Solana Network Was Not Breached, Slope Wallet Blamed

Solana developers are distancing the protocol from a series of hacks that resulted in nearly 8,000 Solana wallets suddenly being emptied of their contents in the last 24 hours.

Solana Status, the blockchain’s hub for data and system performance, said “there is no evidence that the Solana protocol or its cryptography was compromised.” 

What exactly caused the hack, then, is up in the air, but it appears to have originated from a vulnerability in Solana hot wallets and assorted third-party extensions. The breach impacted millions of dollars of the blockchain’s native token, SOL, non-fungible tokens (NFTs) and Solana-based tokens, including the stablecoin USDC.

The breach appears to have affected addresses that “were at one point created, imported, or used in Slope [Finance] mobile wallet applications,” according to Solana Status.

That would isolate the incident to Slope accounts, and to an exploit in “private key information” that was “transmitted to an application monitoring service” or third party. 

As such, seed phrases that Slope had access to could have exposed wallets to the unidentified hackers.

That appears to be why many Phantom wallets were also compromised, likely “due to complications related to importing accounts to and from a Slope wallet,” Phantom tweeted. 

Phantom also encouraged users to create a new non-Slope wallet with a fresh seed phrase to move their assets to, in response to a statement published by Slope.

Slope recommended users create a new wallet on its network with a corresponding, unique seed phrase, and transfer any assets to this new wallet. It also reiterated its commitment to “identify and rectify” the issue, but it has not “fully confirmed the nature of the breach.” 

Consensus points to Slope being able to store users’ encrypted private keys and seed phrases, decipher them as plain text and transfer them to their own centralized servers, as suggested by developer 0xfoobar.

Arthur Breitman, co-founder of Tezos, told Blockworks he believes there will likely be a bailout from venture capital firms and other asset managers, “even though this opens them up to unverifiable fraudulent claims.”

Anatoly Yakovenko, Solana Labs co-founder, tweeted that users ought to “order a ledger, setup a cold wallet!” 

---

Get the news in your inbox. Explore Blockworks newsletters:

• The Breakdown: Decoding crypto and the markets. Daily.
• 0xResearch: Alpha in your inbox. Think like an analyst.