The Solana Foundation says exploited addresses were “created, imported, or used” in Slope mobile wallets and there's “no evidence” the protocol was compromised

Decrypt 2022-08-05 Andrew Hayward

Context & Ripple Effects

Reports of wallets being emptied of SOL and USDC had established a broad user-impact incident before the Foundation narrowed the apparent exposure to addresses associated with Slope mobile wallets. That distinction matters because it directs the immediate investigation toward wallet use and key handling rather than Solana's base protocol.

First-order effects

Slope users whose addresses were created, imported, or used in its mobile wallets are the population most directly implicated by the Foundation's assessment.
The Solana Foundation can separate the wallet incident from a confirmed protocol breach, while affected users still face the consequences of the earlier wallet draining.

Second-order effects

Slope becomes the focal point for remediation and user communication, since the reported common factor is its mobile-wallet address lifecycle rather than the Solana protocol.
For the Foundation, incident response must distinguish wallet-layer exposure from chain-layer failures; treating them as interchangeable would misdirect users and technical investigation.

Third-order effects

If this separation becomes standard practice, Solana ecosystem security will be assessed more explicitly by layer—wallet creation and import flows, applications, and protocol infrastructure—rather than through a single "network compromised" label.
The Foundation's later account of validators quietly patching a Token-22 minting and draining vulnerability underscores that wallet incidents and protocol flaws require different disclosure and response paths.

The trend: Crypto security response is moving toward layer-specific attribution, separating wallet and application compromise from underlying protocol failures.

