Key Highlights
- Solflare entered a heightened security state, restricting access to its infrastructure and code, requiring multiple approvals for every change, and pausing new additions.
- Co-founder Vidor acknowledged that the measures will slow development in exchange for stronger protection.
- The move comes after a third-party staking provider incident that compromised keys for the Solflare validator and drained roughly 1,343 SOL worth about $135,000, though no user funds or delegated stake were affected.
- Solflare migrated users to a new validator with improved key controls and covered missed rewards.
Solflare, a leading non-custodial wallet in the Solana ecosystem, has entered a heightened state of security alert. Co-founder Vidor announced that the team has restricted access to its infrastructure and code, requires multiple approvals for every change, and paused new additions.
“After the month this industry just had, access to our infra and code is shut down, every change needs multiple approvals, and nothing new gets in,” Vidor stated. He noted the measures will slow development but accepted the trade-off for stronger protections.
The move comes as the cryptocurrency sector faces a series of high-profile security incidents in October and early November 2026.
Wallet Infrastructure Faces Major Security Incidents
In late October, Solflare itself dealt with a third-party issue. Its staking provider reported a security incident that compromised keys held for the Solflare validator. On-chain analysis showed an attacker used keys from several Solana validators, including Solflare’s, draining roughly 1,343 SOL, about $135,000 at the time, much of it in JitoSOL. Funds moved to Tornado Cash.
Critically, no user funds or delegated stake were affected. Solana’s design keeps staked SOL under user control in individual stake accounts, and validator keys cannot move them. Solflare paused rewards on the affected validator, migrated users to a new one operated with improved key controls including multisig for withdrawal authority, and committed to covering missed rewards for those who switched via the official app.
Earlier in October, hardware wallet users faced a supply-chain attack involving Ledger devices. Criminals tampered with genuine Ledger hardware sold through the authorized Southeast Asian reseller CryptoBilis. Hidden implants captured recovery phrases during setup and transmitted them.
On-chain trackers reported losses of approximately $93 million across hundreds of wallets on multiple chains, primarily USDT on TRON, with smaller amounts on Bitcoin, Ethereum, and others. Ledger confirmed at least one device contained an unauthorized implant, advised affected buyers, and worked with partners, while some stablecoin funds were frozen.
The largest incident struck on October 29. Binance reported a security breach involving unauthorized withdrawals from hot wallets totalling about $6.3 billion across multiple blockchains.
The exchange stated an initial investigation pointed to a compromised engineer’s laptop among other factors, found no evidence of private key leaks from wallets, suspended withdrawals temporarily, and pledged to cover all losses using its Secure Asset Fund for Users and corporate reserves.
Roughly $3 billion in assets were frozen with help from partners including stablecoin issuers. The FBI later attributed the attack to a North Korea-linked group.
Additional pressure continued into early November with reports of further drains, including activity at other platforms and suspected large withdrawals from exchange accounts linked to an unidentified European entity.
Tezos-related projects have also maintained active security practices. Teams associated with Etherlink and related components have publicly disclosed and patched vulnerabilities through governance upgrades and bug-bounty reports, emphasizing rapid response even when no funds were lost.
Measures Taken by Solflare
Solflare’s response prioritizes defense-in-depth. Access to core infrastructure and code repositories has been tightly restricted. All modifications now require multiple layers of approval. New features or additions are paused. The company previously introduced Solflare Guards, which simulate transactions, add on-chain assertions, and block known malicious activity. It also maintains blocklists and real-time monitoring.
Vidor and the team have stressed transparency. After the validator incident, they communicated early that user SOL remained safe and provided guided in-app migration paths while warning against phishing attempts.
