One attacker held the keys to five Solana validators. They took $135K and sent it to Tornado Cash

01 · What happenedWhat happened to the Solflare validator

If you stake SOL through the Solflare wallet, your rewards stopped this week. Solflare says your coins are safe, and the record backs that up. Money was taken, though. It came from the people who run the service.

Solflare runs a validator, one of the computers that confirm Solana transactions and pay rewards to the people who stake with them. On 27 October, Solflare said the firm running that machine had reported a "security incident on their side". It hit the keys that firm held. A day later the on-chain researcher ama31337 showed that Solflare was not alone. Validators run by Blockdaemon, Astraeus and a fourth team had been drained by the same wallet in the same few minutes. The fourth is known only by its address, which starts J21SMP.

Bitquery traced each transfer out of those keys with its Solana data, then followed the money onto Ethereum. One person or group held the keys of all four, plus a fifth that Slow Ventures stopped running in 2024. They took 1,343 SOL worth, about $135K. Most of it was JitoSOL, a token you get for staking SOL through Jito, and the first public count put no figure on it. Within two hours almost all the money was in Tornado Cash, a mixer that hides where coins go. The same route had been tested 11 days earlier. A day after the drain the keys were still in use, and the attacker took a rescue payment five seconds after it landed.

02 · How a validator runsHow a Solana validator is run, and what its keys control

Stakers keep their SOL in a stake account that only they control, and point it at the validator they like. The validator earns rewards for doing its job, keeps a cut called the commission and passes the rest on to the people who staked with it.

Three keys do the work. The identity key is a hot key. It lives on the server, signs blocks and pays the small fees for doing so, and its account collects block rewards and tips. The vote account collects the commission. Only the withdraw key can take SOL out of it. That is why teams are told to keep that key cold, on a device that never touches the server.

Since July, a vote account has one more job. Under a rule called the Validator Admission Ticket, it pays 1.6 SOL every epoch to stay in the set of validators that vote. Solana counts time in epochs, and one now lasts about a day, since Solana blocks got faster. A vote account that cannot pay sits out the next one.

Neither of the keys the attacker held can touch a staker's account, so the stake itself was never at risk. Everything else was.

03 · Three minutesThree minutes on 26 October

Just after 7pm UTC on 26 October, Solflare's hot key sent its JitoSOL to a brand-new address, 9LsvNg…5Qr8. We call it wallet R. Each JitoSOL trades for a bit more than one SOL. Solflare's SOL came seconds later.

J21SMP's hot key went next, then Blockdaemon's, then Astraeus's. In 3 minutes the four keys handed over 1,188 SOL worth. Wallet R sold the JitoSOL for SOL on Solana's DEXs before the last of it arrived.

The vote accounts came next. Over the next hour and a half, the attacker used each team's withdraw key to empty its vote account into R. Twelve minutes after the last one, a new epoch began. That is when Solana picks who votes in the epoch after, and none of the four vote accounts could pay the ticket.

04 · One set of handsFive validators, one set of hands

Sending money to the same address is one clue. The fees say more. Each Solana transaction names a fee payer, and that key has to sign it. In the drain, keys of one validator kept paying for thefts from a second.

Blockdaemon's hot key paid the fee when Solflare's vote account was emptied. The next morning, Blockdaemon's old withdraw key paid for one more Solflare withdrawal. Astraeus's hot key paid for thefts from J21SMP, Blockdaemon and Slow Ventures. Whoever signed those held the keys of all five teams at once.

The withdraw keys go back to 2022. Solflare's and Blockdaemon's first appear on the same February day. The four active validators also share a host. All four run from TeraSwitch's network in Amsterdam and Ireland, on the same software version, 4.3.2. So does a fifth validator that later tried to help Solflare. We found no public statement from Blockdaemon or Astraeus by 29 October.

05 · What was takenWhat was taken, validator by validator

The first count on X gave a figure for the SOL, "plus JitoSOL and other tokens". The SOL figure was right. The JitoSOL was worth more. The attacker took 637 JitoSOL from Solflare's and J21SMP's identities, worth 833 SOL at the price it sold for. That is more than all the SOL taken.

