Pump Science tweeted that due to an oversight in their GitHub repository, the wallet: T5j2UB...jjb8sc was attacked, and the attacker found the private key in the source code of the website; the private key was initially used for testing purposes on GitHub and was considered unimportant by the development team; however, this wallet is actually marked as the creator of the off-chain tokens URO and RIF on Pump Fun, and the attacker may use the Pump Fun pscience account: T5j2UB...jjb8sc to issue more tokens.
Pump Fun co-founder Alon explained why the CA deployer appears different from the actual token creator, as URO and RIF were created off-chain, which means they were free to create, and the first buyer was technically the on-chain creator at the address: BLDRZQ...36KtuZ, which is the first wallet to purchase URO and RIF, as shown on the Solscan block explorer as the token deployer.
