Raydium (RAY): the Solana AMM, its LaunchLab, the RAY buyback and two exploits

What is Raydium? It is an automated market maker on Solana, running since February 2021, where anyone can swap tokens, add liquidity or open a new pool without asking permission. As of 24 October 2026 it runs three pool programs (AMM v4, CPMM and CLMM), a bonding-curve launchpad called LaunchLab and a perpetual futures venue operated by Orderly Network. DefiLlama put the value locked in its pools at about $1.14 billion at 17:00 UTC that day.

Its token, RAY, has a fixed maximum of 555 million units. Twelve percent of every pool trading fee buys RAY on the market, and the tokens bought sit at a public address instead of being burned.

Two exploits mark the record. In December 2022 an attacker used a stolen admin key; in June 2026 another drained a program that Raydium says it retired in 2021. And in October 2026 a data firm tied more than a fifth of one month of Raydium CLMM volume to a single wash-trading wallet, which changes how its headline numbers should be read.

What is Raydium: one exchange, three pool programs

There is no order book behind the swaps. Prices come from pools that each hold two tokens: a trade puts one token in and takes the other out, and the ratio between the two reserves sets the price. Our glossary entry on how a liquidity pool works covers the mechanism from scratch. Raydium runs three generations of that idea side by side.

AMM v4, the 2021 original

The first program, AMM v4, went live in February 2021 as a constant-product pool that also placed orders on Serum, then the main order book on Solana, and later on OpenBook, the community fork that took over after FTX collapsed. Every trade pays 0.25%. Liquidity providers keep 88% of that fee and the other 12% funds RAY buybacks. Opening a pool costs a 0.15 SOL creation fee plus about 0.15 SOL of account rent, according to Raydium’s fee comparison page.

The order-book link is gone now. A program change dated 22 July 2026 removed what Raydium’s changelog calls a long-dormant OpenBook and Serum dependency, along with the unused market-making instructions. Swaps, deposits and withdrawals keep their existing layouts, and integrators were told to move to the new swap entry points. Halborn reviewed the change in late June 2026. Raydium steers new pools to CPMM.

CPMM, the default for new tokens

CPMM keeps the constant-product formula, drops the order-book code and supports Token-2022, Solana’s newer token standard. Whoever creates the pool picks a fee tier between 0.005% and 4%, with 0.25% as the default. The split shifts a little: 84% to liquidity providers, 12% to RAY buybacks and 4% to the treasury. Raydium’s history page dates the mainnet launch to June 2024.

CLMM, concentrated liquidity

CLMM follows the Uniswap v3 design. Each provider chooses the price range where its capital works and receives an NFT that stands for the position. Fee tiers run from 0.01% to 4%, again 0.25% by default, with the same 84/12/4 split. A concentrated position earns more fees per dollar while the price stays inside its range, and suffers more impermanent loss when the price leaves it.

An update shipped on 18 May 2026 added limit orders, fee collection in a single token and a dynamic fee that moves with volatility. Sec3 had reviewed it in a report dated 21 April 2026.

All three programs are permissionless. Any wallet can open a pool for any pair, which is how a genuine new token finds a market within minutes, and also how copycat tokens with borrowed tickers get one. Raydium’s API tags some pools as scam or honeypot and its interface flags risky token features such as transfer fees or a freeze authority. Whether a token deserves trust is left to the user.

Raydium LaunchLab and the split with Pump.fun

For years Raydium was where Solana memecoins landed. Tokens launched on Pump.fun graduated into Raydium pools once their bonding curve filled, paying a 6 SOL migration charge on the way. That flow stopped on 20 March 2025, when Pump.fun began sending graduating tokens to its own exchange, PumpSwap; our Pump.fun project page covers that side of the split.

Raydium’s answer was LaunchLab. Decrypt reported it live on 16 April 2025, two weeks after an earlier 2 April target that slipped while Raydium lined up support from trading front-ends BullX and Jupiter. Halborn’s audit of the launchpad ran from 7 to 30 April 2025. Raydium’s own history page says August 2024, a date that matches neither the press nor the audit, so this page uses April 2025.

The mechanics follow the bonding-curve model. Buyers send SOL, USDC or RAY to a curve and receive the new token at a price that climbs as supply is sold. When the curve reaches its threshold the token graduates: it moves into a CPMM pool, the pool’s liquidity tokens are burned or locked and the mint authority is revoked. Since 17 August 2026 every new LaunchLab launch has to graduate into CPMM.

Trading on the curve costs 1%. Who gets that 1% is less clear. Raydium’s fee comparison page splits it evenly between the pool seed and a LaunchLab treasury, while press reports and DefiLlama describe other splits that include a RAY buyback share. The answer depends on each launch’s configuration. After graduation the ordinary CPMM rules apply.

