Solflare staking rewards halted after security incident at a provider

The validator has stopped producing rewards

Solflare is preparing to move delegations away from its validator after a security incident reported by its staking provider. In its October 27 communication, reported again Wednesday, the wallet said keys held by the provider were affected and an investigation was underway. Its validator is currently not producing rewards. The available communication does not identify the provider, the precise cause of the incident or how long the interruption will last.

The company says users’ funds are unaffected. That assurance concerns delegated SOL held in users’ stake accounts and should remain attributed to Solflare while the investigation continues. It does not mean the service is operating normally: tokens can remain under their owners’ control while a delegation temporarily stops earning rewards. No amount of lost rewards has been announced at this stage.

Withdrawal authorities are separate from the validator

Solana’s documentation distinguishes a stake account from an ordinary wallet and from the keys used to operate a validator. Each account has signing authorities that determine which operations are permitted. The stake authority can, for example, delegate, deactivate a delegation or split the account. The withdrawal authority can withdraw tokens that are no longer delegated and can also replace the stake authority. These roles explain why a validator problem alone does not establish that delegated tokens have been stolen.

This technical separation is not an independent forensic assessment of the Solflare incident. It describes the network’s normal operation, which the company refers to when saying users retain control of their funds. Solana also notes that activating or deactivating a delegation is not immediate: changes take effect at network epoch boundaries. It would therefore be premature to promise an instant return of rewards as soon as a transfer is requested in the app.

Migration is expected through the official app

Solflare plans an update to guide users to new validators and says no action is required for now. Rewards are expected to remain paused during the transition until the new staking becomes active. The company is also preparing compensation for users who complete the migration. Available information provides no schedule of payments, individual amount or firm timetable, so the announcement cannot support a reimbursement estimate or be described as money already paid.

The wallet says migration will take place through its app and that it will not approach users through direct messages or external links. That instruction is particularly relevant during an interruption, when a fake support message can exploit users’ wait for a solution. The next concrete development will be the release of the update and its official instructions. Until then, the provider investigation, restoration of rewards and compensation arrangements remain three separate matters to follow.