$135,000 in Assets Stolen from Keys of Five Solana Validators

Key Facts

Bitquery estimated that assets worth about $135,000, equivalent to 1,343 SOL, were stolen from the keys of five validators on the Solana network in transactions between October 26 and 29, 2026. Entities associated with the keys included Solflare, Blockdaemon, Astraeus and J21SMP, as well as a retired validator linked to Slow Ventures. Not all five validators stopped voting: four were active, while the fifth had not voted since 2024. Bitquery said the assets moved along routes that included bridges to Ethereum, and it later tracked deposits into Tornado Cash. These figures distinguish the estimated scale of the theft from its operational impact on validators and delegators.

The stolen assets included 637 JitoSOL from two identity accounts linked to Solflare and J21SMP, which Bitquery valued at 833 SOL at the time of sale. The company calculated the token’s value using a sale price of 1.307 SOL per JitoSOL. Its dollar estimates for SOL and ETH were based on hourly prices between 19:00 and 20:00 UTC on October 26: $100.44 per SOL and $2,314 per ETH. Bitquery describes total asset flows across bridges to Ethereum, so it does not attribute the entire amount of JitoSOL to bridge transfers alone.

Blockdaemon said it detected the compromise of operational keys for a limited number of its oldest validators between October 26 and 27. It said limited operational assets were moved from operational accounts, while delegated SOL balances remained in delegators’ staking accounts and were not transferred. Previously paid rewards also remained safe, the company said, but the affected validators will be unable to generate rewards starting in epoch 1070 because their voting accounts are not funded. According to Bitquery, four active validators stopped voting after their voting accounts were emptied and they failed the next voting-group check. The direct impact is therefore concentrated on voting and rewards in coming periods for the affected validators, not on delegated SOL principal.

Blockdaemon advised delegators to unstake from the affected validators and redelegate to others. The company said staking changes take effect only at epoch boundaries, and an epoch lasts about 24 hours, so the timing of a move depends on when the next boundary occurs. The company’s instructions to delegators differ from the status of the balances themselves: the assets remained in delegators’ accounts, while future rewards for the affected validators may be interrupted. Bitquery says a voting account needs a 1.6 SOL ticket fee per epoch to remain in the voting group, under the rule it said had been in effect since July 2026. Emptying the accounts before the next group eligibility check led to the four active validators being excluded from voting after the current epoch ended.

In an update dated October 30, Blockdaemon said its forensic review, conducted with the participation of two independent incident response firms, found no compromise, data exfiltration or persistent presence on the affected validator hosts. It added that the affected validator credentials were created between 2020 and 2022, and that the key material came from a local copy on a corporate device assigned to a former employee. The company said tracking data showed information being transferred to personal systems. It had said its review found no signs of compromise in its broader infrastructure or other products and services. A comprehensive root-cause report will be issued after the investigation is complete, it said, while the impact it announced remained limited to operational accounts and future validator rewards.

The incident comes amid recent changes to the validator participation mechanism. The Solana Foundation said the Validator Admission Ticket feature began with the activation of Alpenglow on mainnet in epoch 1064 on October 21, 2026, and deducts 0.8 SOL from the voting account at the start of each epoch to secure participation in the next epoch. It added that a validator that does not pay the fee does not vote or produce blocks in the next epoch. This mechanism differs from the 1.6 SOL per-epoch fee Bitquery cited in its explanation of voting-group requirements. In a broader context, the foundation said a routing outage on August 12 took about 29% of the network’s stake offline, while block production continued and transactions still landed. It also said it had reduced the share of hosting at TeraSwitch from 38% in the previous year to less than 30% before that outage.