Following the attack on the bridge protocol Nomad at the beginning of the week, hackers hacked the Solana ecosystem early on Wednesday, affecting hundreds of wallets. Estimates of the damage vary. Just over $5.2 million in cryptoassets have been stolen so far from more than 7,900 Solana wallets, according to blockchain forensics firm Elliptic. Security company PeckShield said four Solana wallet addresses drained approximately $8 million from victims.
“The root cause is still not clear,” Elliptic’s co-founder Tom Robinson said. “It appears to be due to a flaw in certain wallet software, rather than in the Solana blockchain itself.”
The attack sent Solana’s SOL token down as much as 7.3% to $38.40 in early trading on Wednesday, its lowest in a week. Bitcoin rose 1.3% to $23,327.
The exploit affected users of a digital crypto wallet made by Slope Finance, according to a tweet sent Wednesday afternoon by Solana Status, a Twitter account managed by the Solana Foundation.
“There is no evidence the Solana protocol or its cryptography was compromised,” the tweet said.
Slope confirmed in an official statement that a group of its wallets had been affected and said that its own founders and staff had lost funds. The startup, which raised $8 million in February in a seed funding round led by Solana Ventures and Jump Crypto, is conducting its own investigation into the cause of the hack.
Crypto projects are proving a rich vein for hackers and the industry has suffered numerous attacks this year. Solana’s woes come days after Nomad — a bridge protocol for transferring crypto tokens across different blockchains — lost close to $200 million in a security exploit on Monday. More than $1 billion has already been stolen from bridges in 2022, according to a June report by Elliptic.
“Much remains unknown at this point — except that hardware wallets are not impacted,” Solana spokesman Austin Federa said.
While there’s speculation the incident was a supply-chain attack, the nature of the exploit remains unclear, Federa said. Supply-chain hacks occur when an outside party or provider with access to the victim’s systems and data is infiltrated.
Solana, which has suffered network outages in the past, is a rival to the Ethereum blockchain. As transaction prices on Ethereum rose last year, chains like Solana, which tout their low transaction fees, emerged as alternatives for minting non-fungible tokens. The code underpinning Solana is also popular with clients looking to build their own decentralized-finance applications.
Some NFTs were also stolen in the hack — but the full impact of the exploit is still unclear, Elliptic’s Robinson said.
