$29.7M Stolen From Solana Traders in 11 Months, and Pump.fun Was the Main Target
Sandwich bots quietly extracted $29.7 million in gross profits from Solana traders over just 11 months, and nearly every attack landed on the same two venues: Pump.fun's bonding curve and PumpSwap.
New data reveals that these two platforms accounted for 96% of all detected sandwich attacks during the study window. If you have traded a memecoin on Solana in the past year, there is a real chance a bot front-ran your buy, dumped tokens on your head, and pocketed the spread before your transaction even confirmed.
How the Theft Actually Works
Sandwich attacks are not glamorous. A bot detects your pending transaction in the mempool, fires a buy order ahead of yours to push the price up, lets your trade execute at the inflated rate, then immediately sells into your liquidity. You get a worse price. The bot gets your money. The whole sequence takes milliseconds.
The reason Pump.fun became ground zero is structural. Its launch curve model creates predictable price slippage windows, especially during the frenzied early seconds of a new token launch when traders are competing to get in fast and slippage tolerance settings are often wide open. Bots treat that chaos as a buffet.
PumpSwap, Pump.fun's own DEX, inherited the same problem when it launched. Combined, the two products handed sandwich operators a concentrated, high-volume hunting ground that dwarfs anything else on the Solana network.
$29.7M Is the Floor, Not the Ceiling
The figure cited is gross revenue before bot operational costs, including Solana transaction fees, validator tips, and infrastructure. Net profits will be lower. But with 11 months of data and $29.7 million on the board, the economics clearly work for the attackers or they would have stopped.
This is also only what was detected. Sophisticated bots are built to obscure their patterns. The real number is almost certainly higher.
What This Means for Traders Right Now
If you are active on Pump.fun or PumpSwap, three things matter immediately.
First, set slippage as low as your trade will tolerate. Wide slippage settings are an open invitation. Second, consider routing trades through aggregators that include MEV protection, such as Jupiter with its MEV-shield option. Third, treat extremely new token launches as the highest-risk environment on Solana. The first few minutes of a curve are peak sandwich territory.
The broader signal here is harder to ignore: Solana's memecoin ecosystem is generating real volume, but a significant portion of that volume is being systematically taxed by bots before retail traders see a single confirmation. Until Pump.fun addresses this at the protocol level, traders are paying an invisible fee on every memecoin play.
Watch whether Pump.fun responds publicly. Silence from the team would be its own kind of signal.