# Is Raydium safe? Check before you connect

> Raydium: worst case for your money, official links, freeze and key risks, incidents and a 3-step safe setup. Sourced, checked 2026-10-28.

Canonical: https://tradingagentstack.com/check/raydium/

1. [Home](https://tradingagentstack.com/)

2. [Check](https://tradingagentstack.com/check/)

3. Raydium

# Is Raydium safe to connect?

Swap service · Solana, SPL and Token-2022 tokens (AMM v4, CPMM and CLMM pools), LaunchLab bonding-curve token launches, Perps UI powered by Orderly Network (not a Raydium on-chain product). Checked 2026-10-28; every line links its source.

**Worst case:** You keep your own keys, so a leaked seed phrase, a fake raydium.io clone (some show up above the real site in search ads) or one malicious signature can empty your wallet, and Solana transactions are final. Money in Raydium pools depends on its programs and admin keys: a stolen admin key drained about $4.4M in Dec 2022, a retired program lost $1.34M in Jun 2026, and a 3-of-4 multisig can replace program code after a 24-hour delay.

Already lost funds? [What to do if a bot or wallet is drained](https://tradingagentstack.com/trading-bot-drained-what-to-do/).

## Safe setup in 3 steps

1. Open Raydium only from a bookmark of raydium.io, which Raydium says is its only domain; check the address bar character by character, and ignore DMs, because Raydium never messages you first and support never asks for your seed phrase

2. Use a wallet that simulates transactions and read every signing prompt: reject unexpected transfers, unfamiliar programs or NFT transfers (CLMM positions are NFTs), and paste token mint addresses instead of typing tickers; check mint and freeze authority and Token-2022 transfer hooks before you buy or add liquidity

3. For more than about $1,000, use a hardware wallet and a separate browser profile, as Raydium's docs advise, and revoke SPL token delegates you don't recognize in your wallet's connected-apps view (revoke.cash does not cover Solana)

## What it can do with your money

| Who holds the keys | You hold the keys Raydium describes itself as 'permissionless, non-custodial smart contracts': you trade from your own Solana wallet with no signup and no KYC on Raydium itself. Liquidity you add sits in Raydium's on-chain pools. Every program (AMM v4, CPMM, CLMM, LaunchLab) can be upgraded by a Squads 3/4 multisig with a 24-hour timelock, which can deploy any new code. A separate Treasury 3/5 multisig with no timelock can toggle pool status and change fees on existing pools. [source](https://docs.raydium.io/security/admin-and-multisig.md) |
| --- | --- |
| Can funds be sent out to any address? | Yes. You sign every swap and transfer from your own wallet. Raydium says it can't reverse transactions: 'If you sent funds to the wrong address, they're gone unless the recipient voluntarily returns them.' [source](https://docs.raydium.io/getting-started/faq) |
| Can it hold or freeze your funds? | There are no accounts to freeze, but Raydium's Treasury multisig can toggle a pool's status, and the upgrade multisig can change program code after a 24-hour delay. Raydium lets anyone create pools; Token-2022 tokens with transfer hooks (which can be upgraded after listing and can block withdrawals) are allowed but tagged. LaunchLab 'does not intervene in launches that fail to reach graduation'. [source](https://docs.raydium.io/security/admin-and-multisig.md) [source](https://docs.raydium.io/security/attack-vectors) [source](https://docs.raydium.io/user-flows/creating-a-launchlab-token) |

## Official links

**Not fully confirmed.** Some of these links were confirmed in only one place, so treat them with care.

- Website: `raydium.io`

- X: `@Raydium`

- GitHub: `github.com/raydium-io`

Where we confirmed these
- https://docs.raydium.io/getting-started/trust-and-safety (vendor docs: raydium.io is 'Raydium's only domain'; Raydium does not DM users first; docs at docs.raydium.io)

- https://docs.raydium.io/introduction/what-is-raydium.md (vendor docs: official web app https://raydium.io, API https://api-v3.raydium.io, docs https://docs.raydium.io)

- https://docs.raydium.io/resources.md (vendor docs: GitHub organization https://github.com/raydium-io 'containing every Raydium repository', Discord https://discord.gg/raydium, bug bounty https://immunefi.com/bug-bounty/raydium/information/)

- https://github.com/raydium-io (GitHub org 'Raydium Protocol': website https://raydium.io/, X link twitter.com/Raydium, email connect@raydium.io, 30 repositories incl. raydium-clmm, raydium-amm, raydium-sdk-V2, raydium-cp-swap updated Sep 2026; no verified-domain badge shown)

- https://immunefi.com/bug-bounty/raydium/information/ (bug bounty platform: website https://raydium.io/, max bounty $505,000, live since 2023-04-25, updated 2026-07-09)

