From Wormhole to Web3.js: Tracking Solana’s Security Evolution

FaveFave
18 min read

Table of contents

The $325M Wormhole Bridge hack (February 2022) and the $8M Slope Wallet breach (August 2022) were not merely isolated incidents—they were seismic revelations of protocol-level weaknesses and ecosystem-wide dependencies that would define Solana’s security challenges for years to come. This analysis traces how these early crises exposed three existential threats:

  1. The Bridge Problem
    Wormhole’s fake signature exploit proved that cross-chain interoperability—Solana’s killer feature—could become its major weakness when guardianship models and finality checks failed.

  2. The Custody Paradox
    Slope’s plaintext key storage highlighted a brutal truth: Solana’s scalability meant nothing if wallet providers ignored basic encryption. The incident contaminated trust across Phantom, Trust Wallet, and beyond.

  3. The Centralization Trap
    Both incidents shared a common thread—over-reliance on centralized fail-safes, whether Jump Crypto’s bailout or Slope’s insecure servers. True decentralization remained theoretical.

Through 10 additional exploits (2022–2025)—from Cashio’s infinite mint to DEXX’s key leak—we map how these foundational flaws mutated into new attack vectors, while profiling the hard-fought solutions (TWAP oracles, multi-sig mandates) that emerged in response.

Why Revisit the Pain?

  • For builders: To see how design choices bred systemic risk.

  • For users: To understand why "not your keys, not your crypto" became Solana’s mantra post-Slope.

  • For auditors: To trace how attack patterns evolved from smart contract bugs (2022) to supply chain hijacks (2025).

Wormhole Bridge Hack (Feb 2022) – $325M Exploit

Root Causes

  1. Fake Signature Spoofing

    • The hacker bypassed signature verification by exploiting a flaw in how Wormhole checked Ethereum-to-Solana messages.

    • Critical error: Wormhole’s Solana contract did not verify the Ethereum-side transaction was finalized before minting tokens.

  2. Guardian Approval Trick

    • Wormhole relied on 19/20 "guardian" nodes to approve transfers.

    • The hacker faked a guardian vote by manipulating a Solana sysvar (system account) to make it seem like the transfer was approved.

  3. No Replay Protection

    • The same fake approval could be reused to mint unlimited ETH on Solana (though the hacker only did it once).

Repercussions

  • $325M stolen (120k ETH minted out of thin air on Solana).

  • SOL dropped 15% due to panic.

  • DeFi apps froze (e.g., Saber, Solend paused Wormhole-related deposits).

Incident Response

  1. Jump Crypto Bailout

    • Jump Crypto (Wormhole’s backer) replaced all 120k ETH within 48 hours.

  2. Patch Deployed

    • Wormhole fixed the signature check to prevent fake guardian approvals.

  3. Hacker’s Silence

    • The attacker ignored Wormhole’s $10M bounty offer.

Remediations

  1. Strict Finality Checks

    • Now requires Ethereum transactions to be fully confirmed before Solana minting.

  2. Guardian Security Upgrade

    • Guardians now verify full transaction history, not just signatures.

  3. Bug Bounty Boost

    • Max reward raised to $10M for critical bugs.

Lessons Learnt

  1. Never Trust Unfinalized Data

    • Cross-chain bridges must wait for final confirmations from both chains.

  2. Sysvars Can Be Lied To

    • Solana’s sysvar accounts (like recent blockhashes) can be spoofed if not double-checked.

  3. Centralized Backups Are Risky

    • Jump’s bailout saved users but showed bridges still rely on "too big to fail" backstops.

User Losses

  • None directly (Jump covered the stolen ETH).

  • Indirect: Some users faced withdrawal freezes on DeFi apps.

Key Sources

  1. samczsun’s Thread (Technical Deep Dive)

  2. Wormhole’s Official Report

Solana Wallet Drain Attack (August 2022) – $8M Stolen

Root Cause

  1. Supply Chain Attack

    • Malicious code was injected into Slope Wallet (a Solana wallet provider) via:

      • Compromised npm package (@solana/web3.js)

      • Trojanized wallet updates

    • The code secretly exported users’ private keys to attacker servers.

