On 26 and 27 October 2026, someone compromised the operator keys of five Solana validators run by Blockdaemon, and reassigned the withdraw authority on their vote accounts (Blockdaemon incident report). Solana Compass reports that Solflare's old validator was run by Blockdaemon, and Bitquery (via Coinpaper) lists Solflare among the five affected validators. Blockdaemon and Solflare say no delegated SOL was moved. But the old Solflare validator stopped earning, and our query of Solana's public RPC on 8 November shows that about 1.14 million SOL of its former stake now sits in 44,373 accounts deactivated in epoch 1077 and not re-delegated, while about 506,000 SOL is active on the replacement validator. Solflare has extended its deadline to move stake and qualify for missed-rewards cover to 30 November.
Key Takeaways
Blockdaemon says historical key material generated in 2020 to 2022 was copied from a former employee's company device in December 2025, and that it found no sign of intrusion into its current infrastructure. It called the incident contained on 5 November. Solflare says user SOL is safe because delegated stake stays in accounts controlled by users' own keys, and Blockdaemon says the same, so the reported cost for stakers is missed rewards rather than principal. On chain at epoch 1080, the old validator has about 77 SOL active against about 1.69M at epoch 1069 (Solana Compass), and about 1.14M SOL sits in accounts still pointing at it that were deactivated in epoch 1077. Another 506K SOL is active on the new validator, but we cannot tell how much of that came from the old one. The chain does not show who started the epoch 1077 deactivations, and some of those accounts may belong to wallets that have not moved. Solflare's compensation covers rewards missed from 26 October to 1 November for users who complete the migration by 30 November.
What Happened to the Validators
Blockdaemon, a staking infrastructure provider, published an incident report that it updated between 27 October and 5 November. It says operator keys for "a small set of our oldest running validators" were compromised between 26 and 27 October. The affected set is five Blockdaemon-operated Solana mainnet validators and one internal operational wallet. The unauthorized party reassigned the withdraw authority on the five vote accounts and moved operational funds. Blockdaemon does not disclose how much.
Blockdaemon says that under Solana's authority model the withdraw authority change cannot be reversed, so it permanently retired the five vote accounts. Its report says they stopped earning rewards from epoch 1068 and were delinquent from epoch 1070. On our block times epoch 1068 began at 19:28 UTC on 25 October, before the 26 to 27 October compromise window, and the report does not explain the gap. Four replacement validators were deployed, keyed, funded and synchronised by 22:28 UTC on 27 October, according to the report. Solflare says the compromised keys were for its validator at its previous staking provider, which Solana Compass identifies as Blockdaemon, and Solana Compass reports that the provider notified Solflare on 27 October. Blockdaemon's report says affected customers were notified directly but does not name them.
"no indication of any loss or risk to the principal staked" (Blockdaemon incident report, 27 October update)
What Blockdaemon Says Caused It
Blockdaemon's 5 November update says a copy of the key material, generated between 2020 and 2022, sat on a corporate device assigned to a former employee. It was copied to systems outside Blockdaemon's control during that employee's off-boarding in December 2025 and was not detected at the time. The 30 October update describes an unauthorized data transfer from the device to personal systems. Blockdaemon reports no sign of intrusion, exfiltration or persistence on its current validator hosts, and says it checked secrets-management systems and password vaults. The attacker's identity has not been determined, and Blockdaemon says it filed a report with the applicable government authorities. A root cause analysis for affected customers is still pending. This is Blockdaemon's account, and we have not seen it independently verified. Compromised company devices were also behind Step Finance's shutdown after compromised executive devices, though no source links the two incidents.
What Bitquery Says Was Taken
Blockchain analytics firm Bitquery published a trace on 29 October. Per Coinpaper, which reported it on 2 November, about $135,000 (1,343 SOL, including 637 JitoSOL) was moved from the keys of five validators between 26 and 29 October, then converted and bridged to Ethereum, with about 57 ETH deposited into Tornado Cash by 28 October. Bitquery found no evidence that the attacker's wallets received funds directly from customers' stake accounts. Coinpaper lists Solflare, Blockdaemon, Astraeus, an unidentified validator and an inactive Slow Ventures validator among the five. The $135,000 comes from this one analysis, and we read Coinpaper's account of it, not Bitquery's own report. Coinpaper also says the attacker emptied the validator voting accounts, leaving operators unable to pay participation fees; it does not say which fees. Alpenglow, covered in our Alpenglow and ETF outflow report, also made voting validators pay a flat per-epoch ticket from their vote accounts, but no source says that is what Coinpaper means.
What It Cost Solflare Stakers
Solflare is a non-custodial wallet (CoinDesk); we have also covered our coverage of the Solflare Shield hardware wallet. Solflare disclosed the incident on 27 October. Solana Compass reports that the old validator ("Solflare (Legacy)") stopped earning and that the new one, "Solflare", became active in epoch 1071. The old validator had about 1.56 million SOL delegated, according to Stakewiz data cited by CoinDesk, worth roughly $160 million then. CoinDesk quotes Solflare's X post: delegated stake "sits in your own stake account and is controlled by your keys alone", and "no user funds were touched." A Solflare co-founder said the validator's operator "lost control of the validator's keys" (AMBCrypto).