LaunchLab also works as a back end for other launchpads. Outside platforms run their own front-ends on it and can add their own fee, capped at 500 basis points (5%) since 26 August 2026. LetsBonk, tied to the BONK community, was the first big one. Decrypt reported on 7 July 2025, citing Dune data, that LetsBonk had created 19,620 tokens in 24 hours against 9,249 on Pump.fun. The lead did not last: on 6 August The Block, also citing Dune, had Pump.fun back ahead, 13,690 launches to 13,392.

The next wave came from StonkFun, a launchpad that lets creators price tokens against assets such as tokenized stocks. It moved new deployments to LaunchLab on 5 September 2026, The Block reported. DefiLlama’s monthly Raydium volume jumped from $3.82 billion in August to $9.56 billion in September.

Where Raydium fees go: the 12% RAY buyback

Raydium’s buyback documentation and fee pages give the split by pool type. The percentages apply to the trading fee, not to the size of the trade.

Pool type	Fee tiers	Default	Liquidity providers	RAY buyback	Treasury
AMM v4	0.25% only	0.25%	88%	12%	none
CPMM	0.005% to 4%	0.25%	84%	12%	4%
CLMM	0.01% to 4%	0.25%	84%	12%	4%
LaunchLab curve	1%	1%	varies by launch	varies by launch	varies by launch

Source: Raydium docs, read on 24 October 2026. On a 0.25% pool the buyback share comes to 0.03% of volume: a 1,000 USDC swap pays 2.50 USDC in fees, of which 0.30 USDC goes to buybacks.

The fee comparison page labels the 12% share “protocol”. The buyback page and DefiLlama both describe it as buyback money, and so did Raydium’s 2022 post-mortem, which said the fee-collection instruction gathers “protocol fees for RAY buybacks”.

The bought-back RAY is not burned. Raydium says it is held by the protocol at a public address, DdHDoz94o2WJmD9myRobHCwtx1bESpHTd4SSPe6VEZaz, which anyone can open in a Solana explorer. DefiLlama’s LaunchLab notes speak of buying back and burning; Raydium’s docs do not. A query to a public Solana node at 18:47 UTC on 24 October 2026 returned 88,060,077 RAY across six token accounts at that address, close to 15.9% of the maximum supply.

In dollars, DefiLlama records $66.8 million of buybacks since it began tracking them, $18.2 million over the past twelve months and $2.1 million in the 30 days to 23 October 2026. That last figure is about one tenth of the $21.1 million traders paid in fees over the same 30 days.

The RAY token: supply, allocation and a MiCA white paper

RAY lives at the mint address 4k3Dyjzvzp8eMZWUXbBCjEvwSkkk59S5iCNLY3QrkX6R, with six decimals and the mint authority disabled, so no new RAY can be created. Raydium’s docs warn that anyone can copy a ticker, name or logo, so the address is the thing to check. The maximum supply is 555 million. Total supply on-chain at 18:47 UTC on 24 October 2026 was 554,997,361 RAY, which means roughly 2,639 RAY were burned at some point; no document explains when or why.

The docs and the white paper agree on the allocation:

Allocation	Share	RAY
Mining reserve	34%	188,700,000
Partnership and ecosystem	30%	166,500,000
Team	20%	111,000,000
Liquidity	8%	44,400,000
Community and seed	6%	33,300,000
Advisors	2%	11,100,000

Team and seed tokens were locked for 12 months after launch and then released daily; that vesting ended on 21 February 2024. The mining reserve pays out about 1.9 million RAY a year through farms and staking. Raydium does not publish how much of the reserve is left.

RAY is not needed to swap, add liquidity, create a pool or trade perpetuals. It is a pool asset, it can be staked in the app for rewards in RAY at rates that depend on the programme, and it is what the buybacks buy.

In 2026 RAY gained a document few DeFi tokens have: a white paper under MiCA, the EU regulation on crypto-assets, notified on 4 June and published on 2 July 2026. The offeror is the Raydium Foundation, registered on 10 December 2024 at an address in the Cayman Islands, with Ireland as its home member state. As MiCA requires, the paper says no competent authority in the EU has approved it. It describes an admission to trading rather than a sale, gives 268,896,285 RAY in circulation on 4 February 2026 and names Kraken as a trading platform. The rules bind the token’s offeror and the platforms that list it, not an open pool program; our guide to the MiCA regulation explains who is covered.

