Following our October 27 notice about exposed operator keys on a small subset of our validators, here is an update on our security review. Working with external digital forensics partners, we have found no indicators of compromise across our broader infrastructure, and no indication that any other Blockdaemon products, services, protocols or validators are affected. Customer data and assets remain uncompromised, and no client data or sensitive information was accessed.
As previously noted, delegated SOL remains safe in delegators’ own stake accounts.
The incident is limited to the operational accounts identified in our initial notice. All impacted customers have been notified, so if you did not receive a notification, you were not impacted. If you believe you were, contact support@blockdaemon.com.
Beyond the deactivation and re-delegation steps already recommended, no further client action is required. We are maintaining active monitoring across our infrastructure. For help re-delegating stake or other questions, contact Blockdaemon support or see our FAQ.
Look-alike addresses are circulating on-chain, so only use the address published on our incident page or sent to you directly by Blockdaemon. Never copy a validator address from your transaction history, and verify the full address, not just the first and last few characters, before signing.
Between 26 and 27 October, Blockdaemon identified that operator keys for a small set of our oldest running Solana validators were compromised. The attacker was able to change the withdrawal authority on the impacted validators and move a limited amount of operational assets from their operational accounts.
Your delegated SOL is safe. There is no indication of loss or risk to staked principal. Delegated SOL remains in each delegator’s own stake account and was not moved.
Reward impact: Because we cannot fund the voting accounts on the compromised validators, they will not earn rewards starting with epoch 1070.
Recommended action: The impacted validators must be replaced. A new validator is being prepared, and we will post its details here as soon as it is available. We are working directly with affected customers to move stakes to newly created validators quickly and minimise gaps in rewards.
If you need help deactivating, withdrawing or re-delegating, please contact Blockdaemon support - support@blockdaemon.com