For stakers the reported damage is rewards, not principal: Blockdaemon, Solflare and Bitquery all say no delegated stake was moved, which our own query cannot verify. The validator earned nothing after it went delinquent. Solflare offered an in-app "Move your stake" flow from 29 October and said it would cover missed rewards for users who move. The deadline was 1 November and Solflare extended it on 2 November: "You now have until November 30 to move your stake to the new Solflare validator," with rewards covered "from October 26 to November 1" (Solflare post quoted by crypto.news).
| Point | What Solflare says | Source |
|---|---|---|
| Where to move stake | Only inside the Solflare app, via "Move your stake". Solflare says it will never message users or send links about it | Solana Compass, crypto.news |
| Small balances | Stakers with more than 1 SOL should use the migration flow; stakers under 1 SOL are told to unstake instead | Solana Compass |
| Deadline | 30 November (extended from 1 November on 2 November) | Solflare via crypto.news |
| What is compensated | Staking rewards missed from 26 October to 1 November, for users who complete the migration | Solflare via crypto.news |
| What is not | Instant unstake fees | Solflare via Solana Compass |
| Payout | Automatically to the wallet during November, no claim needed (29 October post, before the deadline change) | Solana Compass |
| Who funds it and when | Not stated | Solana Compass |
| New validator | Lower commission than the old one, about 4.69% APY | Solana Compass |
Where the Stake Is Now
On 8 November, in epoch 1080 (snapshot at about 16:15 UTC), we queried Solana's public mainnet-beta RPC for the two validators' vote accounts and for every stake account delegated to the old one. The old vote account is delinquent, with a last vote at slot 462,239,999. That is the final slot of epoch 1069, at 22:29 UTC on 27 October, about when Blockdaemon says its replacement validators were synchronised. It shows about 77 SOL of active stake. The new vote account is current, with a 5% commission against 6% on the old one, about 505,870 SOL active and 20,521 SOL activating across 5,340 accounts. ("About 77 SOL" is the vote account's active stake; delegation records show 72 SOL.)
The largest group is not covered in the reports we read. We found 44,373 stake accounts still pointing at the old validator whose delegation records show deactivation in epoch 1077, holding about 1,135,737 SOL in delegated stake. Epoch 1077 ran from 10:12 UTC on 4 November to 11:54 UTC on 5 November. The records show 31,645 distinct staker authorities across them. Deactivated stake that has not been re-delegated earns nothing, and an account withdrawn in full would no longer exist, so these are accounts that nobody has re-staked or emptied yet. Solflare's blog, as summarised by Solana Compass, said it would deactivate leftover stake after five epochs offline so holders could withdraw it or stake it elsewhere. That is the only public explanation we found. It does not obviously match the five-epoch arithmetic (delinquency began in epoch 1070) or the statement that users' own keys control their stake accounts, and the deactivations could have come from users, wallet software or another party. The chain does not show who sent them. These figures keep moving: between two runs of the same query about ten minutes apart, 38 stake accounts disappeared from the old validator's list and activating stake on the new one rose by roughly 1,100 SOL.
| Epoch (date) | Old validator | New validator | Source |
|---|---|---|---|
| 1069 (ended 27 Oct 22:29 UTC) | 1,688,746 SOL | none yet | Solana Compass |
| 1070 (27 Oct) | 1,559,221 SOL | none yet | Solana Compass; CoinDesk cites about 1.56M from Stakewiz |
| 1072 (30 Oct) | 1,472,491 SOL | 149,416 SOL across 701 accounts | Solana Compass |
| 1080 (8 Nov) | about 77 SOL active | 505,870 SOL active, 20,521 activating | Our RPC query |
| 1080 (8 Nov), old validator's accounts | 1,135,737 SOL in 44,373 accounts, deactivated in epoch 1077 | not applicable | Our RPC query |
Illustrative Scale of Rewards Not Being Earned
As a rough, illustrative figure, 1,135,737 SOL at the 4.69% yield Solana Compass quotes for the new validator is about 146 SOL per day, or about $13,100 per day at $89.56 (CoinGecko, 8 November, 16:18 UTC). That is our arithmetic, not a reported loss: it takes a yield quoted on 30 October, ignores compounding and commission differences, and the stake had already earned nothing since the old validator went delinquent. Some of these accounts may belong to wallets that have not moved, and some may hold SOL that owners chose to leave inactive. The figure shows the scale of what is not earning, not what anyone has lost. We also do not know how much of the roughly 1.69 million SOL at epoch 1069 was withdrawn or moved to other validators before epoch 1077, because withdrawn accounts disappear from the data.