- https://defillama.com/protocol/raydium (third-party: website https://raydium.io, X https://x.com/RaydiumProtocol; hacks list 2022-12-16 $4.4m and 2026-06-10 $1.34m)

- https://coinmarketcap.com/it/exchanges/raydium (third-party: website https://raydium.io/, twitter.com/RaydiumProtocol, Telegram t.me/raydiumprotocol, blog raydium.medium.com)

- https://kucoin.com/announcement/en-raydium-ray-gets-listed-on-kucoin (exchange listing, 2024-01-04: website https://raydium.io/, twitter.com/RaydiumProtocol, RAY mint 4k3Dyjzvzp8eMZWUXbBCjEvwSkkk59S5iCNLY3QrkX6R)

- https://blockchain.news/flashnews/Raydium (news: cites 'Raydium on X' at https://x.com/Raydium/status/1992760782065725693, entry dated 2025-11-24)

### Known fakes

- `raydium-usa.xyz` · [source](https://trojan-killer.net/raydium-airdrop-scam)

- `raydium-airdrop.com` · [source](https://trojan-killer.net/raydium-airdrop-scam)

- `raydium-rewards.net` · [source](https://trojan-killer.net/raydium-airdrop-scam)

## Incidents

Items marked "reported by users" are claims we could not confirm with the vendor or a security firm.

| Date | What happened | Amount | Outcome | Source |
| --- | --- | --- | --- | --- |
| 2026-06-10 | Raydium's legacy AMM V3 program, phased out in 2021 and not reachable from Raydium's app, was drained of about 150,000 RAY, 5,600 SOL and 900,000 USDC from five old pools. Raydium said the cause was insufficient validation of LP mints, which let the attacker bypass proportion checks, not a key compromise. The attacker bridged funds to Ethereum and through Tornado Cash (The Defiant). | ~$1.34M | Raydium said no current users were affected, current programs are under a separate security review, and its treasury will fully reimburse affected LPs. We found no report confirming the payouts. | [source](https://theblock.co/post/404304/raydium-dex-1-34-million-exploit-retired-amm-program-treasury-cover-losses) |
| 2022-12-16 | An attacker took over the AMM v4 pool owner (admin) key and used it to withdraw funds from eight constant-product pools. Raydium said a trojan on the machine holding the key was the likely cause, not a smart-contract bug. CertiK put the loss at about $5.5M. | ~$4.4M (Raydium's post-mortem estimate) | Raydium moved all authority roles to a Squads multisig. LPs were compensated through a Claim Portal (open 2023-01-05 to 2023-04-17), using protocol fees earmarked for RAY buybacks plus team RAY (2,737,521.92 RAY allocated): RAY pairs got 100% of lost principal; other pools got 90% in the original tokens and the rest in RAY plus 20%. | [source](https://www.theblock.co/post/195712/solana-based-exchange-raydium-suffers-2-million-exploit) [source](https://docs.raydium.io/raydium/updates/archive/transparency-on-exploit-compensation-funds) |

## Check a link

Got a link, @handle or repo that claims to be Raydium? Paste it to see if it's on the official list.

Checking links inside Telegram? Send them to [@TASCheckBot](https://t.me/TASCheckBot), or add it to your group so anyone can type `/check`. Alerts on new drains and fakes: [@tradingAgentStk](https://x.com/tradingAgentStk).

## Get an alert for Raydium

We email you if we add an incident, a freeze report, a known fake or a deadline for Raydium. Free; unsubscribe anytime.

## More checks: Swap services
[ChangeNOW](https://tradingagentstack.com/check/changenow/)[SideShift.ai](https://tradingagentstack.com/check/sideshift-ai/)[FixedFloat](https://tradingagentstack.com/check/fixedfloat/)[NEAR Intents](https://tradingagentstack.com/check/near-intents/)[Trocador](https://tradingagentstack.com/check/trocador/)[Exolix](https://tradingagentstack.com/check/exolix/)[StealthEX](https://tradingagentstack.com/check/stealthex/)[LetsExchange](https://tradingagentstack.com/check/letsexchange/)[Houdini Swap](https://tradingagentstack.com/check/houdini-swap/)[THORChain](https://tradingagentstack.com/check/thorchain/)

Something wrong or out of date? [Send a correction](https://tradingagentstack.com/submit/) with a link to the vendor's docs. Not financial advice. [How we check](https://tradingagentstack.com/check/#method).

## For agents

- [When to use this site, and the page index](https://tradingagentstack.com/llms.txt)
- [Sitemap](https://tradingagentstack.com/sitemap.xml)
- [Contact](https://tradingagentstack.com/contact/)
- [MCP server](https://tradingagentstack.com/mcp/)
- [MCP discovery](https://tradingagentstack.com/.well-known/mcp)