Raydium history: key dates from 2021 to 2026

Date	Event
February 2021	AMM v4 and the RAY token launch, with pools linked to the Serum order book
August 2022	CLMM reaches mainnet (Raydium history page)
14 December 2022	After the FTX collapse, Raydium’s trading page drops Serum; swaps, pools and farms keep running
16 December 2022	Admin-key exploit, about $4.4 million according to Raydium
4 January 2023	Compensation plan published; claims close on 14 May 2023
25 April 2023	Bug bounty opens on Immunefi
June 2024	CPMM reaches mainnet (Raydium history page)
January 2025	Perpetuals launch with Orderly Network; DefiLlama records a daily volume high of $13.19 billion on 18 January
20 March 2025	Pump.fun sends graduating tokens to PumpSwap instead of Raydium
16 April 2025	LaunchLab goes live
10 June 2026	Exploit of the retired legacy AMM V3 program, about $1.34 million
22 July 2026	AMM v4 drops its OpenBook and Serum dependency
5 September 2026	StonkFun moves new launches to LaunchLab
21 October 2026	Bitquery publishes its wash-trading study of Raydium CLMM

Was Raydium hacked? The 2022 admin key and the 2026 legacy program

December 2022: a stolen pool-owner key, about $4.4 million

From 10:12 UTC on 16 December 2022 an attacker used the pool owner account of AMM v4, in effect its admin key, according to Raydium’s post-mortem of the next day. The key sat on a virtual machine; Raydium never established how it was taken and named a trojan as one possibility. No program bug was involved, and Raydium’s current docs file it as a key-management failure from before the multisig era.

The method needed two admin instructions. The attacker raised the counters that track fees owed to the protocol, without any trading, then called the fee-withdrawal instruction again and again to empty eight constant-product pools. CLMM pools and RAY staking were not touched. A patch at 14:16 UTC the same day revoked the stolen authority, and on 17 December the remaining admin functions moved to a Squads multisig.

Raydium put the loss at about $4.4 million. CertiK estimated about $5.5 million and traced roughly $2 million over a bridge to Ethereum, then 1,774.5 ETH into Tornado Cash on 19 January 2023. Raydium offered a 10% bounty for the return of the funds.

Its compensation plan of 4 January 2023 used treasury assets to replace most of the stolen tokens, plus RAY taken from vested team reserves. Providers in the RAY pools got back all lost principal; others got 90% in the original assets and the rest in RAY with a 20% top-up, priced at its average of $0.1813 over the 30 days to 3 January 2023. Claims closed at 23:59 UTC on 14 May 2023, and unclaimed funds went back to the buyback treasury.

June 2026: a program retired in 2021, about $1.34 million

On 10 June 2026 an attacker drained five inactive pools on Raydium’s legacy AMM V3 program, phased out in 2021 and no longer reachable from Raydium’s interface, The Block reported. Early estimates put losses at about $1.34 million: roughly 150,000 RAY, 5,600 SOL and close to 900,000 USDC. In The Block’s account of Raydium’s disclosure, the program did not properly validate the liquidity-pool mints it was given, which let the attacker get round its proportion checks.

Raydium said its SDK and app “do not support mainnet interactions with legacy AMM V3 pools”, that no current user was affected, that its live programs were unaffected and that its treasury would cover all losses. Core contributor Infra confirmed the incident. PeckShield traced the funds through KuCoin, a bridge to Ethereum, Tornado Cash and FixedFloat, The Defiant reported.

Three things were still unknown on 24 October 2026: whether the compensation has been paid, whether a full post-mortem exists, and why a program retired years earlier still held funds. Raydium’s changelog has no entry on the incident, and Coindaro found no update after mid-June.

Raydium audits, multisig and bug bounty

Raydium publishes eleven audit reports in its GitHub repository, each on the auditor’s letterhead. OtterSec also lists its three on its own site.

• Kudelski Security reviewed the original AMM and the staking program in a report dated 11 May 2021.
• OtterSec dates its reports 20 June 2022 for RAY staking (one critical finding), 30 December 2022 for the CLMM and 16 February 2023 for the order-book AMM; Raydium’s own table files all three under the third quarter of 2022.
• MadShield, since renamed OShield, covered the AMM and its OpenBook migration in a report of 10 June 2023 that found no critical issue, then CPMM version 1.0.0 on 25 March 2024.
• Halborn reviewed the Burn and Earn liquidity locker in November 2024 (three informational findings), LaunchLab in April 2025 (seven findings, one critical, all addressed) and the OpenBook removal in June 2026.
• Sec3 checked a CPMM creator-fee change on 10 September 2025 and the CLMM limit-order and dynamic-fee update on 21 April 2026.

One naming trap: OtterSec titles its CLMM report “Raydium AMM V3”, the concentrated-liquidity program’s early code name. It is a different program from the legacy AMM V3 drained in June 2026, which Raydium says it retired in 2021. None of the eleven reports is described as covering that retired program, and no audit of the Orderly-run perpetuals venue was found.

Upgrades to the programs need three of four signatures on a Squads multisig, with keys on air-gapped devices held by core team members, and then wait 24 hours under a timelock. The treasury multisig needs three of five signatures and has no timelock, because routine operations have to land the same day. A bug bounty on Immunefi, live since 25 April 2023, pays 10% of the funds directly at risk for a critical bug, with a minimum of $50,000 and a ceiling of $505,000.