  2. Plaintext Key Storage

    • Slope Wallet improperly stored private keys in plaintext (unencrypted) on centralized servers, contrary to crypto security standards.

  3. Widespread Impact

    • Affected wallets: 9,231+ (including Slope, Phantom, and Trust Wallet users).

Repercussions

  • $8M drained from user wallets.

  • SOL price dropped 5% amid panic.

  • Slope Wallet discontinued post-incident.

Incident Response

  1. Wallet Providers’ Actions

    • Phantom/Trust Wallet: Urged users to migrate to new wallets.

    • Slope: Shut down services permanently.

  2. Solana Foundation

  3. No Full Recovery

    • Most stolen funds were swapped for Monero and lost.

Lessons Learned

  1. Never Store Keys in Plaintext

    • Wallets must use hardware encryption or non-custodial designs.

  2. Audit Third-Party Dependencies

    • The attack spread via a poisoned web3.js package.

  3. Decentralization Matters

    • Centralized wallet providers = single point of failure.

User Losses

  • Slope Wallet users: Full losses (no reimbursement).

  • Phantom/Trust users: Only those who imported Slope keys were affected.

Key Sources

  1. Solana’s Official Report

  2. Chainalysis Investigation

  3. Slope’s Shutdown Notice

Cashio Exploit – $50M Infinite Mint Hack

(March 23, 2022, Solana)

Root Causes

  1. No Root of Trust

    • Cashio had no hardcoded authority to verify which "bank" accounts were legitimate. Attackers created fake banks to mint tokens.

    • Critical flaw: Protocol assumed all accounts in validation chains were honest.

  2. Missing Token Matching Check

    • The contract didn’t verify if the minted CASH token matched the bank’s token.

    • Attackers minted real CASH against a fake bank with zero collateral.

  3. Collateral Validation Bypass

    • The arrow account (used for collateral checks) skipped validation of the mint field, letting attackers spoof deposits.

Repercussions

  • $50M stolen (mostly from liquidity pools).

  • CASH stablecoin crashed to $0 (lost peg permanently).

  • Solana DeFi trust damaged: Followed other 2022 hacks (Wormhole, Mango Markets).

Incident Response

  1. Developer Warning

    • Cashio’s team (@0xGhostChain) warned users within 1 hour to stop minting/withdraw LP funds.

  2. Hacker’s Partial Refund

    • Stole $50M but returned funds to small holders (<$100k) after public pressure.

    • Kept ~$25M, claiming it would be "donated" (no proof).

  3. No Protocol Recovery

    • Cashio shut down after the hack; no relaunch or user compensation.

Remediations (Hypothetical, Post-Hack)

(Cashio didn’t survive, but here’s what should’ve been fixed):

  1. Hardcode Trusted Mints

    • Legitimate CASH mint addresses should be immutable in the contract.

  2. Cross-Account Validation

    • Ensure bank.mint == cash_mint before any transactions.

  3. Zero-Supply Checks

    • Reject collateral from tokens with no circulating supply.

Lessons Learned

  1. "Parallel Universe" Attacks Are Real

    • Attackers can forge entire account structures if there’s no root of trust.

  2. Stablecoins Need Over-Engineering

    • Collateral checks must be redundant and paranoid.

  3. Community Vigilance Matters

    • Researchers like samczsun caught flaws Cashio’s audits missed.

User Losses

  • Liquidity Providers: Lost $50M in pooled funds.

  • CASH Holders: Tokens went to $0 (no recovery).

  • Small Users: Some refunded via hacker’s "appeal process".

Key Sources

  1. samczsun’s Thread (Technical Breakdown)

  2. Cashio’s Final Tweet

  3. Rekt.News Report

Crema Finance Hack – $8.8M Exploit

(July 3, 2022, Solana)

Root Causes

  1. Price Manipulation via Fake Ticks

    • Crema’s concentrated liquidity model (like Uniswap v3) used "ticks" to mark price ranges.

