Solana wallet provider Solflare has suspended staking rewards on its validator after a security incident involving a third-party staking operator, affecting roughly 1.6 million SOL delegated to the service.

In an announcement posted on X (Twitter) on October 27, Solflare confirmed that the incident affected validator keys held by an external provider, leaving the company's validator unable to generate rewards. The third-party operator is investigating the compromise, while Solflare prepares to migrate affected delegations to a replacement validator.

Solflare stressed that customer funds remain secure, with no reported losses or unauthorized transfers from users' staking accounts. According to the company, the disruption affects reward generation rather than ownership or custody of the underlying SOL.

Validator Key Incident Disrupts Staking Operations

The affected provider manages keys tied to Solflare's validator infrastructure, which processes transactions and participates in Solana's proof-of-stake consensus. The security incident prevented the validator from carrying out its normal reward-generating duties.

Solflare has not identified the provider, disclosed how the keys were compromised, confirmed whether an attacker used them to perform unauthorized operations, or specified the precise timing of the incident.

Data from validator analytics provider Rated shows approximately 1.6 million SOL delegated to Solflare's validator, placing a substantial amount of delegated stake under the affected reward-generating operation.

Unlike custodial staking services, Solana's native delegation mechanism keeps tokens in stake accounts controlled by their owners. Validator operators cannot withdraw the principal using their validator signing keys. As a result, the affected infrastructure cannot directly transfer users' delegated SOL, although its inability to operate normally interrupts rewards until those positions are moved to a functioning validator.

Migration Plan and Compensation in Development

Solflare is establishing a replacement validator and developing an application update to guide users through transferring their delegations. Affected customers do not need to take immediate action. Once the updated application becomes available, users will be able to complete the migration through an official in-app process.

Staking rewards will remain suspended until the delegated SOL becomes active on the replacement validator. Solflare is also developing a compensation plan for users who complete the migration, though the company has not disclosed the proposed payout amount, calculation method or distribution schedule.

The wallet provider emphasized that migration instructions will appear exclusively inside the Solflare application. Its team will not send private messages or external links requesting wallet connections, recovery phrases or transaction approvals. The warning reflects a recurring pattern in cryptocurrency security, in which impersonators exploit service disruptions to pose as support staff and solicit recovery phrases or transaction approvals from users.

Incident Follows Other Crypto Infrastructure Breaches

The disruption follows several recent security incidents involving external service providers and cryptocurrency infrastructure. On October 1, MetaMask exited Lido validators following a security incident affecting its staking infrastructure, initiating precautionary validator exits while maintaining that customer withdrawal credentials had not been compromised.

On October 27, Coinbase disclosed a separate third-party security incident involving analytics provider Amplitude. That exposure affected limited customer contact information rather than staking operations, with Coinbase confirming that its internal systems and customer assets were unaffected.

The incidents involved different systems and operational consequences. Solflare's immediate disruption is limited to validator performance and missed staking rewards, with the delegated principal remaining under customer control. A shared element across the episodes is reliance on outside providers for critical operations, underscoring third-party risk as a recurring theme in cryptocurrency infrastructure security.

Solflare has not announced a release date for its guided migration update or finalized the compensation terms. The provider's investigation remains underway, and affected delegators are awaiting the new validator's activation before rewards can resume.

Source: Crypto Adventure