Solana wallet provider Solflare has imposed emergency security controls across its infrastructure and development operations after a third-party staking provider suffered a security incident affecting keys tied to its Solana validator. Co-founder Vidor said on November 2 that the team had entered bunker mode, requiring multiple approvals for any code or infrastructure changes and temporarily pausing new additions. He acknowledged the measures would slow development but said that was acceptable given the recent wave of industry attacks.
The wallet first disclosed the validator issue on October 27, after the unidentified staking provider reported compromised operational keys. The affected validator stopped voting and stopped producing staking rewards, impacting approximately 1.56 million delegated SOL worth roughly $160 million at the time. Solflare stressed that user funds remained safe because delegated SOL stays in individual stake accounts controlled by holders' private keys, and validator keys do not allow operators to transfer customer principal.
A separate investigation by blockchain analytics firm Bitquery, published on October 29, found an attacker had obtained keys associated with five Solana validators, including infrastructure linked to Solflare and Blockdaemon. The attacker moved about 1,343 SOL, valued near $135,000, from validator-controlled accounts and later routed funds through cross-chain services, with roughly 57 ETH deposited into Tornado Cash. No customer stake accounts were drained, according to the analysis.
Solflare has since activated a replacement validator and extended its migration deadline to November 30. The company said it will cover staking rewards missed between October 26 and November 1 for users who complete the migration through the official Solflare app. It also warned customers that migration will only occur inside the application and that the team will never send direct messages or links. The incident follows broader security concerns in crypto, including a recent Binance breach affecting approximately $6.3 billion in cryptocurrency assets, unauthorized access to Keystone wallet customer records, and a temporary withdrawal suspension by Brazilian exchange Mercado Bitcoin after unauthorized activity.
