Security Breach in Solana: $135,000 Hijacked from Five Validating Operators and Routed to Tornado Cash

Security Breach in Solana

A security breach affecting Solana has led to the compromise of credentials connected to five different validators, resulting in the theft of around $135,000 worth of cryptocurrency. The incident, occurring between October 26 and 27, enabled the attacker to access operational keys for validators including Solflare, Blockdaemon, Astraeus, one unnamed validator, and a dormant Slow Ventures validator.

Investigation and Asset Tracing

Investigators from Bitquery traced the stolen assets, which amounted to 1,343 SOL and 57 ETH, into Tornado Cash, a privacy-centric platform known for cryptocurrency laundering. It's noteworthy that this recent breach contrasts sharply with the earlier SwissBorg hacking incident, which resulted in a staggering loss of $41 million and involved customer assets being drained. In this instance, the attack did not affect the SOL delegated by customers.

Validator Response and Impact

In a rapid movement, shortly after the theft, four of the active validators transferred around 1,188 SOL into a wallet controlled by the attacker. The majority of the stolen resources included 637 JitoSOL tokens, which were valued at roughly 833 SOL. Following these transactions, the attacker emptied the voting accounts of the affected validators, obstructing their ability to pay the necessary fees for participation in the network. As a result, on October 27, these validators ceased voting in unison, which disrupted the generation of staking rewards until users could reassign their stakes.

Concerns Over Validator Ecosystem

This incident raises concerns about the stability of the validator ecosystem within Solana, particularly given the increasing consolidation of operators that has been criticized for undermining decentralization. However, Bitquery reported finding no direct transfers from user stake accounts into the attacker's wallets. After acquiring JitoSOL, the attacker converted these tokens into SOL and used bridging services to transfer funds to Ethereum, with a notable amount of 56.6 ETH identified moving into a single wallet.

Timing and Laundering Patterns

Investigators confirmed that less than nine minutes elapsed between the first bridging payout and the initial deposits into Tornado Cash. By October 28, a total of 57 ETH was linked to the privacy service, reflecting typical patterns seen in cryptocurrency laundering schemes that employ Tornado Cash to obscure tracing of illicit transfers. This modus operandi bears resemblance to previous incidents, such as the CoinDCX exchange breach, although no link has been established between these events.

Forensic Report and Security Vulnerabilities

"The vulnerability stemmed from outdated credentials that had been generated between 2020 and 2022."

Subsequently, a forensic report from Blockdaemon on October 30 revealed that the vulnerability stemmed from outdated credentials that had been generated between 2020 and 2022. These credentials reportedly came from a local copy on a device previously used by an employee, with no signs of unauthorized intrusion into the existing validator infrastructure. Blockdaemon reassured users that their delegated assets remained intact even though the validators involved required replacement to renew their rewards program. This breach also highlights persistent vulnerabilities in operational security, echoing earlier concerns raised following other compromises involving Solana's treasury wallet.