Discussion

NullTX Mark Arguinbaev on x
Ethereum Price Holds Above $1,600 as Crypto Markets Slow Down
@solanastatus @solanastatus on x
After an investigation by developers, ecosystem teams, and security auditors, it appears affected addresses were at one point created, imported, or used in Slope mobile wallet applications. 1/2
@zellic_io @zellic_io on x
4/ The Slope Wallet for iOS and Android uses Sentry for event logging. Any interaction in the app would trigger an event log. Unfortunately, Slope didn't configure Sentry to scrub sensitive info. Thus, mnemonics were leaked to Sentry s/o to @sniko_ for this screenshot: https://tw…
@solanastatus @solanastatus on x
There is no evidence the Solana protocol or its cryptography was compromised. 3/3
@solanastatus @solanastatus on x
This exploit was isolated to one wallet on Solana, and hardware wallets used by Slope remain secure. While the details of exactly how this occurred are still under investigation, but private key information was inadvertently transmitted to an application monitoring service. 2/3
@phantom @phantom on x
1/ Phantom has reason to believe that the reported exploits are due to complications related to importing accounts to and from @slope_finance. We are still actively working to identify whether there may have been other vulnerabilities that contributed to this incident. https://tw…
@slope_finance @slope_finance on x
Slope statement regarding the breach situation: https://docs.google.com/...
@0xfoobar @0xfoobar on x
Correction - the Slope wallet did not send seed phrases to external partners, but may have logged them on their own centralized servers. Apologies for getting a bit ahead of myself, postmortem still in progress. Wait for an announcement from the team for true confirmation.
@osec_io @osec_io on x
Over $4M was drained from Solana wallets over the past 2 days. We've been working directly with @solana and @slope_finance to investigate. Here's what we found. https://twitter.com/...
@0xfoobar @0xfoobar on x
Solana hack - looks like the Slope wallet sent plaintext seed phrases to external integration partners. Compromised Phantom wallets came from seed phrase imports used in Slope. Compromised ETH wallets were also from seed phrase reuse. Not a blockchain or randomness issue.
@rajgokal @rajgokal on x
the @slope_finance wallet private key leak is incredibly unfortunate and was entirely preventable. the work is ongoing and a full postmortem is yet to come, but in the meantime any slope user (even if seeds were used in other wallets) should move to cold storage. https://twitter.…
@fatmanterra FatMan on x
The recent Solana “hack” was actually due to an accidental leak from Slope wallet's backend (which was potentially compromised). The Solana blockchain remains unaffected. Slope will put out a statement explaining what happened in greater detail shortly.
@fatmanterra FatMan on x
Correction to a previous tweet I made regarding seed phrases: While Slope was indeed able to view user keys as plain text, the external integration did *not* receive these as plain text. My apologies - this is a developing situation; now waiting for official announcements.
@slope_finance @slope_finance on x
See below for our official statement on the breach situation (now posted to our Medium). We empathize with everyone affected, and are doing our best to solve and rectify the situation. https://slope-finance.medium.com/ ...
@coinbureau @coinbureau on x
So the $SOL wallet hack had nothing to do with the network, but compromised private keys created, imported, or used in the Slope mobile wallet It also impacted Phantom users who had imported wallets from Slope. Credit to the Solana devs for their work in finding the root cause.
@lordx64 @lordx64 on x
So the #slope #wallet is more like an insider threat, rather than supply chain hack, or else. I saw this traffic yesterday (see timestamp) going SSL encrypted to slope servers https://o7e.slope.finance/ but I was like nah that can't be malicious but indeed it have the seed phrase…
@chrismaddern Chris Maddern on x
a google doc, really? I feel really bad for Slope, but everything about this has felt odd... https://twitter.com/...
@slope_finance @slope_finance on x
Update: As we work to complete the forensic investigation of yesterday's breach together with our auditing partners @SlowMist_Team & @osec_io, we're calling for the support of the broader community to help us trace & flag attacker wallets & ultimately recover funds.
@lordx64 @lordx64 on x
This traffic was found in the version 2.2.2. of Slope Wallet that I freshly downloaded from the @Apple AppStore. The SHA-256 (pre-thinned) ipa file is this one: 94f0df488452e50d7febf4f8a776b739acd7a9a ac6c441204bff68bae7e06eae
@hudsonjameson Hudson Jameson on x
This investigation and incident response has been a culmination of work of well over 100 people across multiple orgs and blockchain ecosystems. Be on the lookout for information regarding what causes we have ruled out and to (hopefully) quell speculation overall. https://twitter.…
@0xfoobar @0xfoobar on x
Statement from the Slope team https://twitter.com/...
@slope_finance @slope_finance on x
Attackers interacted from @binance to: HYaQcKPcWgLe7gpA99EUbDSGuzJCupNVCRXmXP3 7xYXv Htp9MGP8Tig923ZFY7Qf2zzbMUmYneFRAhSp7vS g4wxV CEzN7mqP9xoxn2HdyW6fjEJ73t7qaX9Rp2zyS6h b3iEu 5WwBYgQG6BdErM2nNNyUmQXfcUnB68b6kesxByw h1J3n GeEccGJ9BEzVbVor1njkBCCiqXJbXVeDHaXDCrB Dbmuy
@gregosuri Greg Osuri on x
Slope uploaded users' mnemonics and private keys in plain text to their servers. We should demand Opensource wallets with better scrutiny by protocol teams. @MoonRankNFT reported it, but I had to see it myself; I never thought a dev could be this negligent, so I ran a trace. http…
@chrismaddern Chris Maddern on x
nightmare case for @slope_finance I feel really bad for a team trying to build in a new space, but hard to imagine how you come back from compromising 15,000 solana wallets https://decrypt.co/...
@zachherbert @zachherbert on x
It looks like the Solana hack is caused by Slope wallet sending the user's seed in plaintext to the company's server. This is why open source is so important. Code needs to be auditable, users need the freedom to build the app from source code. https://twitter.com/...
@mdudas @mdudas on x
<click this link> ffs https://twitter.com/...
@cz_binance @cz_binance on x
If you used a Slope wallet (for SOL) in the past, move your funds to a different wallet ASAP. Do not “import” the old wallet. Use a new private key or seed phrase. If you don't know those words mean, send your SOL to @binance. The easy way. https://twitter.com/...
@ncweaver Nicholas Weaver on x
The most subtle supply chain attack is indistinguishable from a stupid bug... https://twitter.com/...
@cygaar_dev @cygaar_dev on x
We often criticize MetaMask, but their extension is open source which means leaks like the one that happened to Slope are much less likely to happen. I'd love to see an open source Solana wallet competitor come out of this; we need to keep users safer moving forward

Chronicles