152: Stacc Attack

Episode Summary

Executive Summary: The episode follows Jarrett Dunn (“Stack”), a crypto developer whose grief, mental illness, and disillusionment with PumpFun led him to exploit a Solana/PumpFun vulnerability, redirecting liquidity during meme-coin graduation events and causing a major theft. The story also exposes PumpFun’s ethically chaotic culture, weak moderation, and harmful live-streaming ecosystem, raising broader questions about crypto, anonymity, and platform responsibility.

Main Topics: Jarrett Dunn’s path into photography and early disillusionment (Priority: 3/5): The episode opens with a personal anecdote about buying an expensive Canon 5D Mark II he could barely afford, framing a recurring pattern: chasing ambition, then regretting costly choices. This sets up the psychological and financial context for his later actions. Crypto development background and bug-hunting mentality (Priority: 4/5): Jarrett describes years of involvement in crypto projects and a tendency to find flaws in systems. He claims he often reported bugs, but when ignored, the line between responsible disclosure and exploitation became blurred. PumpFun’s meme-coin casino model (Priority: 5/5): The episode explains PumpFun as a fast-moving, highly addictive meme-coin launchpad where users speculate on jokes and social hype. The host emphasizes the platform’s “pump and dump” dynamics and its resemblance to a casino or the worst parts of internet culture. Ethical concerns about moderation, KYC, and live streaming (Priority: 5/5): Jarrett and the host discuss the lack of KYC/AML, no clear terms of service, and dangerous live streams involving sexual content, self-harm, intoxication, and exploitation. This becomes a central critique of PumpFun’s growth-at-all-costs culture. The Solana/PumpFun exploit and theft mechanics (Priority: 5/5): Jarrett allegedly used a flash-loan-based exploit and insider knowledge to manipulate token graduation from PumpFun to Raydium, redirecting liquidity to wallets he controlled. The episode frames this as a technically complex theft that targeted many meme coins at scale. Mental health, grief, and accountability (Priority: 4/5): Jarrett repeatedly links his behavior to grief over his mother’s death, medication lapses, psychiatric diagnoses, substance abuse recovery, and paranoid or delusional states. The episode explores how mental illness complicates responsibility without excusing the crime. Legal fallout and platform response (Priority: 4/5): Authorities arrested Jarrett, he pled guilty, later tried to vacate the plea, and the court process continued. PumpFun increased fees to stop the exploit and ultimately disabled livestreaming after public outcry over dangerous content.

Key Arguments: PumpFun is structurally similar to a casino: users know many meme coins are absurd, yet the rapid speculation and social pressure still drive participation. A public blockchain makes the money flows visible, but visibility does not equal safety; the platform still enabled exploitative behavior and weak oversight. Jarrett claims he reported some vulnerabilities before exploiting them, suggesting a failure of responsible disclosure mechanisms. The exploit was technically sophisticated, involving flash loans, recursive transactions, and redirecting liquidity during token graduation. PumpFun’s lack of KYC, AML, and meaningful moderation created an environment where harmful, illegal, or exploitative content could flourish. Jarrett’s mental health crisis, grief, and addiction seriously affected his judgment, but he also understood the mechanics of the attack and its likely effects. The episode suggests that platforms pursuing viral growth and high fees may become unstable, unethical, or eventually collapse under their own incentives.

Data Points: Canon 5D Mark II cost: $2,500 - Jarrett says this was the camera he bought on credit and regretted because he could not afford it. Solana market position: 5th largest cryptocurrency - The host describes Solana’s size to explain why the outage and exploit mattered. Solana outage duration: 20 hours - A network outage on February 25, 2023 was tied to unusual block sizes and degraded service. PumpFun daily token launches: 20,000+ per day - Jarrett and the host describe the scale of meme-coin creation on the platform. PumpFun fee revenue in one day: $520,000 - Jarrett cites a recent daily fee figure to show how much the platform earns. Total fees collected by PumpFun: $340 million - The episode states this figure as cumulative fees collected by the site. Exploit theft value: About $2 million USD - The host summarizes the value of Solana redirected during the attack. Solana tokens stolen/redirected: 12,600 SOL - The episode says this was the amount ultimately pilfered and sent to random addresses or projects. Potential theft estimate: $40 million - Jarrett says the attack could have stolen far more if executed at full scale. Potential recipient addresses: 95,000 total addresses - Jarrett describes how many addresses could have received funds from the script. Confirmed recipients: About 2,000 - Jarrett says only about 2,000 addresses actually received funds. Podcast view count for the tweet: 2.2 million views - Jarrett’s public post about the robbery drew significant attention. Possible sentence range: 7 to 14 years - The court is described as considering this range for sentencing. PumpFun live-stream moderation failure: Feature disabled - The company reportedly shut off livestreaming after repeated harmful incidents.

Pivotal Quotes: "“The dumbest thing I ever bought is a Canon DSL camera, 5D Mark II.”" — Jack Resider / intro story: Opening anecdote used to frame regret, compulsive spending, and the episode’s theme of bad decisions. "“No magic. Everybody be cool. This is a robbery.”" — Jarrett Dunn: Jarrett’s own social post before or during the exploit, signaling intent and theatricality. "“Pump prevents rugs by making sure all created tokens are safe.”" — PumpFun site messaging (quoted by host): The host highlights this statement as ironic given the exploit and the platform’s wider risks.

Implications: The episode warns that fast-moving crypto platforms can combine speculation, weak governance, and harmful incentives into serious real-world harm. It also shows how mental health, platform design, and insider access can intersect in devastating ways.