    • Exploit: Attacker created fake tick accounts to trick the protocol into mispricing swaps.

  2. Flash Loan Attack

    • Borrowed $10M+ via Solana flash loans to:

      1. Artificially inflate liquidity in a targeted pool.

      2. Trigger mispriced swaps that drained other LPs’ funds.

  3. Missing Slippage Controls

    • No minimum swap ratio checks allowed the attacker to execute imbalanced trades at skewed prices.

Repercussions

  • $8.8M stolen (mostly from USDC/ETH pools).

  • Protocol paused for 3 weeks to fix vulnerabilities.

  • First major Solana CLMM exploit (damaged trust in concentrated liquidity DeFi).

Incident Response

  1. Emergency Pause

    • Crema halted all pools within 3 hours of detection.

  2. Hacker Negotiation

    • Offered a $800K bounty; hacker returned $1.2M (kept $7.6M).

  3. Partial Refunds

    • Used treasury funds to cover 15% of losses for affected users.

Remediations

  1. Tick Account Validation

    • Added checks to ensure ticks correspond to real liquidity.

  2. Oracle-Based Price Guards

    • Integrated time-weighted oracles to prevent flash loan manipulation.

  3. Dynamic Slippage Limits

    • Enforced minimum swap ratios based on pool depth.

Lessons Learned

  1. Concentrated Liquidity ≠ Safer Liquidity

    • Complex tick systems introduce new attack vectors vs. simple AMMs.

  2. Flash Loans Require Assumptions

    • Protocols must model worst-case borrows (+10,000% APR attacks).

  3. Bounties Can Limit Damage

    • Even partial refunds (12% here) are better than total loss.

User Losses

  • Liquidity Providers: Lost $8.8M (~$1.2M recovered).

  • CLM Token Holders: Price dropped 60% but survived.

Key Sources

  1. Crema’s Official Post-Mortem (Twitter)

  2. Rekt.News Report

Nirvana Finance Hack (July 2022) – $3.5M Oracle Exploit

Root Causes

  1. Low-Liquidity Oracle Manipulation

    • Nirvana relied on internal price oracles for its stablecoin ($ANA), which were vulnerable to price pumping due to the token’s low liquidity.

    • The attacker borrowed ANA (via flash loans), artificially inflated its price, then minted Nirvana’s stablecoin ($NIRV) against the overvalued collateral.

  2. No Time-Weighted Price Checks

    • The protocol used instantaneous prices without TWAP (Time-Weighted Average Price) safeguards, making it easy to manipulate.

  3. Weak Collateralization Checks

    • Did not enforce minimum liquidity thresholds before accepting ANA as collateral.

Repercussions

  • $3.5M stolen (mostly from the protocol’s treasury).

  • ANA token collapsed (dropped ~95% post-exploit).

  • Protocol shutdown: Nirvana Finance ceased operations after the hack.

Incident Response

  1. Emergency Pause (Too Late)

    • Nirvana paused contracts after funds were drained.

  2. Failed Negotiations

    • Team offered a bug bounty, but the hacker disappeared.

  3. No Recovery

    • No treasury funds left to compensate users.

Remediations (Hypothetical, Post-Hack)

(Nirvana didn’t recover, but lessons for other protocols):

  1. Use Decentralized Oracles

    • Switch to Chainlink or Pyth instead of internal price feeds.

  2. TWAP Implementation

    • Require time-weighted prices to prevent flash loan manipulation.

  3. Liquidity Requirements

    • Only allow collateral with sufficient liquidity depth.

Lessons Learned

  1. Low-Liquidity Tokens = High Risk

    • Never trust internal oracles for illiquid assets.

  2. Flash Loans Expose Weaknesses

    • Attackers will always exploit price feed vulnerabilities.

  3. DeFi Protocols Need Contingency Plans

    • Nirvana had no emergency fund to cover losses.

User Losses

  • Lenders & NIRV holders: Lost all funds (no recovery).

  • ANA holders: Token became worthless.