Then count the later sweeps, the old Slow Ventures keys and the rescue SOL. One more wallet, used for staking, was emptied with a stolen key too. The total comes to 1,343 SOL. Solflare lost the most, nearly all of it in JitoSOL. The other tokens the attacker swept were worth about $10 in all.

06 · Into Tornado CashFrom Solana to Tornado Cash in under two hours

Wallet R moved the money on at once. Almost all of it went through Bridgers and Chainflip, two services that swap coins across chains, and each order named the same Ethereum wallet as the receiver. That wallet, 0x9bdd…4581, collected 56.6 ETH.

The first bridge payout landed at ten past seven. Less than nine minutes later the wallet made its first deposits into Tornado Cash. Tornado's pools take fixed amounts, so a deposit can later be pulled out to a fresh wallet with no visible link. Two hours after the first payout, 55.9 ETH was inside.

The money swept on the second day by a new collecting wallet went to a second Ethereum wallet, 0x0b7d…bc04, which also paid into Tornado. In all, 57.0 ETH of the 57.2 ETH that reached the two wallets went into the mixer. Both wallets now hold almost nothing.

07 · The rehearsalThe same route, 11 days earlier

The attacker had tried all of this before. On 15 October, wallet R got its first SOL from 4sbDnK…izZm, a wallet that has been active for almost two years. Half a minute later R sent that SOL to Bridgers, and the order named the same Ethereum wallet that would collect the stolen money 11 days later. The day before, the Ethereum wallet had already used Tornado Cash.

On the night of the drain, the first move came from Ethereum. About a minute before the first theft, the wallet paid $12 in ETH to MetaMask Bridge. Two seconds later the same value in SOL reached wallet R through the Mayan bridge, enough to pay its fees. Each swap and bridge order from R and the later collecting wallet paid exactly 0.875% to one fee wallet. That is the rate MetaMask charges for swaps, so the attacker most likely ran the whole thing from a MetaMask wallet.

08 · The second dayThe keys were still live the next day

Early on 27 October, before 4am UTC, the attacker moved the withdraw authority of all five vote accounts to one new key, 6sSJnc…yWyW. The withdraw authority is the setting that says which key can take SOL out, and each change needs a signature from the old withdraw key. For four of them, Blockdaemon's identity first sent the old key a little SOL to pay the fee.

Then the sweeping went on. Two new wallets took leftovers from keys of all five teams in the morning. From early afternoon a third wallet, 85LUgP…Bi5, took about 1 SOL an hour. Most of it came from Solflare's and Blockdaemon's hot keys, and it left through Chainflip.

Late that evening, someone running a different validator on the same network sent 1 SOL into Solflare's empty vote account. Five seconds later the attacker took it. A person does not react that fast, so the attacker was almost certainly watching the account with a bot that grabbed anything new as soon as it landed. The last theft we saw came more than a day after the first.

On the morning of 28 October, the attacker's key moved each withdraw authority again, this time to five fresh keys, one per vote account. The thread reported this as a move to new per-validator keys. Only the holder of 6sSJnc…yWyW could sign it, and the five new keys have done nothing else. So nothing on-chain shows that the teams are back in control.

09 · Why they stoppedWhy the validators stopped voting

A validator earns nothing while it is out of the voting set. All four left it at the same moment, when an epoch ended late on 27 October.

The ticket explains it. Solana picks each epoch's voting set at the start of the epoch before, and charges each member 1.6 SOL then. That check ran at 20:58 UTC on 26 October, minutes after the attacker emptied the last vote account. None held more than 0.1 SOL, so none made the cut. The four kept voting until that epoch ended, then dropped out.

The 1 SOL rescue came too late for that cut, and on its own it was below the ticket price for the next one. Anyone can top up a vote account. Whoever holds its withdraw key can take the money straight back out, as the attacker showed. To vote again safely, each team needs a withdraw key it alone controls, or a new validator.

10 · StakersWhat it means for Solflare staking rewards

Your stake is where you left it. Solflare says that "No user funds were touched", and the chain agrees. None of the attacker's wallets took anything from a stake account. What you lose is rewards. A validator outside the voting set earns nothing for its stakers for as long as it stays out.

