Blockchain auditing firms continue to be trying to puzzle out how online hackers acquired use of 8,000 private keys accustomed to drain Solana-based wallets.
Investigations are ongoing after attackers were able to steal some $5 million price of Solana (SOL) and Solana Program Library (SPL) tokens on Wednesday. Ecosystem participants and security firms are assisting in uncovering the intricacies from the event.
Solana has labored carefully with Phantom and Slope.Finance, the 2 Solana-based wallet suppliers that had user accounts impacted by the exploits. It’s since emerged that a few of the private keys which were compromised were directly associated with Slope.
Blockchain audit and security firms Otter Security and SlowMist aided in ongoing investigations and unpacked their findings in direct correspondence with Cointelegraph.
Otter Security founder Robert Chen shared insights from first-hands use of affected sources together with Solana and Slope. Chen confirmed that the subset of affected wallets had private keys which were present on Slope’s Sentry logging servers in plaintext:
“The working theory is the fact that an assailant in some way exfiltrated these logs and could make use of this to compromise you. This really is still a continuing analysis, and current evidence doesn’t explain all the compromised accounts.”
Chen also told Cointelegraph that some 5,300 private keys which were not an element of the exploit were based in the Sentry instance. Up to 50 % of those addresses have tokens inside them — with users advised to maneuver funds should they have dirty so already.
The SlowMist team found an identical conclusion after being asked to evaluate the exploit by Slope. They also noted the Sentry service of Slope Wallet collected the user’s mnemonic phrase and key and sent it to o7e.slope.finance. Once more, SlowMist couldn’t find any evidence explaining the way the credentials were stolen.
Cointelegraph also arrived at to Chainalysis, which confirmed it had become transporting out blockchain analysis around the incident after discussing initial findings online. The blockchain analysis firm also noted the exploit mainly affected users which had imported accounts to or from Slope.Finance.
As the incident absolves Solana from bearing the brunt from the exploit, the problem has highlighted the requirement for auditing services of wallet providers. SlowMist suggested that wallets ought to be audited by multiple security companies before release and known as for free development to improve security.
Chen stated that some wallet providers had “flown underneath the radar” if this found security in comparison with decentralized applications. He wishes to begin to see the incident shift user sentiment toward the connection between wallets and validation from exterior security partners.
