‘Malicious actor’ drains $5.2 million in crypto assets from 8,000 digital wallets in one go
Solana claims an exploit in users' wallet software is to blame.
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Update:Solana posted a statement via aTwitter threadregarding the status of its investigation:“After an investigation by developers, ecosystem teams, and security auditors, it appears affected addresses were at one point created, imported, or used in Slope mobile wallet applications. This exploit was isolated to one wallet on Solana, and hardware wallets used by Slope remain secure. While the details of exactly how this occurred are still under investigation, but private key information was inadvertently transmitted to an application monitoring service. There is no evidence the Solana protocol or its cryptography was compromised.”
Original story:Thousands of digital wallets on the Solana blockchain were drained of funds by a “malicious actor” last night. Over $5.2 million in crypto assets were lost in the attack, but Solana is blaming external software, stating that it’s not an issue with its own blockchain.
Cybersecurity experts have surmised that it may be a vulnerability in thewallet software, not the Solana blockchain itself, which will at least be a relief for some. The last update from Solana from this morning says: “This does not appear to be a bug with Solana core code, but in software used by several software wallets popular among users of the network.”
Theattack drained over 8,000 walletsthough that number could rise if more and more users report compromised wallets. The affected wallets include but are not limited to Solflare, Trust Wallet, Phantom, and Slope.Trust Wallet CEO, Eowyn Chen, said, “Trust Wallet doesn’t log the private keys or secret phrase anywhere. It takes 20 hours to zoom in again to ensure our security. Here’s the closure to the past 20 hours. Upward and onward!” Chen also recommends that users not “use the same wallet on different wallet apps to reduce exposure like this.“Phantom took toTwitterto say that it, too, is working with Solana though it says at “this time, the team does not believe this is a Phantom-specific issue.”
Solflare has posted somesecurity updatesand said, “we are following the situation closely, and we feel the pain in the community,” and accompanied it with a sad face emoji.
An exploit allowed a malicious actor to drain funds from a number of wallets on Solana. As of 5am UTC approximately 7,767 wallets have been affected. The exploit has affected several wallets, including Slope and Phantom. This appears to have affected both mobile and extension.August 3, 2022
The root cause of the exploit is still being looked into, but OtterSec, a blockchain auditor, said onTwitterthat the transactions were “signed by the actual owners, suggesting some sort of private key compromise.” They also claim that some users on the Ethereum blockchain might be affected, though not as prevalent as Solana.
Elliptic, a blockchain analysis firm, says the assets stolen were “SOL, a small number ofnon-fungible tokens(NFTs) and over 300 Solana-based tokens.”
The biggest gaming news, reviews and hardware deals
Keep up to date with the most important stories and the best deals, as picked by the PC Gamer team.
Solana also strongly encourages people to use hardware wallets (or cold wallets), since there is no evidence that the exploit has affected them, and to move their funds to a centralized platform. If you had your wallet drained, consider it compromised and do not continue using it. It’s also good practice to keep your funds in a cold wallet and only use wallet software (or hot wallets) in small amounts for making transactions.
Solana is asking victims tocompletea survey to help its engineers investigate exactly what happened.
Best CPU for gaming: Top chips from Intel and AMDBest gaming motherboard: The right boardsBest graphics card: Your perfect pixel-pusher awaitsBest SSD for gaming: Get into the game first
Jorge is a hardware writer from the enchanted lands of New Jersey. When he’s not filling the office with the smell of Pop-Tarts, he’s reviewing all sorts of gaming hardware, from laptops with the latest mobile GPUs to gaming chairs with built-in back massagers. He’s been covering games and tech for over ten years and has written for Dualshockers, WCCFtech, Tom’s Guide, and a bunch of other places on the world wide web.
After closing its AAA games development studio, Netflix Games VP transforms into the VP of GenAI for Games and the gobbledygook must flow: ‘a creator-first vision… with AI being a catalyst and an accelerant’
Roblox is banning kids from unrated experiences and Social Hangout spaces in an effort to protect them from paedophiles
I desperately hope Dragon Age: The Veilguard, Baldur’s Gate 3 and Disco Elysium inspire more RPG devs to reject the traditional drip, drip, drip of DLC and expansions
