Solflare Validator Halts Rewards After Key Incident

Solflare, a self-custody Solana wallet, says its staking validator has stopped producing rewards after the outside company that runs it reported a security incident affecting the validator’s keys. In a post on X at 23:26 GMT on 27 October, @solflare said: “Our staking provider has notified us of a security incident on their side, affecting the keys they hold for the Solflare validator. They are investigating. As a result, the Solflare validator is currently not producing rewards. Your SOL is safe.”

Solflare has not named the provider, and it has not said what happened to the keys or when.

In brief

Solflare says a security incident at its staking provider affected the keys for its Solana validator.
On-chain data shows the validator stopped voting about an hour before the announcement, with around 1.56 million SOL staked to it.
Solflare says users’ SOL is safe, and that stakers will move to a new validator through the Solflare app.
A compensation plan for missed rewards is being worked on, according to Unchained.

What the chain shows

Public Solana network data backs up the outage. A TSN query of Solana mainnet at 15:56 GMT on 28 October listed the Solflare vote account (EXhYxF25PJEHb3v5G1HY8Jn8Jm7bRjJtaxEghGrUuhQw) as delinquent, meaning it has stopped voting on blocks. It had 1,559,012 SOL of active stake, about 0.36% of all staked SOL on the network. Its last recorded vote was for a block produced at 22:29 GMT on 27 October, roughly an hour before Solflare’s post.

Validators earn rewards for themselves and their delegators by voting. A validator that is not voting earns nothing, so the people staked to it lose income for as long as it stays down. The validator tracker Stakewiz shows the same validator, listed under the name Solflare, with the same stake and delinquent status.

What Solflare is telling stakers

Solflare has given more detail to its users, as reported by Unchained. According to Unchained, Solflare said delegated SOL “sits in your own stake account and is controlled by your keys alone”, and that “No user funds were touched.”

Solflare is moving to a new validator, so stake “will need to move too”, Unchained reports. No action is needed yet; an app update will guide users through the move, though no date has been given. Rewards stay paused “until your stake is active on the new validator”, and Solflare is “working on a compensation plan for everyone who migrates”, Unchained says. It has not said how large that compensation will be or how it will be worked out.

Solflare also warned that the migration “will only happen through the Solflare app”, and that it will never contact users by direct message or send them a link about it, according to Unchained.

Why the keys matter less than the migration

On Solana, staking does not hand your coins to the validator. Each delegation sits in a stake account with its own authorities, and the Solana documentation says only the account’s withdraw authority can move undelegated SOL out of it. That design is why Solflare can say that stakers’ principal was not affected even though the validator’s keys were. The cost so far is lost rewards, not lost coins.

The bigger risk now is the move itself. Every staker will need to switch, and a mass migration is an obvious opening for fake “migration” links and impostor accounts. Solflare’s warning that it will never send a link is the most important line in its update. Anyone staked with Solflare should wait for the update in the official app and ignore direct messages. Recent cases show how much rides on key handling and on third parties: Solana trading bot Bloom said attackers drained 9,408 SOL through a third-party module, and the Polkadot Community Foundation said a Fearless Wallet browser extension leaked users’ private keys.

Moving also takes time. The Solana documentation says delegating and deactivating stake take several epochs to complete, with limits on how much stake can change across the network at once. Stakers may keep missing rewards for a while even after they act, which is why the compensation terms will matter.

What is still unknown

The incident raises questions that Solflare has not yet answered. It has not said which keys were affected, whether anyone outside the provider gained access, or when the incident began. Many wallets rely on outside operators to run their validators, and a single operator failure can take a large block of stake offline at once. A recent Fidelity FCAT report found Solana’s resilience improving but concentration risks remaining. The network has also been upgrading its consensus with Alpenglow, but no protocol change removes the need to protect validator keys.

Solflare’s X profile notes that its content there is not intended for UK users, so UK customers may need to rely on the app itself for updates.

For now, stakers’ coins appear safe while their rewards are on hold. Solflare’s next update, on the migration and on compensation, will show how well a self-custody design holds up when a trusted operator fails.