chan. And as you’re there, you’re just bombarded with endless messages of new coins being created and what coins people are buying and selling. And it’s wildly popular. So before your eyes, you’re watching a coin get created by someone, and then hundreds of people are buying that coin, all in the first five minutes of it existing. And I only went there to research this place. I only spent like a few bucks on meme coins. Like for $2, you can buy 30,000 meme coins. As I used to cite myself, I got familiar with the game. It’s called Pump Fun because the game is to pump and dump. A meme coin’s relevancy only lasts a few minutes sometimes. Then it crashes into oblivion. So the game is to jump in on a coin, hoping more people are going to buy it after you do. And if they do, your holdings go up. And then you need to get out before that goes back down. And so the people holding that coin will use every strategy they can to get others to buy it after them. And as I played this game, I too became someone trying to convince others to get in on this coin. It’s hot. Pump it. And then as soon as they jump in, I jump out, dump it. It’s ruthless in that way, because you see the other people who are buying the coin and you want to think they’re on your team. They’re going to help you pump it. But no, they’re just looking for a way to get out before you do. (Time 0:15:20)
  • Joining PumpFun
    • Jarrett Dunn joined PumpFun, moving to the UK to work with the young, inexperienced founders.
    • He questioned their ethics and extravagant spending habits. Transcript: Jack Rhysider Site is right out of bizarro internet land. The layout is weird. The images and coin names are a cringe. It’s all moving way too fast for anyone to be able to read. Things are like jumping off the screen, constantly trying to get your attention. And so Jarrett was playing around on the site quite a bit, launching coins, running trading bots, and being pretty active on PumpFun, tweeting about it too. And I recurred on LinkedIn at all. Jarett Dunn I said, you should buy for a couple jobs. And I said, sure, why not? Regredgingly, actually. And I had like two or three interviews with Pump, different founders, and I got an offer. So they paid for my passport, paid for my flight, paid for a couple other things. I got a thing, gave a renewal of my passport and a ticket that was actually the same night. And then I flew over to the UK. I’ve only left Canada once in my life before this. Jack Rhysider So Jared got hired by PumpFun and moved to the UK. And he knew this was a crazy idea to move to a new country for some wacky crypto project, but was excited about it too. Jarett Dunn I was just excited just to work in a real office again. I’ve been remote first since like 2013 when I worked for Research in Motion. It was my last in-person job. Like the guys that later called themselves BlackBrain, they’re now in a business. It’s a long career of isolation and addiction and stuff. And I just, I really wanted to be part of an organization that was young and fit and like looking forward to achieving stuff. They were already one of the number one earning apps anywhere in crypto. It’s a very long story. Like I don’t really know, but the main thing is I wasn’t on my medication. Probably not thinking straight, that’s one thing. What was the medication you’re on? I’m on antipsychotics once a month via Depo, and I’m also on Alvance or Vivanse. You’re in America, so Vivanse. I fixed my own ears up there. Jack Rhysider What is that treat? ADHT. Okay, so you go to London. You meet with the creators of this. What is your opinions of them? Jarett Dunn Oxford, yeah. Yeah, I flew to Oxford. They’re all younger. They’re all in a student housing in Oxford. There was this black tie event they threw. It was their second masquerade or third or whatever. Jack Rhysider What was your first opinion of them? Jarett Dunn I don’t really know. I didn’t anticipate the CTO was the CTO. I actually mistook them as an employee. They’re all young 20s and very unexperienced, I guess is the word. (Time 0:19:07)
  • The Hack
    • During a psychotic episode, Jarrett exploited a vulnerability he had previously reported to PumpFun.
