Key takeaways Five validator key sets compromised in coordinated attack Investigators trace $135,000 theft and 57 ETH deposits Delegated SOL remains untouched despite interrupted staking rewa
A coordinated Solana security breach compromised credentials associated with five validators, allowing an attacker to steal approximately $135,000 in cryptocurrency before moving proceeds across blockchains into Tornado Cash.
According to Bitquery's October 29 investigation, the attacker controlled operational keys linked to Solflare, Blockdaemon, Astraeus, an unidentified validator and an inactive Slow Ventures validator.
The incident occurred October 26–27, with investigators tracing 1,343 SOL worth of stolen assets and 57 ETH deposited into Tornado Cash.
Unlike the earlier $41 million SwissBorg staking compromise, the latest attack did not drain customers' delegated SOL.
Solana Hacker Steals $135,000 Across Validator AccountsBitquery found that four active validators transferred approximately 1,188 SOL worth of assets into one attacker-controlled wallet within three minutes.
The stolen cryptocurrency included 637 JitoSOL tokens, valued at approximately 833 SOL, accounting for most of the losses.
The attacker subsequently emptied validator voting accounts, preventing affected operators from paying the required participation fees.
Four validators stopped voting simultaneously on October 27, interrupting staking rewards until affected users could move their stake.
The disruption highlights additional operational vulnerabilities in Solana's validator ecosystem, where operator consolidation has already raised decentralization concerns.
However, Bitquery found no evidence that the attacker's wallets received funds directly from customers' stake accounts.
Stolen Solana Funds Reach Tornado Cash Within MinutesFollowing the initial withdrawals, the attacker converted JitoSOL into SOL before transferring funds to Ethereum through Bridgers and Chainflip.
Bitquery traced approximately 56.6 ETH into one receiving wallet, with the first Tornado Cash deposits occurring less than nine minutes after its initial bridge payout.
By October 28, investigators identified 57 ETH deposited into the privacy protocol.
The transfers resemble previous cryptocurrency laundering operations involving Tornado Cash, where attackers move assets across networks to complicate tracing.
A similar cross-chain pattern appeared during the CoinDCX exchange breach, although no evidence connects the two incidents.
Investigators also observed the attacker automatically withdrawing a 1 SOL recovery deposit within five seconds.
Blockdaemon Traces Compromised Keys to Former Employee's DeviceBlockdaemon's October 30 forensic update identified historical credentials generated between 2020 and 2022 as the source of its exposure.
The company said affected key material originated from a local copy on a former employee's corporate device, with no evidence of intrusion into its current validator infrastructure.
Its findings distinguish the breach from wallet-permission exploits targeting individual Solana users.
Blockdaemon emphasized that delegated assets remained secure, although affected validators required replacement to restore rewards.
The incident also reinforces concerns raised by earlier Solana treasury wallet compromises, where operational credential security proved critical.
