Ongoing Solana Ecosystem Hack, Suspected Compromised Private Keys

There is a serious hack ongoing in the Solana ecosystem that is breaking the common pattern of users signing malicious contracts connected to sites built to look like well known sites.  In these contracts, the user agrees to send the attacker affected cryptocurrencies.  The current hack instead seems to have compromised users private keys—in effect, they have full control over the wallet, not just funds associated with a signed contract.

It was initially believed to be a Phantom hack, but users of the Slope wallet have also reported being having their funds drained.  It’s extremely unlikely that a hacker was able to find loopholes in both wallets that allowed them to gain full control, so it’s doubtful that the blame is on the wallet itself.

It’s also not believed to be users signing bad contracts because some of the affected wallets haven’t been active in over 6 months.  Most contract hacks happen quickly, and long ones happen within a month.  This is because attackers are at risk of losing the chance to take victims funds if that user transfers out from their wallet.

The truth it, we're not sure what the cause of the hack is.

While it’s not fully clear what the source of the hack is, the secure response is clear.  The safest thing to do with your Solana is to send it to a hardware wallet, or a centralized exchange like Coinbase.  If, like me, your Solana was staked on a wallet, you’re not stuck waiting until the end of the next epoch.

How To Transfer Staked Solana To Coinbase

If your SOL is staked on your Phantom wallet, like mine was, you’re not out of options.  Marinade.finance allows you to swap the tokens in your staked account for mSol, a common and liquid wrapped SOL.  I then took that mSol in my wallet to a DEX, like orca.so, and swapped it for SOL.  From there, it was as simple as sending it off to my Coinbase hosted Solana wallet.

While people have been concerned about the solvency of many centralized exchanges, it’s hard to argue with their security record.  If you don’t have a hardware wallet available, a centralized exchange is the next best option.

This has been a rough year for Solana, which has seen many outages and network limitations.  Add to that the massive wormhole hack, which at the time was the second largest hack ever, and you can start to understand why much of social media has soured on the project.