pump.fun scams and how to avoid them

The one rule

pump.fun’s terms (§12.2(c)): “under no circumstances will we ask you to share your Wallet private keys, seed or recovery phrases, social-login or email credentials, one-time codes or similar.” The app repeats it on the key-export screen. Anyone who asks for any of those is a scammer, whatever their profile picture says.

1. Fake support

How it works: you post a problem in a public chat or reply to pump.fun on X. Within minutes someone “from support” DMs you, then asks you to “verify” or “sync” your wallet on a site, or to share your seed phrase or email login code.

Facts: pump.fun’s terms list one support contact, the Telegram account t.me/pumpfunsupport, and legal notices go to [email protected] (§28.1). The Google Play listing gives [email protected]. The terms also say pump.fun may contact you by direct message on X (§28.2), which is exactly why impostors use that channel. A real support agent never needs a key, a seed phrase or a code. We found no published incident report naming a specific fake-support case against pump.fun users; this is a general pattern seen across crypto apps.

Defence: only start support from the app’s own Support link, and never act on an inbound DM.

2. Phishing domains and fake airdrops

How it works: a lookalike site advertises a “PUMP token sale” or “claim your airdrop”. Connecting your wallet and signing gives the site permission to empty it.

Documented examples (security researchers at PCrisk, 2026): pump-sale[.]live, returnpump[.]fun, pumpclaimpad[.]fun, pumpfun-treasure[.]com, pump-fun-airdrop.pages[.]dev, rewards-pumpfun.web[.]app. Patterns to recognise:

• the brand plus a word: pump-fun-…, pumpclaim…, …-sale;
• a free-hosting suffix such as .pages.dev or .web.app;
• a domain that isn’t pump.fun or one of its subdomains. Our official links page lists the real ones.

A leaked list of about 218,000 trader emails from pump.fun, GMGN, Axiom and Padre users was advertised for sale (Brinztech; date unclear), so phishing emails can address you by name and mention your trading app.

3. Hijacked real accounts and domains

Checking the domain isn’t always enough:

• 26 February 2025: pump.fun’s own X account was taken over and used to promote a fake “PUMP” token.
• 11–12 March 2026: bonk.fun, a rival Solana launchpad, had its real domain hijacked. The site showed a fake “Terms of Service” prompt; signing it drained the wallet. At least one user reported losing more than $270,000, and the team told users to stay off the domain.

Defence: be suspicious of any new signature request on a site you use every day, especially one framed as “accept the new terms” or “verify”. A normal trade shows a swap, not an open-ended permission.

4. Cloned coins

How it works: when a coin trends, copies launch with the same name, ticker and image, on Solana or on other chains. Buyers searching by ticker buy the copy.

Facts: the address suffix “pump” is not proof a coin came from pump.fun. Open-source pump.fun SDKs include vanity address generators, so anyone can create an address ending in “pump”, and some pump.fun coins don’t end in it at all. Paid DEX Screener profiles can also make a copy look official.

Defence: get the contract address (the “mint”) from the coin’s own pump.fun page or the creator’s verified account, and paste that into the coin check. Never buy by ticker alone. How to spot a rug covers the full clone check.

5. Bundled launches and dev dumps

How it works: the creator buys a big share of supply from many wallets in the same block (a “bundle”), so the holder list looks spread out. Once buyers arrive, the wallets sell together. Commercial and open-source bundling tools exist.

Defence: pump.fun’s coin page shows “bundlers %”, “snipers %”, “dev holdings %” and “top 10 %”. High numbers mean a few wallets can crash the price. These are risks inside pump.fun’s rules, not hacks, so nobody refunds them.

6. Recovery scams

After a loss, “fund recovery” services find victims in replies and DMs and charge an upfront fee. Blockchain transfers can’t be reversed by anyone outside the receiving wallet. If you were drained, move what’s left to a new wallet from a clean device and report the scam address to your wallet provider.

If something feels wrong

• Close the tab or chat.
• Type pump.fun yourself, or use the app from the official store listing.
• Check the coin’s contract address, not its name.
• Never sign a request you don’t understand.