Solana cyberattack: More than 8,000 ‘hot wallets’ drained

"As of now, there are over 8,000 victims and counting," tweeted Blockchain audit firm OtterSec. "These transactions are being signed by the actual owners, suggesting some sort of private key compromise," it said in a separate tweet.

At first, it was believed that the attack was limited to Phantom wallets and the popular Solana NFT marketplace Magic Eden. The latter also took to Twitter to warn users, saying, "There seems to be a widespread SOL exploit at play that's draining wallets throughout the ecosystem." The platform also suggested revoking permissions for suspicious links as a safety measure.

Phantom is also looking into the matter. "We are working closely with other teams to get to the bottom of a reported vulnerability in the Solana ecosystem," it said in a tweet. "At this time, the team does not believe this is a Phantom-specific issue. As soon as we gather more information, we will issue an update."

As more reports surfaced, it became evident that the exploit was not limited to SOL and Phantom wallets. Users have also reported USDC holdings being drained over the last few hours. And latest tweets from OtterSec reveal that attackers are also targeting other wallets such as Slope, Solflare, TrustWallet.

Popular crypto analyst 0xfoobar confirmed these developments in a Tweet, saying the attacker was stealing "both native tokens (SOL) and SPL tokens (USDC)" from "Phantom & Slope wallets reportedly". He also pointed out that revoking permissions wouldn't prevent funds from being stolen. Instead, he suggested moving funds to an offline cold wallet to ward off the threat.

This is the second attack in two days. Just yesterday, crypto bridge Noman was hacked, with the attackers syphoning off close to $190 million. SOL dropped 8 percent in the first couple of hours following the attack. However, it has registered a slight recovery since then, trading at $38.54 at the time of writing.