# Solflare's staking provider has validator keys compromised; rewards halted on ~1.6M delegated SOL · pwn.watch > Solana wallet Solflare said on Oct 27 that its third-party staking provider suffered a security incident affecting the keys it holds for the Solflare validator, so the validator no longer earns rewards. Delegated SOL stays in users' own stake accounts and Solflare says no funds were touched. It is preparing an in-app migration to a new validator and a compensation plan, and says migration will happen only inside the Solflare app, never through DMs or links. Page: https://pwn.watch/i/solflare-staking-provider-validator-key-compromise-oct-2026 · generated 2026-10-28T11:31:58.937Z ## Status - Severity: medium · status: live · patch: partial - Product: Solflare validator (third-party staking provider) - Started: 2026-10-27 - Affected: SOL delegated to the Solflare validator - Fixed in: Migration to a replacement validator via a coming Solflare app update ## Follow this incident - RSS (one item per update): https://pwn.watch/i/solflare-staking-provider-validator-key-compromise-oct-2026/feed.xml - JSON Feed: https://pwn.watch/i/solflare-staking-provider-validator-key-compromise-oct-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/solflare-staking-provider-validator-key-compromise-oct-2026.json - This file: https://pwn.watch/i/solflare-staking-provider-validator-key-compromise-oct-2026/llms.txt ## Updates (newest first) - 2026-10-28: Validator trackers show about 1.56 million SOL delegated to the affected node; the provider is still unnamed and investigating. (https://thedefiant.io/news/security/solflare-validator-stops-earning-rewards-after-provider-security-incident) - 2026-10-27: Solflare discloses that its staking provider's keys for the Solflare validator were compromised; the validator stops producing rewards, user SOL is safe, and a migration plus compensation is being prepared. (https://x.com/solflare/status/2115223521395896530) ## Fix brief # Security brief: Solflare's staking provider has validator keys compromised; rewards halted on ~1.6M delegated SOL Source: https://pwn.watch/i/solflare-staking-provider-validator-key-compromise-oct-2026 · status: live · severity: medium · updated Oct 28, 2026, 10:30 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is Solana wallet Solflare said on Oct 27 that its third-party staking provider suffered a security incident affecting the keys it holds for the Solflare validator, so the validator no longer earns rewards. Delegated SOL stays in users' own stake accounts and Solflare says no funds were touched. It is preparing an in-app migration to a new validator and a compensation plan, and says migration will happen only inside the Solflare app, never through DMs or links. Severity detail: Validator keys compromised at a third party; user funds reported safe, rewards paused - Product: Solflare validator (third-party staking provider) ## Affected versions - SOL delegated to the Solflare validator ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - Migration to a replacement validator via a coming Solflare app update After upgrading, re-run the checks above and redeploy/restart the affected services. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Specific notes No action needed yet. Migrate stake only through the official Solflare app update; ignore DMs or links offering migration help. ## Latest updates - Oct 28, 2026: Validator trackers show about 1.56 million SOL delegated to the affected node; the provider is still unnamed and investigating. - Oct 27, 2026: Solflare discloses that its staking provider's keys for the Solflare validator were compromised; the validator stops producing rewards, user SOL is safe, and a migration plus compensation is being prepared. ## Advisories - [Update on Solflare SOL staking](https://x.com/solflare/status/2115223521395896530) (Solflare) ## Write-ups & news - [Solflare Validator Stops Earning Rewards After Provider Security Incident](https://thedefiant.io/news/security/solflare-validator-stops-earning-rewards-after-provider-security-incident) - [Solflare says staking provider security incident halted its validator's rewards](https://cryptobriefing.com/solflare-staking-provider-security-incident-rewards/) --- Machine-readable: https://pwn.watch/i/solflare-staking-provider-validator-key-compromise-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.