Solana AMM Aquifer hit by $2.5 million exploit, offers 20% bounty

Solana-based automated market maker Aquifer has lost roughly $2.5 million in an exploit involving wallets on Solana and Ethereum, with the protocol offering the attacker a 20% bounty for returning most of the funds. Summary Solana based AMM Aquifer lost roughly $2.5 million in an exploit involving attacker addresses on Solana and Ethereum. Aquifer offered the attacker a 20% whitehat bounty if at least 80% of the assets are returned by Sept. 3. The exact point of compromise remains unclear, with no technical post mortem yet establishing how access to the affected wallets was obtained. Available information has not established that Aquifer’s smart contracts were exploited, leaving compromised wallet access as the main focus of the incident so far. Blockchain security monitoring service Defimon reported the attack on Aug. 31, identifying separate Solana and Ethereum addresses controlled by the suspected exploiter. Aquifer later sent an on-chain whitehat offer seeking the return of at least 80% of the assets linked to the incident. Solana prop AMM @_aquifer_ (https://t.co/Ht8ZLFgSDM) exploited for ~$2.5M Attacker (Ethereum): https://t.co/EsfR5KFiQK Attacker (Solana): https://t.co/UozUOIj3sXhttps://t.co/gV1FFq9Mmwpic.twitter.com/UWJAM7FCGX — Defimon Alerts (@DefimonAlerts) August 31, 2026 The offer gives the attacker until Sept. 3 at 14:00 UTC to transfer the assets, or their equivalent value, to recovery addresses provided by Aquifer. The person controlling the wallets may retain up to 20% of the funds as a whitehat bounty if the conditions are met. Aquifer said it would not pursue civil claims arising from the exploit if the attacker complies with the terms, subject to applicable law. The agreement would not bind law enforcement agencies, regulators, sanctions authorities or other government bodies. Aquifer exploit involves wallets on two chains Aquifer operates as a proprietary automated market maker on Solana, where its liquidity is used to facilitate token swaps. DefiLlama describes the protocol as a prop AMM and currently lists its total value locked at around $2.8 million. The addresses identified after the exploit show activity spanning Solana and Ethereum. Defimon linked the Solana address 7fTe9pvrwXJRBHq9MaSyVPR4PgEuhqLiA93Dxf4gRk7J and Ethereum address 0x2Dfe9e969796e2797278b02761dd9Ad6aE922746 to the attacker. Aquifer’s whitehat message was authorized through the protocol’s Solana upgrade authority and published on-chain. The project supplied separate recovery addresses for Solana and Ethereum, allowing assets associated with the attack to be returned on either network. Public information has not yet established exactly how the wallets were compromised. No technical post-mortem has been released explaining whether private keys, administrator credentials or another part of Aquifer’s operational infrastructure was exposed. Available information similarly does not establish that Aquifer’s smart contract code was exploited. The use of addresses across Ethereum and Solana provides a trail for investigators tracking the assets, but does not by itself identify how access to the affected funds was obtained.