A coordinated attack on Solana‘s validator ecosystem resulted in the theft of approximately $135,000 in cryptocurrencies after multiple validator credentials were compromised and funds were quickly moved to the mixing protocol Tornado Cash.
Solana validator credentials targeted in sophisticated breach
The incident took place from October 26 to 27, allowing the attacker to control operational keys associated with several key participants in the Solana network, including Solflare, Blockdaemon, Astraeus, an unidentified validator, and an inactive validator linked to Slow Ventures.
Bitquery, a blockchain analytics firm, investigated the attack and reported that the attacker gained access to operational validator keys. This allowed the unauthorized transfer of crypto assets held within validator accounts.
Investigators traced the theft of 1,343 SOL, with about 1,188 SOL transferred from four separate validator wallets into an address controlled by the attacker in just three minutes.
The attacker also seized 637 JitoSOL tokens, worth about 833 SOL, forming the bulk of the losses. JitoSOL is a liquid staking derivative on the Solana network that allows users to earn staking rewards without locking up their tokens.
Mini dictionary: JitoSOL, a yield-bearing Solana-based token issued by Jito Labs, represents staked SOL and accumulates rewards while remaining liquid and transferable.
Following the transfers, the attacker emptied the validator voting accounts, making it impossible for the impacted operators to pay participation fees or maintain normal operations.
Four validators halted voting simultaneously on October 27, temporarily interrupting staking rewards until affected users could reassign their stake.
Bitquery pointed to a lack of evidence showing that customers’ delegated SOL accounts were directly affected during the breach.
The breach, however, reignited concerns about centralization and security risks across Solana’s validator network, as operator consolidation may increase vulnerability.
Attacker launders funds using Ethereum bridges and Tornado Cash
After stealing the funds, the attacker swiftly converted JitoSOL to SOL and bridged the assets to Ethereum using platforms such as Bridgers and Chainflip, a protocol facilitating secure cross-chain swaps. Within minutes, at least 56.6 ETH reached a designated receiving wallet.
Mini dictionary: Tornado Cash, an open-source Ethereum-based protocol, offers transaction privacy by mixing identifiable funds with others to obscure transaction trails.
The first Tornado Cash deposits occurred less than nine minutes after the initial bridging event, reflecting techniques commonly used to conceal the origins of illicitly gained assets.
BlockchaIn forensic experts noted that these transfers mirrored strategies observed in prior laundering incidents, including the CoinDCX exchange breach, though no formal connection has been established between the cases.
Additionally, the attacker quickly withdrew a 1 SOL recovery deposit in under five seconds, demonstrating the use of automated tools.
| Asset | Amount Stolen | Initial Blockchain | Destination |
|---|---|---|---|
| SOL | 1,343 | Solana | Bridged to Ethereum, moved to Tornado Cash |
| JitoSOL | 637 (≈833 SOL worth) | Solana | Converted to SOL, then bridged |
| ETH | 56.6 | Ethereum (after bridging) | Tornado Cash |
Blockdaemon ties compromise to old credentials on a former employee’s device
On October 30, Blockdaemon, a leading institutional blockchain infrastructure provider, released a forensic update detailing the breach of its validator key material. The company attributed the exposure to credentials generated from 2020 to 2022, which were stored on a device belonging to a former employee.
The review showed that the compromised keys were not linked to Blockdaemon’s active validator infrastructure, and there was no evidence of recent unauthorized access to its systems.
Blockdaemon also drew a distinction between this validator breach and earlier wallet-based exploits targeting Solana’s retail users.
The company stated that delegated assets remained secure, but affected validators needed replacement to restore staking rewards and maintain normal staking operations.
This event echoes earlier cases where poor credential management led to the compromise of treasury wallets on the Solana network, further highlighting the necessity for stringent operational security measures.
