A new blockchain investigation has linked five Solana validator infrastructures to an October security incident in which an attacker took cryptocurrency worth approximately $135,000 and routed 57 ETH through Tornado Cash. Bitquery’s October 29 findings connect operational-key activity associated with Solflare, Blockdaemon, Astraeus, a validator identified as J21SMP and inactive Slow Ventures infrastructure, providing new evidence that the incident extended beyond the initially reported disruption at Solflare.
The investigation reconstructed transfers involving assets worth approximately 1,343 SOL between October 26 and 28. The attacker consolidated assets from multiple validator accounts, emptied vote accounts, changed withdrawal authorities and moved proceeds through cross-chain services to Ethereum. Approximately 57 ETH subsequently entered Tornado Cash.
The findings point to common control of keys associated with multiple validators, but do not identify the person or group responsible or establish precisely how the keys were compromised. Stakers’ principal SOL was not taken from their stake accounts, although the affected active validators stopped earning rewards.
On-Chain Evidence Connects Five Validator Infrastructures
Bitquery’s October 29 investigation traced the initial transactions to October 26, when identity keys associated with four active Solana validators transferred assets into a common wallet within approximately three minutes. The investigation identified the validators associated with Solflare, Blockdaemon, Astraeus and J21SMP, alongside key activity involving a fifth validator linked to Slow Ventures that had stopped operating in 2024.
The estimated total was 1,343 SOL in asset value, equivalent to approximately $135,000 at the prices used in the investigation. That figure includes more than native SOL. Approximately 637 JitoSOL was taken from the identity accounts associated with Solflare and J21SMP, representing an estimated 833 SOL at the prices obtained when the tokens were sold. JitoSOL is a liquid staking token associated with Jito’s Solana staking infrastructure.
The transfers from identity accounts were followed by withdrawals from validator vote accounts. According to Bitquery, the attacker used withdrawal authorities associated with the affected validators to move additional assets into the same collection wallet. Four active validators subsequently stopped voting at the same point on October 27.
One of the strongest indicators of common control was the use of one validator’s keys to pay transaction fees for transfers involving another validator. Blockdaemon’s operational key paid the fee for a withdrawal from Solflare’s vote account, while other transactions showed Astraeus-associated keys paying fees for transfers involving additional validator accounts.
These connections provide stronger evidence of coordinated control than a shared destination wallet alone. Nevertheless, blockchain transactions establish which keys authorized transfers and where assets moved; they do not independently identify the person controlling those keys or explain how control was obtained.
Blockdaemon’s own incident report, updated October 28, confirmed that operational keys associated with a limited group of its Solana validators had been compromised. The company said unauthorized transactions moved operational assets and changed withdrawal authorities, but its investigation found no evidence of compromise across its broader infrastructure. It also reported that customer data and delegated assets remained unaffected.
Blockdaemon further said its investigation pointed to a discontinued key-generation practice, while the root-cause investigation continued. That provides a more specific explanation for its own affected keys, but does not establish that the same mechanism compromised the keys associated with every other validator in Bitquery’s investigation.
Stolen Assets Moved Through Bridgers, Chainflip and Tornado Cash
The on-chain investigation traced the proceeds from Solana to Ethereum through Bridgers and Chainflip, services used to exchange assets across blockchain networks. The first collection wallet sent assets through these routes to a common Ethereum recipient, which received approximately 56.6 ETH. A second recipient wallet subsequently received additional funds.
Across the two Ethereum wallets, approximately 57.2 ETH arrived, of which 57.0 ETH was deposited into Tornado Cash. Bitquery found that the first deposits occurred less than nine minutes after the initial bridge payout. Most of the funds had entered the mixing protocol within approximately two hours of the first payout.
The investigation also identified a possible rehearsal of the same route on October 15, eleven days before the principal theft. A wallet that later received stolen assets had sent funds through Bridgers toward the same Ethereum destination. This earlier transaction is consistent with advance testing of the route, although the transaction history alone does not establish the operator’s intentions.
Tornado Cash uses pooled transactions to make it more difficult to connect a deposit with a later withdrawal. A deposit therefore complicates straightforward tracing, but does not establish whether funds were successfully withdrawn, converted into fiat currency or recovered by investigators.
The protocol has also featured in separate criminal proceedings. In August 2025, the U.S. Department of Justice announced a conviction involving Tornado Cash co-founder Roman Storm, describing the service as a cryptocurrency mixer used to facilitate untraceable transfers. That prosecution concerned separate conduct and does not establish the identity or intent of the person responsible for the Solana incident.
The movement resembles other cases in which assets linked to earlier exploits were subsequently transferred into privacy protocols. Dave Finances previously examined funds linked to the Drift exploit that were deposited into Tornado Cash, as well as a separate Cysic exploit-linked transfer into the same protocol. These cases illustrate a recurring investigative challenge: following assets across bridges and mixing services does not necessarily reveal their ultimate destination or the identity of their controller.
