Solflare enters 'bunker mode' after crypto attacks

What happened

Solflare, a wallet built for the Solana network, has placed new limits on who can reach its infrastructure and alter its code after a run of security incidents across the crypto sector. Co-founder Vidor said in a November 2 statement that the development team had entered "bunker mode," a posture in which access to infrastructure and code is closed off, each change requires multiple approvals and no new additions are allowed into its systems. Vidor acknowledged the measures would slow the company's development work and said he accepted that trade-off.

The announcement came after Binance disclosed an October 29 breach involving about $6.3 billion in affected crypto assets. The exchange's preliminary investigation identified a potentially compromised engineer's laptop as one possible entry point and said attackers may have reached internal infrastructure used to authorize withdrawals. Separately, Keystone reported that unauthorized access to its website exposed buyers' personal information; the hardware wallet maker said private keys and recovery phrases were not affected, though the leaked data raised phishing concerns. Blockonomi also reported that Brazilian exchange Mercado Bitcoin suspended customer withdrawals after finding unauthorized activity in its systems.

Solflare's own October disruption had a different origin. On October 27, the wallet said a third-party staking provider had reported a security incident involving keys the provider held for Solflare's Solana validator. The validator stopped producing staking rewards while the provider investigated. Solflare said delegated SOL remained in users' individual stake accounts, which are controlled by their private keys, and that no customer funds were touched. The company set up a replacement validator, extended its migration deadline to November 30 and said it would cover rewards missed from October 26 to November 1 for users who complete the move. It also warned that migration would happen only through the Solflare app and that it would never DM users or send a link.

Why it matters

Solflare's move underscores how security concerns are reshaping operations at crypto firms, not just customer-facing features. A wallet's infrastructure and code pipeline are sensitive because changes there can affect how funds are accessed and how transactions are authorized. By requiring multiple approvals and pausing new additions, Solflare is deliberately accepting slower development in exchange for tighter control. The episode also highlights third-party risk: Solflare's staking rewards interruption came from a provider's systems, even as the wallet's own lockdown addresses internal access. Solflare has sought to draw a line between validator keys and customer-owned stake accounts, saying the former do not give an operator the ability to move delegated SOL.

What the data shows

The reports cite several figures around the incidents: about $6.3 billion in affected crypto assets in the October 29 Binance breach, roughly 1.56 million SOL delegated to Solflare's affected validator on October 28, and about $135,000 moved from five Solana validators in Bitquery's tracing. Solflare's compensation window for missed staking rewards runs from October 26 to November 1, and the deadline to migrate stake to the replacement validator is November 30.

Background

The restrictions arrived during a difficult October for crypto security. Binance's breach, described by the exchange as under preliminary investigation, was followed by Keystone's website exposure and Mercado Bitcoin's withdrawal suspension. Solflare's validator issue emerged on October 27, two days before the Binance disclosure. Blockchain monitoring cited by Unchained showed about 1.56 million SOL delegated to the affected Solflare validator on October 28, when it had stopped voting and was no longer generating rewards. A separate October 29 Bitquery investigation traced unauthorized transfers from keys associated with several Solana validators, including Solflare's, and estimated the attacker moved about $135,000 in assets from five validators. Bitquery distinguished those operator-held assets from customer funds in delegated staking accounts.

What is still unclear

The reports do not specify how long Solflare's "bunker mode" will last or when paused additions to its systems might resume. They also do not name the third-party staking provider involved in the validator incident, which Solflare said was investigating. Binance described its findings as preliminary, leaving the full scope of that breach unresolved in the reports.

What to watch

Solflare users face a November 30 deadline to move delegated SOL to the replacement validator through the company's app. The wallet says rewards resume once transferred SOL becomes active on the new validator, though Solana's epoch-based staking system can add time to that process. Solflare has also warned that scammers may try to exploit the migration, stressing that it will not send direct messages or links. How quickly the company returns to its normal development cadence is another point to watch after the self-imposed slowdown.

Questions readers ask