Key Sources

  1. Nirvana’s Final Announcement (Twitter)

  2. Rekt.News Report

  3. SlowMist Thread on Oracle Exploits

Solend Exploit (November 2022) – $1.26M Oracle Manipulation

Root Causes

  1. USDH Price Pumping via Spam Transactions

    • The attacker artificially inflated the price of USDH (a stablecoin) by executing small, rapid trades on low-liquidity pools.

    • Solend’s oracle used the last traded price, allowing the manipulated value to be temporarily accepted.

  2. No TWAP (Time-Weighted Average Price) Protection

    • Solend relied on instantaneous price feeds instead of time-averaged data, making it vulnerable to short-term manipulation.

  3. Low Liquidity in USDH Pools

    • The targeted pools had minimal liquidity, meaning small trades could significantly distort prices.

Repercussions

  • $1.26M stolen (mostly from Solend’s lending pools).

  • USDH briefly depegged before recovering.

  • Increased scrutiny on Solana oracles (similar to Nirvana Finance’s exploit months earlier).

Incident Response

  1. Emergency Pause

    • Solend froze USDH borrowing within hours of detection.

  2. Oracle Update

    • Switched to TWAP-based pricing for low-liquidity assets.

  3. No Hacker Negotiation

    • The attacker kept all funds (no bounty offered).

Remediations

  1. TWAP Integration

    • Implemented time-weighted price checks to prevent flash manipulation.

  2. Liquidity Thresholds

    • Restricted borrowing for assets with low liquidity depth.

  3. Circuit Breakers

    • Added automatic pauses if prices deviate too far from expected ranges.

Lessons Learned

  1. Last Price ≠ Fair Price

    • Always use time-averaged oracles for volatile/low-liquidity assets.

  2. Low-Liquidity Pools Are Risky

    • Protocols must monitor liquidity and adjust risk parameters.

  3. Speed Matters

    • Solend’s quick pause limited losses—other protocols should have similar safeguards.

User Losses

  • Lenders: Lost $1.26M (no recovery).

  • USDH Holders: Temporary depeg but no long-term collapse.

Key Sources

  1. Solend Post-Mortem (Twitter)

  2. Rekt.News Report

  3. SlowMist Thread on Oracle Attacks

Raydium Hack (December 2022) – $4.4M Admin Key Compromise

Root Causes

  1. Private Key Leak

    • The attacker gained access to Raydium’s admin private keys, allowing them to bypass security controls.

    • Possible causes:

      • Phishing/social engineering against team members.

      • Insufficient key storage security (e.g., unprotected hot wallet).

  2. Centralized Upgrade Mechanism

    • Raydium’s smart contracts had upgradeable proxies, meaning admin keys could alter contract logic.

    • The attacker modified pool contracts to siphon funds.

  3. No Multi-Sig or Timelock

    • Critical functions (like pool withdrawals) lacked multi-signature or timelock protections, allowing instant theft.

Repercussions

  • $4.4M stolen (from liquidity pools).

  • RAY token dropped ~20% post-exploit.

  • Temporary protocol freeze while investigating.

Incident Response

  1. Emergency Pause

    • Raydium disabled pool operations within hours.

  2. Key Rotation

    • Revoked old admin keys and enforced stricter access controls.

  3. No Recovery

    • Hacker kept all funds (no negotiations).

Remediations

  1. Multi-Sig for Admin Actions

    • Required multiple signatures for contract upgrades.

  2. Timelock Contracts

    • Added delays to critical changes (giving time to detect malicious actions).

  3. Enhanced Key Management

    • Migrated to hardware-secured wallets and stricter internal policies.

Lessons Learned

  1. Admin Keys = Single Point of Failure

    • Always use multi-sig for privileged access.

  2. Upgradeable Contracts Need Safeguards

    • Proxies are useful but dangerous—timelocks are mandatory.

  3. Assume Phishing Will Happen

    • Teams must train for social engineering attacks.

User Losses

  • Liquidity Providers: Lost $4.4M (no reimbursement).

  • RAY Holders: Price drop but no long-term collapse.

