SUBJECT
Baton Corporation Ltd. operating entity — Documented internal-access related incidents and exploits
PRIMARY INCIDENT — MAY 16, 2024
Perpetrator Profile
- Name: Jarett Dunn
- Aliases: Stacc, StaccOverflow, @STACCoverflow
- Role: Former senior developer/contractor
Attack Methodology
Abuse of privileged admin/withdraw authority:
- Leveraged flash loans on Solana lending protocol
- Artificially graduated multiple bonding curve contracts by purchasing tokens to reach migration threshold
- Redirected intended liquidity migration SOL to attacker-controlled addresses instead of Raydium DEX pools
Distribution Details
- Stolen SOL dispersed to random Solana wallet addresses (airdrops to users/projects)
- Attacker retained no funds personally
- Some sources note ~$600,000 in meme coins briefly held, later handed over
PLATFORM RESPONSE
Emergency Measures
- Immediate contract upgrade to revoke compromised authority
- Temporary site shutdown
Public Post-Mortem
Official post-mortem published confirming insider nature of attack
User Compensation: Full restoration of affected liquidity from platform treasury
Fee Waiver: 7 days post-incident
Source: [2]LEGAL PROCEEDINGS
Arrest
Dunn arrested in London (hotel near Pump.fun WeWork office)
Initially bailed; mental health evaluation/hospitalization noted post-arrest
Source: [3]Initial Guilty Plea
Pleaded guilty to:
- Fraud by abuse of position
- Transfer of criminal property
Attempted Plea Withdrawal
Legal team withdrew; Dunn re-pleaded guilty
OTHER INCIDENTS
Official X Account Compromised
Account: @pumpdotfun
Activity: Used to promote fake "PUMP" governance token and other fraudulent coins (e.g., "GPT-4.5")
Resolution: Team regained control same day
Impact: No protocol/smart contract compromise
Source: [5]Attribution
Linked to broader chain of X hacks including Jupiter DAO, DogWifCoin
External social engineering; not internal access compromise
POST-INCIDENT SECURITY STATUS
- No additional internal/employee-access exploits documented (as of January 31, 2026)
- No protocol-level breaches in public sources
- PumpSwap launch (March 2025) passed multiple audits
- No confirmed follow-on insider incidents
UNCORROBORATED / REDACTED ATTRIBUTES
- Exact final recovered amount from dispersed funds (platform compensated fully; no public recovery breakdown)
- Full forensic details of admin authority compromise mechanics (beyond flash loan + withdraw redirect; partial descriptions in post-mortem and court reporting)
- Any unreported minor internal incidents or attempted accesses (none surfaced in litigation, media, or on-chain analyses)
- Potential civil recovery actions by Pump.fun against Dunn (no public filings documented beyond UK criminal case)