Wu said that Pump Science tweeted that due to an oversight in their GitHub repository, the wallet: T5j2UB...jjb8sc was attacked, and the attacker found the private key in the website's source code; this private key was initially used in GitHub for testing purposes and was deemed unimportant by the development team; however, this wallet was actually marked on Pump Fun as the off-chain token creator for URO and RIF, and the attacker might exploit Pump Fun's pscience account: T5j2UB...jjb8sc to issue more tokens.
Pump Fun co-founder Alon explained why the CA deployer appears different from the actual token creator, stating that URO and RIF were created off-chain, thus it was created for free, meaning that the first buyer is technically the on-chain creator of its deployment, namely the address: BLDRZQ...36KtuZ, which is the wallet that first purchased URO and RIF, as shown on the Solscan block explorer as the token deployer.