Some stakers are already leaving. Active stake on the four validators is 3.2M SOL. That is about 639K SOL less than the thread counted a day earlier, most of it from Blockdaemon and Astraeus. Solflare says it is moving to a new validator, will guide stakers there through its app, and is working on compensation. It also says it will never send a direct message or a link about the move. Hold it to that. A fake migration link is exactly what scammers will try next.

11 · The first reportsChecking the first reports

Solflare's post and the thread by ama31337 were the first public accounts. The thread got almost every detail right.

12 · What we cannot seeWhat the record cannot tell us

The chain shows that one party held five teams' hot keys and cold keys at once. It does not show how they got them. Shared hosting is the only common factor we can see, and Solflare says the firm that runs its validator is the one that reported the incident. Neither proves where the keys leaked.

It matters beyond these five. When TeraSwitch had an outage in August, analysts counted more than a quarter of all staked SOL on its network. A leak at one hosting provider can reach a large share of Solana.

Some money is still at risk. Early on 29 October, Solflare's hot key claimed a reward of 1.55 JitoSOL, and it is still there. Three of the hot keys hold about 1 SOL more between them. One of the thief's sweep wallets holds half a SOL. Anyone with those keys can move it. Look-alike addresses have also sent dust to the thief's wallets. That trick is called address poisoning, so anyone watching should copy addresses with care.

For anyone running a validator, the withdraw key is the one to guard. Here it let the attacker empty the vote accounts, keep them empty and choose who holds them now.

Key leaks keep showing up on Solana this year. A month ago it was TradeWiz and this week it was the Bloom trading bot, and both of those drained the wallets of the people who used them. This one hit the people who run the network.

13 · How we traced itHow we traced the Solflare validator hack

We read each transaction since 26 October on the five validators' keys, and the full history of the thief's wallets. Both came from Bitquery's Solana data and a public Solana node. We read token deposits on their own, since they do not always show in a wallet's history. Each bridge order gave us its receiving address. On Ethereum we read each wallet's transfers and checked each deposit against a public node. Our address labels named the bridges and Tornado's pools. JitoSOL is valued at the price the thief got for it. SOL and ETH use Bitquery's price for the hour of the drain.

You can buy the full Solana and Ethereum histories as files. We also trace cases like this for clients through our crypto investigation services. To follow the thief's wallets yourself, use the Bitquery MCP.

14 · The addressesWhere to look

These are the main wallets and transactions in this story. Each description links to the explorer.

FAQ

Was Solflare hacked, or the Solflare wallet?

Solflare's validator was. Solflare says the provider that runs it reported a security incident affecting its keys. On 26 October someone used the identity and withdraw keys of Solflare's validator and four others to take 1,343 SOL worth of SOL and JitoSOL. Everything we traced came from validator keys. None of it came from stakers or from Solflare wallet users.

How much was stolen in the Solflare validator hack?

The attacker took 1,343 SOL worth, about $135K, from the keys of five validators: Solflare, Blockdaemon, Astraeus, J21SMP and a retired Slow Ventures validator. Most of it was JitoSOL taken from the Solflare and J21SMP identity keys.

Is my SOL staked with Solflare safe, and what about staking rewards?

Yes. Staked SOL stays in your own stake account, and validator keys cannot move it. The attacker's wallets received nothing from any stake account. Your rewards have stopped while the validator is out of the voting set. Solflare says it will move stakers to a new validator through its app and will never send a link or a direct message about it.

Which validators were affected?

Solflare, Blockdaemon, Astraeus and a validator known by its vote address J21SMP stopped voting at the same moment on 27 October. The keys of a fifth, an old Slow Ventures validator that had not voted since 2024, were also used. All four active ones run on TeraSwitch's network.

Where did the stolen money go?

The attacker bridged it to Ethereum through Bridgers and Chainflip, then deposited 57.0 ETH in Tornado Cash within two days, most of it in the first two hours.

Why did the validators stop earning rewards?

Since July, each Solana vote account must pay a 1.6 SOL ticket every epoch to stay in the voting set. The attacker emptied the four vote accounts just before the check that picks the next voting set, so none of them made it.