Protocols & Policy · Security
Solflare says staking-provider key incident paused validator rewards; company says user SOL untouched
In an Oct. 27 company post, Solflare said its staking provider reported a security incident affecting keys held for the Solflare validator, paused rewards, promised an in-app migration to a new validator, and said no user funds were touched.
Solflare said on Oct. 27 that its staking provider notified the wallet of a security incident on the provider's side affecting keys the provider holds for the Solflare validator, and that as a result the Solflare validator is not producing rewards, according to an official @solflare post at about 7:26 p.m. ET [1]. The company said the provider is investigating. That is Solflare's framing of a provider-side incident; the post does not name the provider or state a root cause beyond "security incident on their side" [1].
"Your SOL is safe," the company wrote. "Delegated stake sits in your own stake account and is controlled by your keys alone; the Solana protocol does not allow a validator, or anyone holding its keys, to move it. No user funds were touched" [1]. Those safety lines are company claims in the same statement. Le Coin has not independently verified stake-account balances or on-chain movement [1].
Solflare said it is moving to a new Solflare validator, so stake will need to move too. "No action is needed now," it wrote; an upcoming app update will give a secure guided path, and the firm will post when that path is live [1]. "Rewards are paused until your stake is active on the new validator, and we're working on a compensation plan for everyone who migrates" [1]. The post stated no dollar amount for that plan; Le Coin invents none [1].
Migration, Solflare said, will only happen through the Solflare app. "We will never DM you or send you a link" [1].
The objection
A fair objection is that user-SOL safety, "no user funds were touched," the paused-rewards window, and the compensation plan remain company statements while the provider investigation is unfinished and the provider is unnamed [1]. Another limit is that Solflare.com returned 403 on the morning pack, so the public primary for this desk is the X post alone [1].
The tell
What would change the view is a follow-up that names the provider outcome, confirms the app migration is live, and shows how the compensation plan lands for migrators without inventing a figure the Oct. 27 note never gave [1]. Until then, the public record is the company incident notice, the rewards pause, the in-app-only migration warning, and the no-funds-touched claim [1].
Sources
- Solflare (@solflare), X statement, Oct. 27, 2026, ~7:26 p.m. ET (created_at 2026-10-27T23:26:01.000Z; status 2115223521395896530), https://x.com/solflare/status/2115223521395896530 ; staking provider notified of security incident on their side affecting keys held for the Solflare validator; provider investigating; validator not producing rewards; Your SOL is safe / delegated stake in user stake accounts / protocol does not allow validator or key-holder to move it / No user funds were touched; migration to new Solflare validator via upcoming app update; no action needed now; rewards paused until stake active on new validator; compensation plan for everyone who migrates (no dollar amount); migration only through Solflare app; never DM or send a link; accessed Oct. 28, 2026, ~6:20 a.m. ET (3:20 a.m. MST).
Holding the Corner.
Not financial advice.