No Orca or Whirlpools exploit recorded in DefiLlama's hacks database (1,315 entries) as of Oct 23, 2026
—outcome unclear- Outcome
- No known incident (absence of reports, not proof of safety)
- Loss
- —
- Recovered or reimbursed
- —
Orca is a decentralized exchange on Solana. Traders swap tokens at orca.so against liquidity pools, and liquidity providers (LPs) earn trading fees 3. Its pools run on Whirlpools, Orca's open-source concentrated-liquidity program. In a concentrated-liquidity pool, LPs choose the price range where their capital works 23.
Orca launched in February 2021 and is governed by holders of the ORCA token 611. In October 2026 it announced a merger with Solana lender Loopscale. The combined team is called Formation, and both apps keep running 78.
Founding. Grace "Ori" Kwan and Yutaro Mori founded Orca. It launched on Solana in February 2021. Orca's first outside funding was an $18 million Series A, structured as a sale of ORCA tokens from its treasury, in September 2021. Three Arrows Capital, Polychain and Placeholder co-led the round 11.
Governance. The terms describe the protocol as managed by ORCA holders. ORCA holders can submit and vote on proposals, and approved proposals are carried out by the team or a DAO Council 69. The orca.so Terms of Use name only "Orca" as the site provider. They apply Cayman Islands law with individual arbitration 9.
Formation merger. On October 7, 2026, Orca and Loopscale announced they were combining as Formation 8. The leadership team 7:
What Orca says changes and stays the same 78:
In a classic AMM, liquidity is spread across every possible price. In a Whirlpool, each LP picks a price range. The position earns fees only while the market price is inside that range 23. Capital is used more efficiently, but the position needs more attention. If the price leaves your range, the position stops earning and sits entirely in one of the two tokens.
Orca offers two kinds of pool 3:
Swapping:
Orca can route a trade through several pools, for example SOL → USDT → ETH. Each pool on the route charges its own fee 1.
Providing liquidity: choose a pool and price range, then deposit both tokens. Pool creators can also lock liquidity, which is common for new token launches 3. Developers can build on Orca through TypeScript and Rust SDKs and a REST API 3.
Each pool has a fee tier chosen by its creator, from 0.01% for pegged stablecoin pairs up to 2% for volatile pairs 13. The fee is taken from the token you sell 1. In Adaptive Fee pools the tier is a floor, and the fee can rise when the market is volatile 1.
Every fee is split as follows 1:
| Recipient | Share of fee |
|---|---|
| Liquidity providers | 87% |
| Protocol Treasury | 12% |
| Climate Fund | 1% |
The Treasury's 12% is divided again:
Solana network fees are separate and small, around 0.000005–0.00001 SOL per standard transaction 3. On a 0.3% pool, for example, a $1,000 swap pays about $3 in pool fees: about $2.61 to LPs, $0.36 to the Treasury and $0.03 to the Climate Fund 1.
ORCA is used for governance 6. Staking ORCA at orca.so/stake gives you xORCA. Orca uses 40% of protocol fees to buy ORCA and adds it to the staking vault, so each xORCA redeems for more ORCA over time. The amount of xORCA you hold stays the same, and xORCA can be traded 5. These rewards depend on trading volume and are not fixed. After the merger, Orca says ORCA represents the combined Formation products 7.
You need only a Solana wallet; there is no account or KYC. Users must be 18 or older and not on a sanctions list 9.
The orca.so interface is blocked in a published list of countries, including Cuba, Iran, North Korea, Syria, Venezuela and Belarus. It is also blocked in the Crimea, Donetsk and Luhansk regions 4. The United States is not on the list as of October 23, 2026 4. Orca also screens wallet addresses. If your region becomes blocked, you can still close positions and withdraw 4.
Whirlpools has been audited several times 10:
| Date | Auditor |
|---|---|
| January 2022 | Kudelski Security |
| May 2022 | Neodyme |
| August 2024 | OtterSec |
| February, June and August 2025 | Sec3 |
The program is open source and its on-chain build can be checked against that code 310. Orca runs a bug bounty 7. DefiLlama's hacks database lists no Orca exploit 12.
Audits reduce but do not remove smart-contract risk. The program remains upgradeable under a multisig, and Orca says that setup did not change with the merger 7. Other risks to understand:
For comparison with other DEX designs, see Raydium on Solana and Uniswap on Ethereum, or the DEX ratings.
Hacks in DefiLlama’s public database are also scored as the security record on the Orca rating page.
DeFiWhat Is a DEX and How Does It Work?A DEX is a decentralized exchange that lets you swap tokens directly from your own wallet using smart contracts, with no company holding your funds.6 min read·
DeFiAutomated Market Makers (AMMs), ExplainedAn AMM is a smart contract that prices and settles token swaps against a pooled reserve using a formula, replacing the traditional order book.6 min read·
ExchangesCEX vs DEX: Which Should You Use?CEX vs DEX comes down to custody, convenience and control. Compare how centralized and decentralized exchanges work so you can pick the right one.5 min read·
TechnologyUnderstanding gas fees on EthereumA guide to how Ethereum gas fees work, why they change, and practical ways to pay less when you transact on-chain.8 min read·
RegulationBitcoin ETF Outflows Weigh on Market as Interactive Brokers Launches Ethereum StakingSpot Bitcoin ETFs recorded $65.4 million in net outflows as hawkish Federal Reserve comments pressured prices. Meanwhile, Interactive Brokers rolled out Ethereum staking for eligible US clients.4 min read·
MarketsCFTC Opens Retail Crypto Leverage Rulemaking as Bitcoin Holds Near $84KThe CFTC has begun a rulemaking on leveraged retail crypto trading, while Bitcoin hovers near $84,000 and traders wait for U.S. inflation data and the Fed’s October meeting.4 min read·
MarketsUS Moves $1B in Seized Bitcoin as Senate Scrutiny of Tether GrowsU.S.-linked wallets shifted 12,267 BTC from a Bitfinex hack seizure address without any exchange deposit, while Senator Richard Blumenthal pressed Cantor Fitzgerald over its Tether partnership.3 min read·Related: Raydium · Phantom · Uniswap · All company profiles