Stakers Avoided Principal Loss but Face Interrupted Rewards
The most important distinction for Solana users is between the assets held in validator operational accounts and the SOL delegated to those validators by individual stakers.
Bitquery found no evidence that the attacker took SOL from the affected users’ stake accounts. Blockdaemon likewise stated that delegated SOL remained under the control of the relevant staking authorities. The incident therefore involved assets and permissions associated with validator operations, rather than a demonstrated withdrawal of customers’ staked principal.
The operational consequences are nevertheless significant. Once the affected vote accounts had been drained and their withdrawal authorities changed, the validators could no longer fund their voting operations normally. The four active validators subsequently stopped voting, interrupting the generation of future staking rewards for their delegators.
Solflare said it was moving toward a replacement validator and working to address missed rewards. Blockdaemon advised affected customers to deactivate their stake and redelegate to newly created validators. Because Solana stake changes take effect at epoch boundaries, migration is not necessarily instantaneous.
The distinction between principal and rewards is important when assessing the incident’s financial impact. The reported $135,000 represents the estimated value of assets taken from operational accounts; it is not an estimate of losses suffered by all stakers. Separately, the value of future rewards missed while validators remain inactive depends on the amount delegated, the duration of the interruption and the applicable reward rate.
The episode follows another Solana security incident in which 48 wallets linked to the Bloom trading bot were drained in a coordinated operation. That incident directly affected traders’ wallets, whereas the validator event appears to have targeted operational accounts and the infrastructure needed to generate staking rewards. The distinction matters because the two events create different risks and require different remediation.
Key Management and Validator Recovery Remain the Central Questions
The new findings shift attention from an isolated validator disruption toward the security of operational credentials across multiple infrastructures. A validator’s identity key is used for routine operations, while its vote-account withdrawal authority controls the movement of assets held in that account. Compromise of these permissions can therefore disrupt a validator and expose operational funds without necessarily giving an attacker control over delegated customer principal.
Bitquery reported that the four active validators shared a hosting network and software version. Those common characteristics may help investigators narrow the possibilities, but they do not prove that the hosting provider or a software vulnerability caused the incident. Blockdaemon’s explanation points instead to an older key-generation practice that it had discontinued, while its review found no evidence of unauthorized access to the broader infrastructure.
Another unresolved issue is whether the operators have fully regained control of their withdrawal authorities. Bitquery’s October 29 analysis found that the authorities had been moved again to newly generated keys on October 28, but the observed transactions did not establish that the affected operators had recovered exclusive control. That distinction is important because restoring a validator’s ability to vote requires more than simply replacing its software or restarting its server.
The investigation also raises questions about how quickly operators can detect unauthorized transactions across related accounts. Cross-validator fee payments, rapid asset consolidation and subsequent changes to withdrawal authorities provided clues that the activity was connected. Monitoring systems designed to flag unusual movements across operational accounts could help operators identify similar patterns earlier, although the effectiveness of such controls depends on their configuration and access to relevant transaction data.
The wider laundering trail offers another point of comparison. In the Drift exploit-linked transfers into Tornado Cash, investigators also had to distinguish visible on-chain movements from proof of final recovery or cash-out. A similar limitation applies here: the deposits establish where the tracked assets went, but do not reveal who ultimately controls any subsequent withdrawals.
The next meaningful developments will be a completed forensic explanation, confirmation that the affected operators have secured their withdrawal authorities, and clarity on the restoration of staking rewards. Blockdaemon has said it will provide affected customers with a post-incident report covering the scope, root cause and remediation. Comparable detail from the other operators would help determine whether the incident resulted from a shared weakness or separate failures involving related operational credentials.
For now, the strongest conclusion is that on-chain evidence links five validator infrastructures to a coordinated sequence of operational-account withdrawals and cross-chain transfers. The estimated theft reached approximately $135,000, and 57 ETH entered Tornado Cash. Stakers’ principal remained intact, but the four active validators stopped earning rewards. The method used to obtain control of the broader set of keys, the real-world identity of the attacker and the final disposition of the funds remain unresolved.
Johan Shamshad is a financial markets writer at Dave Finances covering cryptocurrencies, trading platforms, brokers, fintech, financial regulation, and developments across global markets. He previously worked at Gulf News, adding newsroom experience to his coverage of fast-moving financial and digital-asset markets.
His work focuses on identifying market-moving events, company developments, regulatory changes, product launches, and shifts in trading and financial infrastructure.
Johan contributes news and analysis designed to help readers understand not only what happened, but why a development matters and how it may affect the wider financial landscape. You can reach out to him via his social media accounts:
Linkedin: https://www.linkedin.com/in/johan-shamshad-742851262/
X: https://x.com/Yasmine_FX
Investing: https://www.investing.com/members/contributors/279781574