A Timeline of the Incident
The on-chain dates in this timeline come from block times for the first slot of each epoch, which we queried on 8 November. Epochs now last about 26 hours (an average slot time of about 217 ms over 10 recent samples, 432,000 slots), not the "roughly two days" CoinDesk gave in late October.
What to Watch Next
- 30 November. Solflare's deadline to move stake and qualify for rewards cover. We found no public count of how much stake has migrated.
- Blockdaemon's root cause analysis. Pending for affected customers, and not yet public.
- Who funds the compensation. Solana Compass notes Solflare has not said who pays or exactly when.
- The inactive stake. Whether the 1.14 million SOL is re-staked, withdrawn or left, and who it belongs to.
- Other Blockdaemon customers. Blockdaemon says it notified affected customers directly and has not stated their number.
Known Discrepancies
Reports of this incident disagree on several points, partly because early coverage predates Blockdaemon's updates.
| Claim in circulation | What the sources support |
|---|---|
| Solflare lost its keys | A Solflare co-founder said the operator "lost control" of the keys (AMBCrypto). Blockdaemon's report says the keys were compromised, and that the withdraw authority was reassigned by an unauthorized party. |
| The provider was not named | CoinDesk, ForkLog and Crypto Briefing wrote on 27 to 29 October that the provider was unnamed. Solana Compass names Blockdaemon as Solflare's former provider; we have not seen Solflare name it first-hand. Blockdaemon's own report covers five validators and does not name customers. |
| The withdrawal-authority change is unconfirmed | CryptoTicker (3 November) called it unverified. Blockdaemon's incident report, updated 5 November, states that the withdraw authority on the five vote accounts was reassigned. |
| Four live validators and one retired | Blockdaemon's 27 October entry says four live, one retired. Its 5 November entry says all five vote accounts were permanently retired. |
| The deadline is 1 November | The first deadline was 1 November. Solflare extended it to 30 November on 2 November (crypto.news). |
| $160 million at stake | CoinDesk and ForkLog give about $160M for 1.56M SOL, which implies about $103 per SOL. At $89.56 (CoinGecko, 8 November, 16:18 UTC) the same stake is worth about $140M (our arithmetic). |
| $135,000 stolen | Bitquery's figure, via Coinpaper. Blockdaemon says operational funds were moved and does not disclose an amount. |
| Epochs last about two days | CoinDesk describes roughly two-day epochs. On chain, epoch 1077 ran from 4 November 10:12 UTC to 5 November 11:54 UTC, about 26 hours. |
Sources and Methodology
We read Blockdaemon's incident report directly, and Solana Compass, CoinDesk, ForkLog, AMBCrypto, Crypto Briefing, crypto.news, Coinpaper and CryptoTicker. We did not read Solflare's original X posts or blog post; their wording comes from the outlets that quote them. The on-chain figures are from our own queries of Solana's public mainnet-beta RPC on 8 November 2026 at epoch 1080: the two vote accounts' status and commission, and the parsed stake accounts delegated to each, which we grouped by deactivation epoch. The vote accounts are the ones listed by Solana Compass (old: EXhYxF25PJEHb3v5G1HY8Jn8Jm7bRjJtaxEghGrUuhQw, new: 48Za4qpPrYz7v7aDhPhjHZwh7ahtWkye8vjqDYEUy9iV), and we did not independently confirm they belong to Solflare; Solflare says to move stake only inside its app. We used the standard getEpochInfo, getVoteAccounts, getProgramAccounts (stake program, filtered by voter) and getBlockTime methods. Those figures describe delegation records at one moment; they do not identify account owners or intent. The price is from the CoinGecko API (8 November, 16:18 UTC).
Items we left out because we could not verify them: the amount Blockdaemon moved, the number of affected customers, and the attacker's identity.
- Blockdaemon, "Operational impact on Solana validators" incident report, updated 5 November 2026
- Solana Compass, "Solflare Staking Update: Move Stake to the New Solflare Validator", 30 October 2026
- CoinDesk, "Solana wallet Solflare pledges to pay missed rewards on staked $160 million after validator goes offline", 29 October 2026
- ForkLog, "Solflare to Compensate Missed Staking Rewards for $160 Million in SOL", 29 October 2026
- AMBCrypto, "Solflare halts SOL staking rewards after validator operator loses security keys", 29 October 2026
- Crypto Briefing, "Solflare says staking provider security incident halted its validator's rewards", 27 October 2026
- crypto.news, "Solflare enters 'bunker mode' after crypto attacks, restricts code access", 2 November 2026
- Coinpaper, "Solana Validator Hack Exposes Five Operators as $135,000 in Crypto Flows Into Tornado Cash", 2 November 2026
- CryptoTicker, "Solana price prediction: validator incident, SOL at $93", 3 November 2026
- Solana mainnet-beta public RPC (our queries), 8 November 2026; CoinGecko API, SOL price data, 8 November 2026
This article is analysis, not financial or security advice. Solflare's instructions and deadlines can change, and every figure here carries the date it was checked.