    • He was aware of his actions but not their illegality, as confirmed by a psychiatric report. Transcript: Jack Rhysider Did you know what you were about to do? Like, were you aware of your actions at all? Jarett Dunn Psychiatric report confirms that I was aware of what I was doing, but totally unaware of the illegality of my actions. I had no idea any of this fallout would happen. I had no idea that police would care. I didn’t think this throughout. I really didn’t. So unfortunately, I am where I am. I got to deal with the repercussions of my actions. I got to learn there are consequences to my actions, so I’m just resigned to it. Jack Rhysider So where does this begin? Do you see the vulnerability in the code and then just decide to exploit it as soon as you find it? Jarett Dunn Yeah, and funny enough, I did report it a couple of weeks before that. There was just no action to fix it. Well, you’re the developer. I know, but I reported it. I tried to tell the CTO. You email yourself like, hey, you should fix this. Hey, I’m busy. True enough. Jack Rhysider This hack is probably one of the more complex hacks I’ve ever talked about. I didn’t understand it when Jared explained it. I didn’t understand it when I read an article explaining it. I didn’t understand it when I asked my DGEN friends to explain it. It took a long time of me reading article after article trying to fully grasp what happened. And I’ll summarize it just for the geeks out there who like the technical aspects like me. When a token is made on PumpFun, it pretty much is just available on PumpFun. But when enough people buy it, it then gets graduated to Radium, which is a DEX, a decentralized exchange. And this makes it a little bit more official because it’s on this decentralized exchange now. And so to graduate out of PumpFun into the DEX, PumpFun sends a bunch of Solana along with it in order to fund the liquidity pool on the DEX. So what Jared did is he took out a flash loan and bought all the tokens needed to graduate the meme coin over to the DEX. And then he immediately sold the meme coin to pay back the flash loan. Then, using his insider access, he redirected where the Solana was supposed to go. Instead of it going to the DEX, it went to somewhere that he controlled. This would allow him to take anywhere from 1 to 80 Solana coins every time he could get a coin to graduate out of PumpFun and onto the radium DEX. But Jarrett, being Jarrett, wrote a little program to try to do it to not just one or 10 or 20, but thousands, tens of thousands of PumpFun meme coins. Because every time he could get one of them moved over to the Dex, he’d make a few thousand dollars. So he wrote this program and executed it, taking out thousands of flash loans, pumping projects, and redirecting the Solana that was supposed to go to the DEX to somewhere else he controlled. Then he immediately sold the meme coins to pay the loan back. On May 16th, 2024, he decided he was going to execute this program. It was all built and ready, and once triggered, it would just automatically try to hit as many meme coins as possible on PumpFun. Jarett Dunn I was not thinking straight at all. I was just that out of it that I didn’t understand what was going on. I didn’t even know what I was writing while I was writing it. It’s very interesting. Any idea why you were so out of it? Like, what do you mean by out of it? Probably without, probably without medication, like antipsychotic medication for about six months would do it. I’m a diagnosed schizoaffective person with panic disorder, bipolar, and ant-social personality disorder. And depending on how you talk to ADHD, the New Psych Report, the New Psych Report believes me to have one diagnosis. He doesn’t think there’s any psychotics and there’s no other so long, so long when it’s over. However, he thinks just ADHD and maybe make it to a personality disorder, but he didn’t want to actually declare it. Just needs more success. Gosh, dang, dude. No wonder you’re called Stack Overflow. It’s a memory leak, isn’t it? That’s the vibe. My Instagram, and my no-law of Instagram, is 256 bits of confusion. Yes. That was a lie. You (Time 0:33:52)
  • Stacc Attack Announcement
    • Before executing the hack, Jarrett tweeted about his intentions, calling it the “Stacc Attack.”
