ALIEN WHO? 🈴

As I write this, billions are leaving Binance’s hot wallets in what CZ himself calls a likely hack, with Tether and Circle freezing close to two billion of it. Three days ago our validator operator had its keys compromised. Different scale, same lesson: whoever holds the key holds the asset. Your staked SOL never left you this week, and it never could have. A validator’s keys can’t touch delegated stake. Solana working as designed. But every validator has one key that controls it, and for three years an operator held ours. When their keys were compromised, so was our validator, and your rewards stopped with it. And whoever runs the node also has to hold its identity key, a hot key sitting on the server, which is where block rewards landed by default. However you split the other keys, the operator stood in the money’s path. Until Alpenglow. The upgrade that went live this month is mostly talked about for finality and one-day epochs. Quietly, it also changed where a validator’s money goes: votes moved off-chain, and the owner can now point every reward stream at an account the operator never touches. Nobody had used that to take the operator out of the money’s path, as far as we can tell. We did, in a day, because we had to. The new Solflare validator is, as far as we know, the first on Solana run by a third-party operator who holds neither the controlling key nor the rewards. The withdraw authority sits in a Solflare multisig, so nobody can take the validator from us again, and if an operator’s keys are ever compromised we rotate them and keep going. Every reward stream lands in accounts only that multisig controls. @StakingFac runs the machines with operational keys we can rotate. Ownership and operations, separated. Staking Facilities are the people I called that night. We built @solanabeach_io with them in 2020, when SOL was under a dollar (for the new folks). Six years later, they’re still the people you call at midnight. If your stake is still on the old Solflare validator, move it in a few taps in the app. The new one runs at a lower commission, on top of covering the rewards you missed. Not your keys, not your coins. This week it applied to validators. Tonight it applies to the biggest exchange in the world.

Okay chat, shitty situation, but no user funds lost. Marketing is asleep so I wrote this one myself; don’t hold it against me, I’d rather be early and transparent than polished. Our validator’s operator lost control of the validator’s keys. Solana is built for exactly this: validator keys can’t touch delegated stake, so your SOL sits in your own stake account where it always was. What’s paused is rewards, until we move stake to a new Solflare validator over the coming days, in-app and guided. HOLD STRONG