Lukey, the crypto commentator posting as @VERYKOOLLUKEY, challenged Pumpfun's move away from external-wallet sign-ins in a November 2 post, arguing that email and social accounts create addit
Lukey, the crypto commentator posting as @VERYKOOLLUKEY, challenged Pumpfun's move away from external-wallet sign-ins in a November 2 post, arguing that email and social accounts create additional security concerns. Pumpfun's own migration notice confirms that external-wallet login on the web will end on November 30, 2026, at 15:00 UTC.
The change replaces wallet-based sign-in with email, Google, Apple or GitHub authentication. Pump says its mobile app already uses that approach and that a single login will cover both products.
Lukey asked the team to explain the decision and argued that properly managed self-custody offers stronger protection than relying on an email or social account. His post presents that as a security judgment; it does not document a breach.
Why are you removing web3 login
— LUKEY (@VERYKOOLLUKEY) November 2, 2026
The consequential detail is in Pumpfun's migration instructions. Retaining an existing wallet address under the new login system involves linking an email or social account and importing that wallet's private key. Pump says the key is encrypted in the browser and held end-to-end encrypted by its login provider, Privy.
Privy's import architecture documentation describes encrypted transmission into trusted execution environments. That explains the provider's stated handling of imported keys; it is not a comparative test of the security claims in Lukey's post.
For Ledger, multisig and other wallets whose keys cannot be exported, Pump lists starting with a new Pump wallet as the alternative. Its notice says history remains attached to the old address in that case.
Pump says the sign-in change does not itself alter existing positions, callouts, followers or usernames. Mobile-app access, API sessions and trading are listed as unaffected. Users with an existing wallet session after the deadline will be prompted to add a login, rather than having their account deleted.
The dispute centers on access and recovery: how much control users retain over authentication, and what importing an existing key means for their security setup. The confirmed news is the November 30 web-login change; Lukey's broader claim that it makes accounts easier to compromise remains his assessment.