    • He aimed to redistribute funds to deserving Solana projects, not to enrich himself. Transcript: Jack Rhysider And no light was shed on the possible future or the consequences. You see this vulnerability, you have this episode, a psychotic episode, and you’re just like, oh my gosh, let’s see, like, let’s see if this can work. I don’t really care. Like, I mean, do you have kind of a, I’m thinking about that moment right before pushing enter. Jarett Dunn Well, yeah, that’s the thing. The moment right before pushing enter, and I’m glad you phrased it like that, because it was quite the… Leading up to it, I got paranoid again. I couldn’t be in the same building as them. I thought they would lash out and stuff. And I had to, like, certidatiously move to a cafe full spy and stuff. And I had to sneak around and look around the corners. They couldn’t see me and stuff. But then at the very moment, I was hovering over the enter key, right? I stepped back and I said, well, let’s just, let’s just think about it for a second. Let’s, let’s draft a tweet here. And so it was actually a Facebook post. It was, yeah, I’m going to show you. They’ve got 2.1 million views. Um, uh, this is the tweet. It basically summarizes my thoughts at that very moment. Jack Rhysider Now magic, everybody be cool. This is a robbery. What’d it do stack attack? I’m about to change the course of history and then rot in jail. Am I insane? Nah. Am I? Well, very much not. Do I want anything? My mom raised from the dead and barring that life without parole. Okay. So you string a series of tweets and you had 2.2 million views, this thing. Yeah. So you knew this was going to steal money. Who did you think it was going to steal money from? The users. That’s the thing. I limited the damages enough that they could pay back to users. Jarett Dunn That’s not a big deal, giving up the fire guy. Jack Rhysider Now, did you have any estimate on how much money you would be stealing? $40 million. $40 million. Jarett Dunn No, it says in the tweet about $80 million, but I was just being silly. Jack Rhysider If done right, this heist is going to steal $40 million worth of Solana from the users of PumpFun. In his tweet, he even goes so far as to say it might cause a Solana outage, suggesting that this hack could be so catastrophic to that it causes a chain split, similar to what happened to Ethereum Classic. Jarett Dunn I don’t know why I said that. The Solana fork thing. People laugh about it constantly these days. They quote this thing still and say, I’m not even thinking it can cause a fork to Solana fork. It’s just very interesting that people think I’m bad. I mean, I was. I was always not well on our opus. (Time 0:38:51)
  • Hack Execution
    • Jarrett’s hack exploited PumpFun’s system, redirecting Solana funds to random projects.
    • He didn’t keep any of the stolen Solana, distributing approximately $2 million. Transcript: Jack Rhysider Okay. So you write the tweet and then hit enter. Yeah. Jarett Dunn I’m going to start getting phone calls on Telegram over and over again. So I uninstall Telegram. How was that? I went and walked around in circles. And I was running out of battery. One of the employees came running by me. And I even just put up my hands at a beachside, but he like ran right by me and looked both ways down the road and ran off in a different direction. I said, well, that’s my, that’s my hands that I should, I should get some cover. God protected me in that instance. So let’s go get some cover. Jack Rhysider His program was working flawlessly. He was taking out flash loans, pumping projects until it’d flip over to the decks and then sell those coins to pay back the Flash Loan and then redirect in the Solana that was supposed To go to the DEX. But here’s the thing. His program had one other trick up its sleeve. His mission wasn’t to make money. He wanted to be dramatic and theatrical. Remember? So his hack was programmed to send the coins he was getting to random Solana projects that he liked. In fact, he never had possession of the stolen Solana at any time. They were automatically redirected to random people in the world, and he had thousands of wallets that he was sending this money to. Jarett Dunn There’s about 95 total thousand addresses. 95,000 total addresses that could have potentially received funds. Either those only about 2,000 did again because I’m not good at math and it was supposed to actually hit everybody more than once. Regardless, yeah, just random jokes. I actually, I asked somebody at some point, I said, who do you believe to be a more deserving subset of users on Solana? And this is what I came to mind. Jack Rhysider Hundreds of Pump Fund coins were getting hit by this, and as the continued running, thousands were getting hit. The owners of PumpFun quickly became aware that their site was under attack and were looking for Jarrett. But at that point, someone gave Jarrett some money and he checked into a hotel room, not even a block away from the offices, to try to lay low for a while. And I’m just trying to catch your emotional reaction when you’re seeing it actually working. Like, shit, it worked. Jarett Dunn I didn’t anticipate… Yeah, I mean, there’s that. The first one when it went through, I was like, oh, shit, it didn’t work. And then it was obviously multiplying, like doing these on a… You got an acyntric on the sleep and stuff, so there’s many thousands