Notes

Experts Discover Private Keys on Slope Servers. Still Puzzled over Access

Blockchain analysis firms involved in the Solana investigation of the Solana exploit decode the latest developments as teams try to discover how private keys were stolen.



Blockchain auditing firms are trying out to figure what the hackers did to gain access to 8,000 private keys that were used to drain the Solana wallets.



Investigations are ongoing after attackers stole approximately $5 million worth of Solana (SOL) and Solana Program Library (SPL) tokens on Wednesday. Security firms and ecosystem participants assist in identifying the intricacies of the event.



Solana has been working closely with Phantom and Slope.Finance, the two Solana-based wallet companies that had user accounts affected by the exploits. Since then, it's been discovered that a portion of the compromised private keys were linked to Slope.



Blockchain audit and security firm Otter Security and SlowMist supported ongoing investigations and released the findings directly in correspondence to Cointelegraph.



Robert Chen, founder of Otter Security, shared his insights gained from having first-hand access to affected resources in collaboration with Solana and Slope. Chen confirmed that a portion of affected wallets had private keys that were present on plaintext Sentry log servers at Slope.



Chen also revealed to Cointelegraph that 5,300 private keys that weren't part the exploit were discovered in the Sentry instance. Nearly half of these addresses contain tokens. Users are urged to transfer money if they haven't already.



The SlowMist team came to a similar conclusion after being contacted to analyze the exploit by Slope. The Sentry service of Slope Wallet took the user's private key, mnemonic phrase, and sent the credentials to o7e.slope.finance. Once again, SlowMist could not find any evidence explaining how the credentials were stolen.



Chainalysis was also contacted by Cointelegraph and confirmed that the company was conducting a blockchain analysis of the incident, and shared its initial findings online. The exploit affected users who transferred accounts to or from Slope.Finance.



While Solana is not responsible for the vulnerability The incident has brought attention to the need to review wallet providers. SlowMist suggested that wallets be audited by a variety of security firms prior to release and called for open source development to enhance security.
extrememining.org


Chen stated that some wallet providers had "flown under the radar" when it came to security when compared to decentralized apps. Chen hopes that the event will change the attitude of users towards the relationship between wallets and validation from security partners.


Homepage: https://extrememining.org/