UPDATE: Solflare Opens Validator Migration as Onchain Review Finds a Wider Key Theft

Frank Joaquin

Date: October 30, 2026

Solflare has opened an in-app migration from its disabled legacy validator and says users who move by 1 November will receive missed staking rewards automatically during November. The update follows a third-party provider incident that stopped rewards on approximately 1.56 million delegated SOL.

The replacement process is available through the latest Solflare application under “Move your stake.” Solflare warns that it will not send direct messages or external migration links. Principal remains in each user’s stake account and was not transferable by the compromised validator keys.

The case is broader than a single reward outage. A Bitquery transaction reconstruction found that one attacker used keys associated with five validators, including active validators branded by Solflare, Blockdaemon and Astraeus. It traced 1,343 SOL, worth about $135,000 at the time, from validator-controlled accounts through cross-chain services, with 57 ETH ultimately entering Tornado Cash. Bitquery

The chain establishes that the same actor controlled the affected keys and moved validator funds. It does not establish how the keys were obtained or prove the identity of the hosting provider. Solflare has not publicly named that provider.

Independent validator data on 30 October showed roughly 1.47 million SOL still delegated to the legacy validator and about 149,000 SOL on the replacement, leaving most of the affected stake temporarily without rewards. These figures can change rapidly as migrations reach epoch boundaries.

TOKEN RECON ASSESSMENT

The material update is a live compensation path and evidence that the key incident reached several validators, not just Solflare. Delegator principal was protected by Solana’s separation of stake-account authority from validator keys, but operational concentration allowed one compromise to halt rewards across multiple branded services. The next confirmation points are the provider’s identity, a root-cause report, validator-key rotation, restored vote performance and completed compensation.