or a couple of minutes or whatever, but like at least attempts, right? Because there was, again, many hundreds of thousands in total that failed. However, I guess I was more worried about getting the thing to have more successful transactions than when emotional response. Again, somebody who’s diagnosed presently with ASPD and potentially next person, I don’t really understand emotion the way that most people do. It’s more technical and it’s more, it’s more, like, I don’t process emotions in my, I guess is what I should say. Jack Rhysider Yeah, how does that work? Jarett Dunn It’s like I’m on the moon and I have a telescope and I can kind of witness what other people go through by viewing them through the telescope and I can emulate as best as I can and I come off Pretty well, but I really have no idea what I’m doing. It’s just through emulation at a very long distance. Jack Rhysider PumpFun creators couldn’t stop it. They wanted to, but simply had no tools to combat this. And they just sat there, staring at the devastation unfolding. Thousands of Solana tokens were being taken and redistributed to random Solana projects. Eventually, the PumpFun team came up with a plan. They increased the transaction fees that were being charged on the site. This way, every time Jarrett bought some PumpFun tokens, he’d be charged a ridiculous amount. And the increase in fees actually did put an end to this, because the flash loans that Jarrett was taking out simply couldn’t cover the extra fees required to pump the token anymore. And even if it did, it would likely make this plan be a lot less profitable. So somewhere between 30 to 60 minutes in, the elaborate and wild robbery of Pump Fund came to an end. Jarrett was able to pilfer 12,600 Solana coins at the time and send them all to random addresses, other projects that he thought were deserving of the money. He didn’t keep a single token for himself. In total, it was about 2 million US dollars worth of Solana. So the victims here were the people who were using these meme coins on PumpFun. They had their liquidity stolen. PumpFun had to take responsibility for this and spend their own money putting back the liquidity into these projects that got it stolen from. So in the end, the biggest loser here is actually PumpFun. And they were mad. They learned pretty early on that Jarrett must have been behind this. His sudden disappearance, strange behavior, and wild tweets were clues alone. But tracing this through, they also could see that it was an insider who was redirecting the funds. So they called the police to help them hunt down and arrest (Time 0:41:17)
  • Arrest and Aftermath
    • PumpFun hired an international security service to track down Jarrett, eventually arresting him near their office.
    • He faces a potential prison sentence of 7 to 14 years. Transcript: Jarett Dunn Jarrett. Two days later, they found me. Three days later, actually, they found me. Again, 90 meters from the office. They sent somebody to my sister’s house in Canada in that time. And there was a private, what was it called? The International Security Service was hired to find me, which is why they found me, I guess. But I was just eating a burger across the street. And they saw me and reported me. And then to a warning, the cop showed up. Jack Rhysider Somewhere in the middle of it all, he discovered that his wallet was receiving huge amounts of meme coins. And he couldn’t quite understand why. By the time this was all over, he had about $600,000 in meme coins in his wallet. But he just handed the private key of that wallet over to the PumpFun team because he wasn’t trying to make money off this himself and felt like he already made the statement he was trying To make. Jarett Dunn Two or three in the morning, I was asleep. I was fast asleep. The cops show up and they knock on the door and I said, ah, shit, here we go. Not even this person I’ve ever been arrested. And they come in. These gentlemen, and it was cordial and stuff. I eventually went to go pick up a glass bottle full of water to pour myself water. I didn’t know I was under arrest at this point. And they said, can you put the bottle down? I just want some water. He says, I’ll get you some water. I said, sure. Thank you. Anyway, they’re terrifying. I’ve learned since that the reporter for the alleging party said that I would tend to violence very quickly, which is not true, categorically, so historical, all of that stuff. And they were worried I would destroy the evidence needed upon the police arrival. Body chemist will prove otherwise. Then I went to the station. Stayed overnight. Based on in the morning. Lots of psychiatrists. Three psychiatrists, actually. They said I probably shouldn’t answer questions. I mean, I’ve been a bit concerned myself. Listen, I haven’t had medication. I have not had medication in six months. I don’t think I can answer questions right now. So that’s what happened. Then I was in the hospital for a month. I came out. I was late on my rent. Paid my rent. Dale says that I here. Been here since. Got drunk for like two months straight, if you will. And then decided one Monday to stop drinking. Started doing recovery groups and have been sober since. The court looked at his case and decided that he’ll (Time 0:45:50)
  • PumpFun Rug Pull Prediction
    • Jarrett believes PumpFun will eventually rug pull its users, despite their claims of security.
