Update, 29 October 2026, 12:30 UTC: Solflare’s replacement validator is live, and the company has pledged to pay the missed staking rewards of every user who moves to it, CoinDesk reported on 29 October. Stakers can unstake from “Solflare (Legacy)” and delegate to the new validator themselves, or wait for an app update that guides the move; no compensation amount or period has been announced. On Stakewiz, at 11:32 UTC on 29 October, the old validator was still delinquent, with 1,526,587 SOL delegated to it.
Solflare, the self-custody Solana wallet, said late on Tuesday 27 October that a security incident at one of its staking providers affected the validator keys that provider held for the Solflare validator. The validator has stopped producing staking rewards. According to the company, the SOL delegated to it was not touched and stays in each user’s own stake account. On Wednesday 28 October, Solflare said a replacement validator was live, according to CoinDesk. “User funds are safe,” Solflare said, as quoted by The Defiant.
That validator is not small. The tracker validators.app showed 1,559,012 SOL of active stake on it in its 05:44 UTC scoring run on 28 October, about 0.4% of all staked SOL. At $101.8 per SOL, the price in Coindaro’s market snapshot of 05:43 UTC that day, the stake was worth roughly $159 million. The Defiant reported the same figure of about 1.56 million SOL from validator trackers. A day later the stake had barely moved: Stakewiz, a different tracker, counted 1,526,587 SOL still delegated at 11:32 UTC on 29 October, about 32,400 SOL less (roughly 2%).
What happened to the Solflare validator
The account so far rests on Solflare’s own statement, posted on X and relayed by several outlets. Per Spendnode’s summary, the provider that ran the validator told Solflare the keys it held were affected and is still investigating. Those were the provider’s keys, not Solflare’s internal systems and not individual user wallets.
Solflare has not named the provider. No outlet we found has either. When Crypto Briefing published its report at 19:42 EDT on 27 October (23:42 UTC), neither CoinDesk nor The Block had covered the incident. CoinDesk reported on it on 29 October, also without naming the provider.
The on-chain picture fits a validator that is down. On validators.app, the Solflare row (6% commission, Jito’s client version 4.3.2, member of the Jito stake blockchain that runs exactly as written when it is called, holding and moving funds according to its code, without an intermediary able to change the outcome.">smart contract holding reserves of two or more tokens, supplied by users, that a decentralized exchange uses to execute trades automatically at a price set by a formula.">pool) carries a red “delinquent” tag. The tracker shows no data centre for the node. Stakewiz showed the same picture at 11:32 UTC on 29 October: delinquent, with zero epoch credits.
Why the 1.5 million SOL staked stays in users’ accounts
Staking on Solana does not hand coins to the validator. Each delegator holds a separate stake account, and two keys control it. According to Solana’s documentation on stake accounts, the stake authority signs to delegate, deactivate, split or merge the stake, while the withdraw authority “holds more control over the account as it is needed to liquidate the tokens”. In a wallet like Solflare, both normally sit with the user.
The validator’s own keys are not among those authorities, so whoever holds them has no signature that counts on a delegator’s stake account. Summing up Solflare’s statement, Crypto Briefing writes that delegated stakes “are still sitting in each user’s own stake account, fully under that user’s control.” That is how self-custody is meant to work: the wallet and its partners never hold the coins.
There is also no protocol penalty eating into the stake. Solana’s staking page states: “There is no in protocol implementation of slashing currently.” A stalled validator costs its delegators the rewards it no longer earns, not their principal.
What is still unknown
Quite a lot. Solflare and its provider have not said:
- which company ran the validator, or whether its other validators are affected;
- what happened to the keys, when, and whether they were stolen or access was simply lost;
- how many people delegate to the validator, and from which epoch rewards stopped;
- whether the compromised keys were used for anything, such as a commission change;
- the date of the app update that will guide the migration, and the amount, period or formula of the compensation;
- which validator replaces the old one: no source we could open gives its name or vote account, and Stakewiz lists no other validator under the Solflare name.
Solflare’s card balances, USDC and point-of-sale spending are a separate product. Spendnode’s analysis, not a Solflare statement, says the incident does not reach them.
Two routes to the replacement validator, and a pledge on missed rewards
On 27 October, Solflare told users that no action was required yet, according to Spendnode’s account of its post on X. A day later the plan had moved on. The replacement validator is live, and Solflare has pledged to cover the missed rewards of every user who moves to it, CoinDesk reported on 29 October. Phemex News and ChainCatcher, citing Solflare’s post on X, carry the same terms. We could not open that post ourselves, so the terms given here are Solflare’s statement as relayed by these outlets.
Two routes lead there. A staker can do a regular unstake from the validator now listed as “Solflare (Legacy)” in the app, then stake the SOL with the new validator. Or the staker can wait for an app update that will guide the migration in a few steps. Rewards stay paused until the stake is active on the new validator. Solflare has given no amount, no period and no formula for the compensation; ChainCatcher writes that the details will be announced later.
The move is not instant. Stake changes on Solana take effect at epoch boundaries, roughly two days apart, CoinDesk notes, so the old delegation has to wind down before the new one starts earning. Solana’s documentation warns that a delegation or deactivation “takes several epochs to complete” and that the exact duration is hard to predict. Each stake account delegates to one validator at a time.
Stakers also keep routes of their own, because the stake authority is theirs: they can deactivate and later withdraw the SOL, or point a stake account at a validator outside Solflare. The pledge, as CoinDesk reports it, covers users who move to the replacement validator; it says nothing about those who stake elsewhere. Where and how to stake is each holder’s call.
The migration is a scam magnet
Any announced migration draws fake ones. Solflare says the move will happen only inside its app and that it will never send direct messages or links to users, Spendnode reports. CoinDesk relays the same warning on 29 October. A message offering to “help migrate” your stake, a link to a look-alike site, or a request to sign a transaction you did not start in the app is a trap, whatever account it comes from. Our guide on how to avoid crypto scams lists the usual tricks and where to report them.
A wallet drainer only needs one signature. The stake account is safe from the validator’s keys, not from the owner signing away its authorities on a fake page.
Solana delegation in two minutes
On Solana, validators earn inflation rewards in proportion to the stake delegated to them and keep a commission, here 6%, before passing the rest on. A wallet that offers staking usually runs or sponsors its own validator and outsources the machines and keys to an infrastructure firm. That arrangement is what broke here. The coins never moved; the yield stopped.
The next steps to watch are the app update that will guide the migration and the announcement of the compensation amount and period. The provider, meanwhile, still has not said who it is or what its investigation found.