Who runs Raydium: pseudonymous builders and a Cayman foundation

Raydium’s builders are pseudonymous. No founder is named on raydium.io, in the docs or on GitHub, and press profiles refer to contributors only by handles. The contributor quoted in incident reports goes by Infra.

The only people named in an official document are Marc Piano and Bryce Howarth, listed in the MiCA white paper as the members of the Raydium Foundation’s management body, both as directors. The paper does not describe them as developers.

Raydium has not published a funding round. DefiLlama lists no raise and the white paper no token sale; the 6% “community and seed” line is the only trace of early backers, on terms that are not public.

How to use Raydium: a swap step by step

Raydium runs in the browser at raydium.io with a Solana wallet such as Phantom; our Phantom wallet review covers setup. The swap flow in Raydium’s docs has six steps:

1. Pick the token you pay with and the token you want, then type an amount; the other box fills from the current quote.
2. Check the token’s mint address against the project’s own site or a block explorer before going further, since tickers can be copied.
3. Review the route: which pools Raydium chose, their TVL, their fee and the price impact. The interface warns when impact passes 1%.
4. Check slippage. The default is 0.5%, or 1% on volatile pairs; too tight and the trade fails, too loose and it invites sandwich attacks.
5. Choose a priority fee (Auto by default, or Normal, Fast and Turbo), then sign in the wallet.
6. Compare the amount received with the quote once the transaction confirms, usually within 5 to 15 seconds.

Adding liquidity follows the same pattern, with one more decision on CLMM: the price range. Once the price leaves that range, the position stops earning fees.

Raydium in numbers on 24 October 2026

All figures below come from DefiLlama, read at 18:38 UTC on 24 October 2026.

Metric	Value	Period
Total value locked	$1.14 billion	24 October 2026, 17:00 UTC
RAY staked (counted apart)	$77.1 million	Same time
Trading volume	$151.2 million	23 October 2026
Trading volume	$6.20 billion	30 days to 23 October
Fees paid by traders	$21.1 million	30 days to 23 October
Revenue (treasury plus buybacks)	$3.47 million	30 days to 23 October
Of which RAY buybacks	$2.11 million	30 days to 23 October

TVL peaked at $2.97 billion on 23 January 2025 and fell to $805 million on 9 June 2026 before recovering. Monthly volume dropped from $22.8 billion in October 2025 to $2.4 billion in July 2026, the low of the series over that stretch.

Among Solana exchanges, DefiLlama ranked Raydium’s AMM pools fourth over the 30 days to 23 October, with $5.96 billion, about 9.2% of Solana DEX volume. PumpSwap, BisonFi and Orca were ahead.

Reading Raydium volume after the wash-trading finding (October 2026)

On 21 October 2026 Bitquery, a company that sells blockchain data, published an on-chain study that attributes about $1.40 billion of Raydium CLMM volume between 21 September and 20 October to one automated wallet: 22.7% of the $6.17 billion traded on CLMM in that window. The wallet traded with itself through 438 pools of copycat tokens named after XMR, XRP and other assets, with about $12,000 of working capital. Our report on the Raydium wash-trading bot sets out the method; grouping the wallets into one operation is Bitquery’s inference.

What that means for the figures above is partly open. Bitquery’s number covers CLMM only. DefiLlama’s Raydium total for the same 30 days, all products included, is $7.215 billion. If DefiLlama counts the bot’s swaps, they would make up about 19.4% of that total. Coindaro has not been able to check whether DefiLlama’s adapter includes those pools. September also had a separate driver, the StonkFun launches, and the monthly series cannot tell the two apart.

Fees are harder to fake. Each of the bot’s round trips booked about $22,200 of volume for roughly $1.13 in fees. That does not prove Raydium’s fee figures leave the bot out. It means that comparing volume with fees, and with the number of distinct traders, says more than volume alone.

Coindaro found no statement from Raydium on the study by 24 October 2026. For traders, two habits help: check the mint address, not the ticker, and check how much USDC or SOL a pool really holds.

Raydium risks and what to watch

Coindaro rates Raydium’s risk at 3 out of 5. In its favour: more than five and a half years live, eleven public audits, a timelocked multisig and buybacks anyone can check on-chain. Against: two exploits, the second without a confirmed payout, unidentified builders, copycat pools and revenue tied to launch flow Raydium does not control.

That last point has already bitten once. After Pump.fun left in March 2025, LaunchLab came to lean on outside platforms such as LetsBonk and then StonkFun. The perpetuals venue carries Raydium’s name but runs on Orderly Network’s infrastructure.

Next items to follow: a statement on the June 2026 compensation, any Raydium response to the Bitquery study, whether LaunchLab volume holds after the September wave, and the next entries in Raydium’s public changelog, where program changes appear first.