Key Sources

  1. Raydium Post-Mortem (Twitter)

  2. Rekt.News Report

  3. SlowMist Thread on Key Management

Cypher Protocol Hack (August 2023) – $1M Exploit

Root Cause

  • Unknown vulnerability in smart contracts.

  • Suspected (but unconfirmed) to involve price oracle manipulation or accounting logic flaws.

Repercussions

  • $1M stolen (mix of SOL, USDC, ETH).

  • Protocol frozen indefinitely; users unable to withdraw funds.

Incident Response

  1. Emergency shutdown within hours.

  2. No hacker negotiations (attacker kept funds).

  3. Recovery plan proposed (still pending in 2024).

Lessons Learned

  1. Transparency matters: Cypher’s lack of post-mortem hurt trust.

  2. Audits aren’t enough: Even audited protocols can have hidden flaws.

User Losses

  • Lenders lost $1M (no recovery yet).

  • CYPH token dropped ~70%.

Key Source

Mango Farm Rug Pull (Early 2024) – Undisclosed Losses

Root Cause

  • Developer exit scam: The anonymous team drained liquidity pools and abandoned the project.

  • No smart contract exploit: Funds were stolen via admin privileges (e.g., minting tokens or withdrawing locked liquidity).

Repercussions

  • All funds vanished: Exact losses unconfirmed but likely millions (TVL was ~$5M before collapse).

  • Token ($MNGO) crashed to $0.

  • Community outrage: Investors labeled it a "classic rug pull."

Incident Response

  1. No recovery possible: Anonymous team left no traces.

  2. Warnings ignored: Earlier community suspicions were dismissed (e.g., unaudited contracts, anonymous devs).

Lessons Learned

  1. Avoid anonymous teams: No doxxing = higher risk.

  2. Check liquidity locks: Rug pulls often exploit unlocked LP tokens.

  3. Audits ≠ safety: Many rug pulls use unaudited "copy-paste" contracts.

User Losses

  • Liquidity providers: Lost entire investments.

  • Token holders: $MNGO became worthless.

Key Source

Pump.fun Exploit (May 2024) – $1.9M Attack

Confirmed Root Cause: Private Key Compromise (Method Unknown)

What Happened?

  1. Attacker Gained Unauthorized Access

    • Used stolen private keys (how they got them is still unclear) to bypass Pump.fun's security.

    • Not a smart contract bug – this was a backend/admin system breach.

  2. Funds Drained From Treasury

    • Hacker withdrew $1.9M in SOL and meme coin liquidity directly from Pump.fun’s controlled wallets.

  3. No Bonding Curve Exploit

    • Earlier reports about "bonding curve manipulation" were incorrect.

    • The attack was purely from private key access.

Repercussions

  • $1.9M stolen (mix of SOL and user-deposited meme coin funds).

  • No smart contract fixes needed (the protocol itself wasn’t hacked).

Incident Response

  1. Immediate Key Rotation

    • Pump.fun revoked all compromised keys within hours.

  2. No Recovery

    • Hacker kept all funds (no negotiations).

Lessons Learned

  1. Private Keys = Biggest Risk

    • Even the best smart contracts fail if keys leak.

  2. Cold Wallets Are Mandatory

    • Hot wallets (internet-connected) are vulnerable to phishing/hacks.

  3. Transparency Helps

    • Pump.fun’s quick admission limited reputational damage.

User Losses

  • Meme coin creators: Lost some deposited SOL.

  • Traders: Temporary disruption, but no direct fund losses.

Key Sources

  1. FrankResearcher’s Thread (Key Compromise Confirmation)

  2. DeFiLlama Hack Entry (Private Key Issue)

  3. Pump.fun’s Response

M2 Exchange Hack – $13.7M Centralized Breach

(October 2024, Access Control Exploit)

Root Cause: Access Control Failure

  1. Privilege Escalation Attack

    • Hackers exploited weak API key permissions or compromised admin credentials to gain unauthorized access to M2's hot wallets.

    • Unlike decentralized hacks, this was a traditional CEX breach (similar to KuCoin 2020 or Coincheck 2018).

