On December 16, 2022, Raydium AMM private keys were compromised by trojan malware; attacker gained admin access and modified SyncNeedTake pool parameters to extract $4.4M without burning LP tokens. Raydium patched within 4 hours and recovered governance.