SOL, the native token of the Solana network, dropped following reports that thousands of wallets have been drained in apparently still ongoing attack.
Per blockchain auditor OtterSec, over 5,000 Solana wallets have been drained in the past few hours.
“This affects multiple wallets – Phantom, Slope, Solflare, TrustWallet – across a wide variety of platforms. FOR USERS, please move your assets to a hardware ledger or a centralized exchange,” the firm said, adding that “there’s also been evidence of this issue affecting ETH users, although it seems less widespread.”
However, other industry players report that the number of affected wallets has already surpassed 7,000.
At 03:52 UTC, SOL trades at USD 38.69, somewhat recovering from USD 38.06 it reached earlier today. The price is down 4% in a day.
The team behind Solana said that engineers from multiple ecosystems, with the help of several security firms, are investigating drained wallets on Solana.
“There is no evidence hardware wallets are impacted,” they added.
Meanwhile, Phantom said that “at this time, the team does not believe this is a Phantom-specific issue.”
According to Solana Labs co-founder Anatoly Yakovenko, only a token-specific delegation or an auto approve or a leaked seed could transfer assets from a wallet on behalf of the user.
“Since system transfers are happening, that rules out delegation. There is no way an “interaction” could make a wallet vulnerable,” he added.
Other reactions:
One possible route is a "supply chain attack" where a JS library is hacked, and it exfiltrates (steals) users' private keys. Affected wallets seem to have been created in the last ~9 months, but there are reports of freshly created wallets also being affected.
— Emin Gün Sirer🔺 (@el33th4xor) August 3, 2022
If you're worried about the current wallet draining scare, @FamousFoxFed has a great tool for you to review your wallets:https://t.co/IAnTz0DtV7
— korg (@levicook) August 2, 2022
For reference I haven't interacted with any contracts at all in ~40 days. My ERC-20 and SPL USDC held on both @slope_finance and @TrustWallet were drained
— Justin.sol (@JustinBarlow) August 3, 2022
Source: Cryptonews