  2. No Multi-Sig Protection

    • Funds were stored in single-signature wallets, allowing instant drainage once access was obtained.

  3. Possible Attack Vectors (Per Cyvers):

    • Phishing of employees with high-level access.

    • Exploit of an unpatched backend system vulnerability.

Repercussions

  • $13.7M stolen (mix of BTC, ETH, and SOL).

  • Exchange temporarily halted withdrawals for 72 hours.

  • User trust eroded: M2’s trading volume dropped ~40% post-hack.

Incident Response

  1. Freeze and Trace

    • M2 worked with Chainalysis to track stolen funds, but most were laundered via mixers.

  2. Partial Reimbursement

    • Used insurance funds to cover ~30% of losses (priority for small depositors).

  3. Security Overhaul

    • Implemented multi-sig wallets and hardware security modules (HSMs).

Lessons Learned

  1. CEXs Are Still Vulnerable

    • Centralized exchanges remain prime targets for credential-based attacks.

  2. Cold Storage > Hot Wallets

    • Over 90% of user funds should be offline (M2 had ~60% in hot wallets).

  3. Transparency Matters

    • M2’s delayed disclosure worsened user backlash.

User Losses

  • Retail traders: Lost 70% of unreimbursed funds.

  • Institutional clients: Negotiated private settlements.

Key Sources

  1. Cyvers Alerts Thread

  2. M2’s Post-Mortem (if available)

  3. DeFiLlama CEX Hack Database

DogWifTools Hack (January 2025) – $10M Supply Chain Attack

Root Cause: Malware-Infected GitHub Update

  1. Trojanized Code Upload

    • Attackers compromised DogWifTools' GitHub repository, pushing a malicious update (v2.1.5) that included wallet-draining malware.

    • The malware activated when users ran the tool, silently exporting private keys to attacker-controlled servers.

  2. Social Engineering

    • Fake "urgent update" alerts tricked users into downloading the infected version.

  3. No Code Signing

    • Lack of GPG-signed releases made it impossible to verify update authenticity.

Repercussions

  • $10M stolen from 8,200+ Solana wallets.

  • DogWifTools’ reputation destroyed; project abandoned.

  • Secondary scams: Fake "recovery" services targeted victims.

Incident Response

  1. GitHub Takedown

    • The repo was shut down within 6 hours, but many users had already updated.

  2. Warnings Issued

    • Solana wallets (Phantom, Backpack) blacklisted malicious transactions.

  3. No Recovery

    • Stolen funds were swapped for Monero and laundered.

Lessons Learned

  1. Verify Open-Source Tools

    • Always check commit histories and contributor identities before updating.

  2. Use Airgapped Wallets

    • Never run trading tools on wallets holding main funds.

  3. Demand Code Signing

    • Projects must cryptographically sign releases (e.g., via GPG).

User Losses

  • Retail traders: Lost entire wallets (no reimbursement).

  • Developers: Forked clean versions of DogWifTools post-hack.

Key Sources

  1. BleepingComputer Report

@solana/web3.js Malware Incident – December 2024

Root Cause: Compromised npm publish credentials led to malicious package versions ().

Attack Flow

  1. Phishing Campaign:

    • Attackers targeted npm maintainers of @solana/web3.js with spear-phishing emails, stealing credentials and 2FA codes .

    • Used cloned npm login pages to harvest credentials .

  2. Malicious Package Upload:

    • Published trojanized versions 1.95.6 and 1.95.7 to npm, embedding:

      • addToQueue function to exfiltrate private keys .

      • Backdoors in Keypair.fromSecretKey() and other crypto methods .

  3. Exfiltration:

    • Private keys were sent to attacker-controlled servers when affected functions were called .

Impact

  • $130K–$160K stolen (per Helius Labs ).

  • Affected projects: Only apps handling private keys directly (e.g., trading bots, custodial services) .

  • Non-custodial wallets (e.g., Phantom) were unaffected .

