Solana cyberattack: More than 8,000 ‘hot wallets’ drained

The Solana network seems to be the victim of an ongoing cyberattack. Over the last few hours, several users have taken to Twitter to report that their Solana holdings have been completely drained.

Data from block explorer, Solana FM backs these reports and shows that the attackers have managed to syphon off more than $5 million so far. The platform has also managed to identify four wallets currently linked to the attack and has posted details of the same on Twitter.

What's more alarming is that the attack is still unfolding, and initial reports point to compromised private keys. If this is true, wallet holders could do very little to prevent funds from being stolen.

"As of now, there are over 8,000 victims and counting," tweeted Blockchain audit firm OtterSec. "These transactions are being signed by the actual owners, suggesting some sort of private key compromise," it said in a separate tweet.

At first, it was believed that the attack was limited to Phantom wallets and the popular Solana NFT marketplace Magic Eden. The latter also took to Twitter to warn users, saying, "There seems to be a widespread SOL exploit at play that's draining wallets throughout the ecosystem." The platform also suggested revoking permissions for suspicious links as a safety measure.

Phantom is also looking into the matter. "We are working closely with other teams to get to the bottom of a reported vulnerability in the Solana ecosystem," it said in a tweet. "At this time, the team does not believe this is a Phantom-specific issue. As soon as we gather more information, we will issue an update."

As more reports surfaced, it became evident that the exploit was not limited to SOL and Phantom wallets. Users have also reported USDC holdings being drained over the last few hours. And latest tweets from OtterSec reveal that attackers are also targeting other wallets such as Slope, Solflare, TrustWallet.

Popular crypto analyst 0xfoobar confirmed these developments in a Tweet, saying the attacker was stealing "both native tokens (SOL) and SPL tokens (USDC)" from "Phantom & Slope wallets reportedly". He also pointed out that revoking permissions wouldn't prevent funds from being stolen. Instead, he suggested moving funds to an offline cold wallet to ward off the threat.

This is the second attack in two days. Just yesterday, crypto bridge Noman was hacked, with the attackers syphoning off close to $190 million. SOL dropped 8 percent in the first couple of hours following the attack. However, it has registered a slight recovery since then, trading at $38.54 at the time of writing.