Blockdaemon reports key compromise across five Solana validators

Blockdaemon says keys associated with five of its Solana validators were compromised between October 26 and October 27, allowing an attacker to change each validator vote account’s withdrawal authority and transfer assets from operational accounts.

The infrastructure provider disclosed the five-validator count in an incident report updated October 28. It described the transferred assets only as a “limited” amount of operational funds and published no SOL value, transaction list or affected-validator addresses. That prevents an independent calculation of the loss from the available source packet.

Blockdaemon said it had observed no further unauthorized activity after 10:29 UTC on October 27. That cutoff describes the company’s monitoring window when the report was prepared; it is not proof that the investigation is complete or that every related address has been identified.

Vote accounts and delegated stake are separate

The compromise affected validator identity and vote accounts used to participate in consensus and receive operational rewards. It did not, according to Blockdaemon, transfer the SOL that customers had delegated to those validators.

That distinction follows Solana’s account structure. The network’s official documentation describes the Vote program as managing validator voting state and rewards, while the Stake program manages delegations. Individual stake accounts have their own stake and withdrawal authorities. Delegating SOL to a validator therefore does not give the validator operator ownership of the delegator’s stake-account principal.

Blockdaemon said none of the delegated SOL or rewards already credited to customer stake accounts moved during the incident. Those customer-impact findings remain company assertions rather than an independently published forensic conclusion. The report does not disclose the amount of SOL delegated to the five affected validators, so it is not possible to quantify the total stake exposed to interrupted rewards.

Control of a validator vote account still matters. Blockdaemon said the unauthorized withdrawal authority can change the validator’s commission and that the compromised accounts can no longer be funded to vote. The company expects the affected validators to stop generating rewards beginning with Solana epoch 1070.

Epoch 1070 is an operational milestone, not a fixed wall-clock deadline supplied in the report. Solana processes delegation and deactivation changes at epoch boundaries, and the official staking documentation warns that the exact duration can depend on network-wide activation and deactivation activity.

Customers are being moved to replacement validators

Blockdaemon instructed affected delegators to deactivate their stake and redelegate it to a newly created validator. It said all affected customers had been notified and that customers who received no notification did not need to take additional action.

Deactivation and redelegation do not happen instantaneously. Solana documentation says a stake account changes activation status at epoch boundaries and that network limits can cause the process to span multiple epochs. Delegators may therefore experience a period without rewards even though their principal remains under their own stake-account authorities.

The company also warned about look-alike validator addresses appearing onchain. Its incident page publishes the intended replacement vote-account address and advises customers to verify the complete address before signing. That warning does not establish that any customer has transferred stake to an impersonating validator.

Root cause remains under investigation

Blockdaemon attributed the exposure to keys created under an older key-generation practice that it says has since been discontinued. It reported rotating withdrawal authorities for unaffected Solana validators and restricting access to existing key stores.

The company said its investigation and outside forensic work had found no evidence that current validator servers, Ethereum infrastructure, customer data, wallet products or other protocol operations were compromised. Because no external forensic report was published with the update, those scope conclusions cannot yet be evaluated independently.

Blockdaemon has promised affected customers a post-incident report covering root cause, scope and remediation. Until that record appears, the defensible conclusion is narrow: five validator vote accounts lost authority control and operational assets moved, while available documentation and the provider’s monitoring found no transfer of delegated principal. The missing loss amount, transaction inventory and completed forensic report remain material limitations.