Briefing
The SwissBorg SOL Earn staking program suffered a major security breach resulting in the unauthorized transfer of $41.5 million in assets. The core incident was a supply chain compromise involving the Kiln API, a critical third-party staking partner. This off-chain access allowed the threat actor to silently manipulate on-chain stake account authorities, effectively bypassing the platform’s standard multi-signature withdrawal controls. The total financial impact is confirmed at $41.5 million, underscoring the systemic risk posed by centralized dependencies within decentralized products.
Context
The prevailing risk factor in institutional DeFi remains the security perimeter of external dependencies, particularly third-party APIs that manage on-chain permissions or data feeds. This incident leverages a known class of vulnerability where off-chain administrative access holds too much unilateral power over delegated on-chain assets. Prior to this event, the industry had yet to fully implement zero-trust architecture for critical staking and key management functions delegated to external service providers.
Analysis
The attack vector was a classic supply chain compromise targeting a staking partner’s infrastructure. The attacker gained unauthorized access to the Kiln API, which possessed the necessary permissions to control the Solana stake accounts. By leveraging this off-chain API access, the actor executed a silent transfer of the stake account authority, a process that did not require the protocol’s multi-signature confirmations for withdrawal. This technical maneuver created a blind spot, allowing the attacker to evade standard monitoring tools focused on withdrawal events while transferring the stake authority to a malicious address, thereby draining the $41.5 million in user funds.
Parameters
- Total Loss Value → $41.5 million (The total amount of user assets unauthorizedly transferred from the SOL Earn program)
- Compromised Component → Kiln API (The external staking partner’s interface used to gain administrative control)
- Affected Blockchain → Solana (The network where the stake account authority was manipulated)
- Attack Technique → Supply Chain Compromise (The method of exploiting a third-party vendor’s system)
Outlook
Protocols must immediately adopt a zero-trust model for all third-party dependencies, mandating that no external service can unilaterally execute a critical on-chain function like stake authority transfer. The immediate mitigation for similar protocols is to audit all API-driven administrative roles and enforce on-chain multi-signature approval for any change in key ownership or delegation. This incident will likely establish new auditing standards that prioritize the security of the entire operational supply chain, shifting focus from pure smart contract logic to external key management and API access controls.
