Pump.fun reports a $2 million exploit by a former employee using a "bonding curve" attack, impacting users and pausing trading temporarily.