    • He views his actions as a preemptive strike against their exploitative practices. Transcript: Jack Rhysider Receive a maximum of 14 years in prison for this. And a minimum of seven. How do you feel about that? Jarett Dunn No, I have no idea. I’m not really phased. I’ve been through worse. It’s just unfortunate. I’m glad mom’s not allowed to see this. I really have my reservations about my nieces. Knowing that I’m in jail, that will suck for them. But the point is, yeah, I see no issue with it. It’s a good jail. I mean, no jail is a good jail, but it’s the UK. I mean, it’s not like dirt floor. You can get a degree. There’s like libraries. I’ll be fine. You can buy vapes at the canteen. Jack Rhysider You’ll be fine. You’ll be fine in jail. Jarett Dunn I’ll be fine. I’ll be fine. I’ll be fine. The funny thing is, I begged for it in the tweet. Like, you just saw the tweet. Like, I begged for it. At that point, anything was better than living with the roaches and mice here in this barn-up scene. At that point, I really just didn’t want to live where I was living. I didn’t want to deal with the things anymore. And I thought to myself, Gio’s preferable to this. And so I did this stupid thing. And now I got to face the music. Jack Rhysider You really are a character out of, likearchar, Camus, or Kafka or something. Mice and rats made me, drove me crazy to the point where I committed a crime to go to jail for seven years. But at the same time, I wanted to spread the wealth to everyone else who deserved it. This is ridiculous. Jarett Dunn This is what it is. Jack Rhysider This is all fact. Jarett Dunn I mean, you’re welcome to do your research and cross-reference, but this is the series of events that exactly what I… I don’t even know what to think about this. Jack Rhysider How do you want this story to end? Like, you’re going to go to jail, and you’re going to be watching the news, and what news are you hoping to see? Jarett Dunn I know invariably that they’re going to run off with the money at some point. All of the user funds, which is much more than trying to avoid. Jack Rhysider Hold on. It’s kind of ironic that you said that because when you go to the site, Pumped Up Fund, a pop-up shows up and it says, pump prevents rugs by making sure all created tokens are safe. They say they’re the ones preventing rugs, but you’re saying, no, they are (Time 0:47:56)
  • Live Streaming Shutdown
    • PumpFun temporarily disabled live streaming due to extreme content, including self-harm and threats.
    • The platform struggles to moderate its rapidly growing user base. Transcript: Jack Rhysider Oh, and this episode was really hard to make because PumpFun is always changing. Just before I was about to publish this, there was a surge in new users at PumpFun. And along with that came a surge of new live streamers and things got pretty wild. Some guy was holding a goldfish at gunpoint saying, buy my coin or I’ll kill the fish. Another guy was live streaming himself pooping for four days. He was sitting on the toilet for four straight days trying to pump his coin. Another guy locked himself in a dog cage until his coin would hit a certain price. And someone else locked their grandma in a cage until the coin would hit a certain price. I saw the photo, but I’m pretty sure it was fake. Another guy was firing his gun out the window every time the coin went up a certain amount. And I also heard reports of some live streaming bestiality. And there were reports of people threatening to shoot their pet dog unless their coin pumps. And I heard a report that there was someone live streaming threatening to shoot their family unless their coin got to a certain height. And someone live streamed themselves tying a rope around their neck, saying unless their coin hits a certain amount, they’re going to hang themselves. And the coin didn’t make it. So he hung himself. But then as the stream continued, some viewers were like, nah, I can see your hand moving. That’s fake, bro. Anyway, all this sparked an outcry on Twitter, especially from the crypto community saying, whoa, PumpFun, you’ve got people killing themselves on camera. You need to make some rules, guys. You’re going to ruin everything. On top of that, the PumpFun team themselves was actively taking down live streams that had repulsive or dangerous content. And it got to be too much. The PumpFun team simply couldn’t keep up with the constant stream of awful content that they were trying to remove. So they turned off the live streaming feature altogether and issued a statement saying, they simply can’t moderate effectively with the current user base size and they need to scale Up their moderation abilities and make it clear what’s allowed and what’s not allowed before allowing live streaming back on. All I can say is I think this is just PumpFun’s origin story. I don’t know what’s going to happen next, but it almost feels like one of those internet moments that I’m tuned into now. And I’m going to have a box of popcorn ready for whatever happens next. Jarett Dunn Aside from that, it was a pleasure, Jack. If you do get around to publishing this, I just want to say that I recommend everybody get some more fun and more time to touch your glass. That’s about it. Thank you. Seriously. All right. I’ll take advice from you. Thank you. I can’t trust a bunch. You put it. (Time 0:52:54)