Slope Wallet Likely Tied to Solana’s Exploit

  • Solana developers claimed an investigation found no evidence that the protocol or its cryptography were compromised in the widespread exploit.
  • The investigation, however, discovered that the affected wallets were either “created, imported, or used” in Slope’s mobile app at one point in time.


Investigations into Solana’s recent incident suggest that wallet provider Slope could be responsible for the widespread wallet exploit on the network, an account run by the Solana Foundation said on Twitter on 3 August.

According to Solana Status, an investigation by developers, ecosystem teams, and security auditors found no evidence that the “Solana protocol or its cryptography was compromised”. It discovered, however, that the affected addresses were at one point “created, imported, or used in Slope mobile wallet applications”, suggesting that the wallet provider was largely responsible for the security exploit. Slope confirmed that a “cohort” of its wallets were compromised in the breach, stating that:

“We have some hypotheses as to the nature of the breach, but nothing is yet firm. We are still actively diagnosing, and are committed to publishing a full postmortem, earning back your trust, and making this as right as we can.”

Although details of how exactly the incident occurred are still under investigation, Solana Status noted that private key information was inadvertently transmitted to an application monitoring service. Developers for the Phantom wallet confirmed that Slope was the most likely reason for the incident, saying they had “reasons to believe the exploit was due to complications related to importing accounts to and from Slope”.

Reports of the exploit started to appear on Tuesday night, when users started claiming their Solana-based wallets had been drained from funds. Later, it became clear that an attacker had gained the ability to sign transactions on behalf of other users, which had compromised around 8,000 wallets on the network.

Solana’s head of communications, Austin Fedora, later shared that 40% of the drained wallets belonged to Slope users, while 60% were owned by Phantom users. After “extensive interviews and requests to the community” it became clear that not a single wallet affected by the exploit had its seed phrase generated using Phanotm.

Related Coverage
Exploiter Returns 90% of “Recoverable Funds” to Euler Finance
  • The remaining $31 million worth of crypto assets were returned late on Monday, marking a successful end to Euler Finance’s recovery efforts.
  • The total value of assets returned is a little over $177 million, which is 90% of the “recoverable funds” after adjusting for the 10% bounty previously offered.
April 4, 2023, 3:32 PM


Hacker Steals $9M from SafeMoon
  • SafeMoon said that only its SFM:BNB liquidity pool (LP) was affected, and that it had located the suspected exploit, and patched the vulnerability.
  • The bug was allegedly introduced with the latest SafeMoon upgrade, and allowed the attacker to burn the majority of SFM in the pool, artificially inflating its price.
Euler Finance Gives $200M Exploiter an Ultimatum
  • DeFi lending protocol Euler Finance has given the exploiter 24 hours to return 90% of the $197 million he stole in a flash-loan attack on Monday.
  • If the funds were not returned in time, the protocol is ready to post a $1 million bounty on any information that could lead to the arrest of the attacker.