Mitigation

  1. Package Deprecation:

    • Malicious versions unpublished within 5 hours (3:20 PM – 8:25 PM UTC, Dec 3) .

  2. Clean Version (1.95.8):

    • Released with backdoors removed .

  3. Key Rotation:

    • Developers urged to rotate multisig/admin keys .

Lessons Learned

  1. Supply Chain Risks:

    • Over 450K weekly downloads made web3.js a high-value target .

  2. Credential Hygiene:

    • npm now uses granular access tokens instead of broad permissions .

  3. Detection Gaps:

    • Reliance on community reports delayed response (~4 hours) .

Key Sources

  1. GitHub Advisory (GHSA-jcxm-7wvp-g6p5)

  2. Anza’s Root Cause Analysis

  3. Mend.io Report

DEXX Hack – $30M Private Key Breach

(November 16, 2024 | Solana Memecoin Trading Terminal)

Root Cause

  1. Centralized Private Key Storage

    • DEXX stored user wallet private keys on a single server, which was compromised, likely due to:

      • Phishing/Social Engineering: Attackers gained backend access via employee credentials .

      • Insufficient Encryption: Keys may have been stored in plaintext or weakly encrypted .

  2. No Multi-Sig or Hardware Isolation

    • Unlike secure MPC wallets (e.g., CipherBC’s solution), DEXX relied on hot wallets with single-key control, enabling instant drainage .

Attack Flow

  1. Server Breach: Hackers exfiltrated private keys from DEXX’s backend.

  2. Direct Wallet Drains:

    • Over 8,620 Solana wallets were drained via signed transactions, bypassing user approvals .

    • Stolen assets (SOL, memecoins) were swapped to Monero via bridges to obscure trails .

Repercussions

  • $30M stolen (revised up from initial $21M estimate due to memecoin volatility) .

  • 900+ users affected: Most lost <$10K, but one user lost $1M+ .

  • Solana ecosystem trust eroded: Part of a broader pattern of 2024 Solana wallet exploits .

Incident Response

  1. Negotiation Failures:

    • DEXX offered a bounty and token rewards, but the hacker ignored on-chain messages .

  2. Law Enforcement Collaboration:

    • Worked with SlowMist and police to track funds, but recovery stalled due to Monero laundering .

  3. Security Upgrades:

    • Promised transition to multi-sig wallets and third-party audits (no public ETA) .

Lessons Learned

  1. Never Store Private Keys Centrally

    • MPC (Multi-Party Computation) or hardware wallets are mandatory for trading platforms .

  2. Monitor for Insider Threats

    • SlowMist noted the hack’s precision suggested potential internal collusion (unconfirmed) .

  3. Regulatory Gaps

    • DEXX’s offshore registration complicated user compensation efforts .

User Losses

  • No full reimbursement: DEXX’s compensation plan depends on partial fund recovery .

  • Legal hurdles: Offshore status limits victims’ recourse .

Key Sources

  1. SlowMist Report (8,620 Wallets)

  2. Legal Analysis (Panewslab)

  3. Chainalysis 2024 Hack Trends

Conclusion

In reviewing Solana's security evolution from 2022 to 2025, it's evident that the blockchain ecosystem has faced significant challenges, including high-profile hacks and exploits. These incidents highlight the critical importance of robust security measures, such as multi-signature protections, decentralized oracles, and stringent private key management. The recurring themes of supply chain attacks, oracle manipulations, and admin key compromises underscore the need for continuous vigilance and improvement in security protocols. While some incidents resulted in partial recoveries or community-driven responses, others led to the permanent shutdown of projects, emphasizing the high stakes involved in the DeFi space. As Solana and similar platforms continue to evolve, the lessons learned from these incidents will be crucial in fortifying the ecosystem against future threats and ensuring user trust and safety.

0
Subscribe to my newsletter

Read articles from Fave directly inside your inbox. Subscribe to the newsletter, and don't miss out.

Web3CryptocurrencySecuritySolana

Written by

Fave
Fave

I help secure users funds on the DeFi protocols by providing audits and educating users on how to prevent hacks from their end..