Is Raydium safe to connect?
Swap service · Solana, SPL and Token-2022 tokens (AMM v4, CPMM and CLMM pools), LaunchLab bonding-curve token launches, Perps UI powered by Orderly Network (not a Raydium on-chain product). Checked 2026-10-28; every line links its source.
Worst case: You keep your own keys, so a leaked seed phrase, a fake raydium.io clone (some show up above the real site in search ads) or one malicious signature can empty your wallet, and Solana transactions are final. Money in Raydium pools depends on its programs and admin keys: a stolen admin key drained about $4.4M in Dec 2022, a retired program lost $1.34M in Jun 2026, and a 3-of-4 multisig can replace program code after a 24-hour delay.
Safe setup in 3 steps
- Open Raydium only from a bookmark of raydium.io, which Raydium says is its only domain; check the address bar character by character, and ignore DMs, because Raydium never messages you first and support never asks for your seed phrase
- Use a wallet that simulates transactions and read every signing prompt: reject unexpected transfers, unfamiliar programs or NFT transfers (CLMM positions are NFTs), and paste token mint addresses instead of typing tickers; check mint and freeze authority and Token-2022 transfer hooks before you buy or add liquidity
- For more than about $1,000, use a hardware wallet and a separate browser profile, as Raydium's docs advise, and revoke SPL token delegates you don't recognize in your wallet's connected-apps view (revoke.cash does not cover Solana)
What it can do with your money
| Who holds the keys | You hold the keys Raydium describes itself as 'permissionless, non-custodial smart contracts': you trade from your own Solana wallet with no signup and no KYC on Raydium itself. Liquidity you add sits in Raydium's on-chain pools. Every program (AMM v4, CPMM, CLMM, LaunchLab) can be upgraded by a Squads 3/4 multisig with a 24-hour timelock, which can deploy any new code. A separate Treasury 3/5 multisig with no timelock can toggle pool status and change fees on existing pools. source |
|---|---|
| Can funds be sent out to any address? | Yes. You sign every swap and transfer from your own wallet. Raydium says it can't reverse transactions: 'If you sent funds to the wrong address, they're gone unless the recipient voluntarily returns them.' source |
| Can it hold or freeze your funds? | There are no accounts to freeze, but Raydium's Treasury multisig can toggle a pool's status, and the upgrade multisig can change program code after a 24-hour delay. Raydium lets anyone create pools; Token-2022 tokens with transfer hooks (which can be upgraded after listing and can block withdrawals) are allowed but tagged. LaunchLab 'does not intervene in launches that fail to reach graduation'. source source source |
Official links
- Website:
raydium.io - X:
@Raydium - GitHub:
github.com/raydium-io
Where we confirmed these
Known fakes
Incidents
| Date | What happened | Amount | Outcome | Source |
|---|---|---|---|---|
| 2026-06-10 | Raydium's legacy AMM V3 program, phased out in 2021 and not reachable from Raydium's app, was drained of about 150,000 RAY, 5,600 SOL and 900,000 USDC from five old pools. Raydium said the cause was insufficient validation of LP mints, which let the attacker bypass proportion checks, not a key compromise. The attacker bridged funds to Ethereum and through Tornado Cash (The Defiant). | ~$1.34M | Raydium said no current users were affected, current programs are under a separate security review, and its treasury will fully reimburse affected LPs. We found no report confirming the payouts. | source |
| 2022-12-16 | An attacker took over the AMM v4 pool owner (admin) key and used it to withdraw funds from eight constant-product pools. Raydium said a trojan on the machine holding the key was the likely cause, not a smart-contract bug. CertiK put the loss at about $5.5M. | ~$4.4M (Raydium's post-mortem estimate) | Raydium moved all authority roles to a Squads multisig. LPs were compensated through a Claim Portal (open 2023-01-05 to 2023-04-17), using protocol fees earmarked for RAY buybacks plus team RAY (2,737,521.92 RAY allocated): RAY pairs got 100% of lost principal; other pools got 90% in the original tokens and the rest in RAY plus 20%. | source source |