DeSci Platform Pump Science Admits Private Key Leak, Vows Security Overhaul

Pump Science, a decentralized science (DeSci) platform, is facing backlash after a private key linked to its Pump.fun profile was exposed on GitHub, enabling a hacker to create counterfeit tokens. The incident, acknowledged on November 27 during an AMA session hosted on X by Pump Science’s co-founder Benji Leibowitz, has raised concerns about platform security.

“We absolutely acknowledge this as a significant failure on our part,” Leibowitz stated, pledging that such a mistake would not occur again. He further assured users that Pump Science will no longer launch tokens through Pump.fun, a decision underscored by the renaming of its compromised profile to “dont_trust” to deter further token purchases.

Fraudulent Tokens Flood Market

The leaked private key allowed the attacker, described as a “known threat,” to mint fraud tokens, including Urolithin B to E ($URO) and Cocaine ($COKE). Pump Science swiftly warned users against trusting any new tokens issued under its compromised profile.

To address the fallout, the platform has partnered with blockchain security firm Blockaid to flag suspicious mints originating from the exposed wallet. Additionally, Pump Science has begun a comprehensive audit of its platform and plans to implement enhanced security measures, including a bug bounty for penetration testing.

While partially attributing the leak to Solana-based software firm BuilderZ, which mistakenly included private keys for a developer wallet in its GitHub codebase, Pump Science dismissed BuilderZ as the likely attacker. Instead, the team suspects the culprit is linked to a prior hacking incident involving James Pacheco, co-founder of Solana-based platform Elmnts.

Commitment to Future Security

Pump Science remains committed to bolstering security before launching new tokens, aiming to complete audits and enhancements by the holiday season. The platform specializes in trading tokens linked to longevity medicine, with only two legitimate tokens—Rifampicin (RIF) and Urolithin A (URO)—currently active.

Data from CoinGecko reveals that RIF and URO hold market caps of $85.6 million and $37.2 million, respectively. Rifampicin is an antibiotic used to treat tuberculosis, while Urolithin A is a dietary supplement touted for its mitochondrial and anti-inflammatory benefits.