Briefing
SwissBorg’s Solana Earn program suffered a significant security incident on September 8, 2025, resulting in the theft of approximately 193,000 SOL tokens, valued at $41 million. The breach originated from a compromised API belonging to Kiln, a staking infrastructure partner, enabling unauthorized fund withdrawals from user deposits. This incident underscores the inherent risks associated with integrating third-party services into decentralized finance ecosystems. SwissBorg has committed to fully reimbursing all affected users from its treasury.
Context
Prior to this event, the digital asset landscape consistently presented a broad attack surface, particularly within DeFi protocols leveraging external services. Integrations with third-party APIs introduce expanded vectors for compromise, often overlooked in smart contract-centric security models. Centralized points of failure within decentralized systems, such as administrative keys or compromised API endpoints, frequently expose protocols to substantial financial risk.
Analysis
The incident leveraged a critical vulnerability within Kiln’s API, the software bridge connecting SwissBorg’s application to the Solana staking network. Attackers manipulated requests through this compromised API, gaining unauthorized access to and control over funds within the Solana Earn program. This attack circumvented direct smart contract vulnerabilities, exploiting an operational security flaw in the data exchange layer. The illicitly obtained funds were subsequently routed to a Solana wallet identified as the “SwissBorg Exploiter.”
Parameters
- Exploited Protocol → SwissBorg Solana Earn program
- Vulnerability → Third-party API compromise (Kiln)
- Financial Impact → $41 Million (193,000 SOL)
- Blockchain Affected → Solana
- Attack Date → September 8, 2025
- Attacker Wallet → Solscan-labeled “SwissBorg Exploiter”
- Mitigation Response → User reimbursement, active investigation, Kiln exiting Ethereum validators
Outlook
Immediate mitigation requires users to remain vigilant regarding third-party service permissions and to monitor official announcements for security updates. This incident will likely drive a re-evaluation of API security protocols and supply chain risk management across the DeFi sector. Protocols integrating external services must implement more robust validation mechanisms and multi-layered security controls to prevent similar API-based exploits. The industry must establish new best practices for assessing and managing third-party dependencies.
Verdict
This API compromise on a critical staking partner fundamentally redefines the scope of supply chain risk within decentralized finance, demanding immediate and comprehensive re-architecture of external service integrations.
Signal Acquired from → Cointelegraph
