Solflare Tightens Access After Validator-Related Theft; Delegated Customer SOL Was Not Taken
Solflare says it has restricted access to its code and infrastructure following an incident involving keys associated with its Solana validator. Blockchain analytics firm Bitquery traced theft from validator-related accounts, but found no transfers from users’ stake accounts.
- Bitquery estimated that about 1, 343 SOL, worth roughly $135, 000, was involved in transfers linked to five validator teams or sets of keys.
- The affected validators continued voting until late October 27, then dropped out of Solana’s voting set, according to Bitquery.
- Solflare says users must move their stake to its replacement validator by November 30 to qualify for coverage of missed rewards.
What Happened to the Validator
On October 27, Solflare said its third-party staking provider had notified the company of a security incident “on their side.” The available information does not identify the provider or explain exactly how the keys were compromised.
Bitquery traced the first transfers to just after 7 p.m. UTC on October 26. It reported that the attacker moved assets from four active validators in about three minutes, then emptied vote accounts over the next hour and a half. The investigation also identified keys associated with Slow Ventures. Bitquery said its validator was no longer active.
The validators kept voting after the transfers began. According to Bitquery, they continued until their current epoch ended late on October 27, then fell out of the voting set. In practical terms, they were no longer eligible to take part in Solana’s validator voting process.
Bitquery says the vote accounts were emptied before an eligibility check. Its analysis found that the accounts could not meet a 1.6 SOL per-epoch payment requirement, which it says had been in effect since July. That is Bitquery’s explanation of what happened, not an established account of how the provider’s keys were compromised.
What Was Stolen, and What Was Not
Bitquery estimated that about 1, 343 SOL, worth roughly $135, 000, was linked to unauthorized transfers involving five validator teams or sets of keys. The estimate includes activity beyond the initial transfers, including later sweeps and a rescue payment. It does not represent a single transaction or provide a straightforward measure of net losses.
The difference between validator-related accounts and users’ stake accounts matters. Users delegate SOL to validators to support network operations and may earn rewards. Their stake accounts are separate from the operating keys used to run a validator.
Bitquery found no transfers from stakers’ accounts. That supports the narrower conclusion that users’ delegated SOL was not taken. It does not mean no assets were stolen.
Bitquery also reported that 637 JitoSOL associated with Solflare’s identity and that of another validator was taken. JitoSOL is a liquid-staking token. Bitquery valued the tokens at 833 SOL based on the sale price and described JitoSOL as a substantial part of Solflare’s loss. This is a separate denomination and valuation within the reported activity, not an additional amount to add to the 1, 343 SOL estimate. The available findings do not establish who beneficially owned each asset.
The four active validators Bitquery identified were Solflare, Blockdaemon, Astraeus, and a validator associated with an address beginning J21SMP. Bitquery also noted that the active validators shared a hosting network and software version. That observation does not prove shared hosting caused the incident.
Solflare’s Response and Migration Terms
In a November 2 statement attributed to co-founder Vidor, Solflare said it had restricted access to its infrastructure and code, required multiple approvals for changes, and paused new additions. Vidor acknowledged the controls would slow development, adding, “It slows us down and I’m fine with that.”
These measures may make unauthorized internal changes harder, but they do not explain or resolve the third-party provider’s security incident. Solflare’s statement does not name the provider or say how its keys were compromised.
Solflare says it has set up a replacement validator and extended the migration deadline to November 30. It also says it will cover missed staking rewards from October 26 to November 1 for users who complete the migration. The available information does not explain how the compensation will be calculated or distributed.
Solana processes staking changes through network epochs, so migrated SOL may take time to become active on the new validator and earn rewards. The incident interrupted rewards while the affected validator was out of operation. That is different from an attacker taking SOL from users’ stake accounts.
Solflare says users should migrate only through its official app and that it will not send direct messages or links. Open the app directly or verify it through Solflare’s established official channels. Never provide a recovery phrase or private key to complete a migration. Anyone asking for one is trying to gain control of the wallet.
The migration deadline, reward coverage, and app-only instructions are terms Solflare has announced. The available information does not independently establish how many users were affected, how many have migrated, or how the company will calculate individual payments.
Key Questions and Answers
-
Were users’ delegated SOL stolen?
Bitquery found no transfers from users’ stake accounts. It did trace theft from validator-related accounts, so that finding does not mean no assets were lost.
-
Why did the validators stop voting?
Bitquery says they kept voting until their epoch ended late on October 27, then fell out of the voting set because their emptied vote accounts could not meet a stated payment requirement.
-
What migration terms did Solflare announce?
Solflare says users have until November 30 to move their stake and that it will cover missed rewards from October 26 to November 1 for users who migrate. The company has not specified how it will calculate the compensation.
-
How can users avoid migration scams?
Follow instructions in Solflare’s official app or verify them through established official channels. Never share a recovery phrase or private key, and don’t trust unsolicited migration links or direct messages.
