Solana’s Slope wallet exploited, $4.5M lost to hackers

Solana, the layer 1 blockchain, was affected by an exploit this week causing 8000 users of the Slope wallet to have the content of their wallets drained. The total amount of lost assets sums up to approximately $4.5M. Solana Status, the blockchain’s hub for data and system performance, said that there is no evidence that the Solana protocol or its cryptography was compromised. 

Let’s have a look at the exploit and what caused it.

What caused the exploit

The hack seems to have originated from a vulnerability in Solana’s Slope wallet. It appears to have affected addresses that were at one point created, imported or used in Slope’s mobile wallet. The exact details remain under investigation but early research indicates that private key information was being stored in plain-text on centralized servers. 

Resistance from good actors

One unidentified developer proposed a type of DDOS attack on the wallet of the hackers, which could slow down the transactions of the exploiters. This would be achieved by issuing a certain type of transaction that would put a brief lock on the target account/wallet. 

An unknown number of white hat hackers went on to use the proposed method to spam the hackers’ wallets. SolBlaze claims that they have significant evidence that the spamming did slow down the hackers. 

The spamming slowed down the hackers but also had negative effects on the blockchain. Because the network was being spammed it caused RPC servers, which facilitate network traffic, to start crashing. This was not the intention of the spamming but it unearthed a bug related to how the RPC servers handle requests. Luckily Yakovenko, Solana’s co-founder, was quick to patch the RPC issue. 

How to prevent this from happening to you

You might be wondering how you can prevent these kinds of hacks from happening to you. That's easy. The reason the exploiter was able to withdraw funds from the affected wallets is because they were all hot wallets. 

Hot wallet

Hot wallets are a type of crypto wallet that is directly connected to the internet. Metamask is the best example of a hot wallet. Hot wallets are the most used wallet type because they are easy to set up and start using. 

Cold wallet

A cold wallet is a type of wallet that is not directly connected to the internet. Ledger and Trezor are currently the biggest providers of hardware wallets, which are the most used type of cold wallets. Hardware wallets store your private key on a physical drive, making it near to impossible for hackers to gain access to your funds. If a hacker or some other kind of bad actor wanted to steal your assets from your cold wallet, they would have to be able to access the physical wallet and also know the pin-code to the wallet. This is the reason a cold hardware wallet is the safest method of storing your precious cryptocurrency.

Conclusion

If the Slope developers had practiced standard safety procedures it would not have been possible for the private keys to get leaked. Let’s hope this will be a valuable lesson to crypto wallet developers. We will have to wait and see how the lost funds will be recovered or recouped to affected users.

Even though there have been many issues in the past year regarding the Solana blockchain, it is worth noting that the problems did not stem from the blockchain itself. Solana was known as a ‘bad chain’ because of multiple occasions of extended downtime, but it has proven itself to be more resilient than before, especially after upgrades to its performance had been rolled out. Going forward we can expect the Solana blockchain to keep on rolling out improvements and implement positive changes. Solana might not be as decentralized as Ethereum, but it sure is fast and cheap.

Finally, if you want to safeguard yourself against any similar threats in the future, you must get yourself a cold wallet. It is the safest method of storing your cryptocurrency and will always be recommended by crypto advocates. Stay safe!