How do you protect your crypto-currencies from the massive Solana hack that affected over 8,000 wallets?

The Solana ecosystem has suffered a massive hack that affected over 8,000 wallets. The hackers drained tokens like SOL and USDC from the wallets. The monetary impact of the attack, while still unclear, is estimated to be in the tens of millions. Phantom and Slope wallets were massively affected.

According to Solana’s status, many engineers and security firms are working to understand what went wrong with the platform. While there are multiple theories, no consensus has been reached as to why the hack occurred.

However, experts seem to agree that the hack did not affect people who stored their tokens in physical wallets or exchanges.

What didn’t work for Solana

Emin Gun Sirer, CEO and founder of Ava Labs, revealed that despite the hack, the transactions appear to have been signed correctly. Such a hack is only possible if the hacker has access to users’ private keys. Foobar, a popular crypto influencer and security auditor, also called the hacks “private key compromise“.

🚨 Widespread Solana private key compromise 🚨

– attacker is stealing both native tokens (SOL) and SPL tokens (USDC)
– affecting wallets that have been inactive for >6 months
– both Phantom & Slope wallets reportedly drained pic.twitter.com/AkZXOGLD0Q

– foobar (@0xfoobar) August 3, 2022

Both Sirer and Foobar mentioned a supply chain attack as a possible reason for the hack. A supply chain attack occurs when a malicious party breaches a system using third-party services. However, Sirer ruled out the possibility of a faulty random number generator or a browser hack.

Patrick O’Grady of Ava Labs revealed that the problem could be due to possible reuse of the nonce. This would allow an attacker to access the private keys of some users.

How to protect yourself from Solana Like hacking?

According to several reports, the hack only affected users of certain wallets. There does not seem to be any impact on users storing their tokens on exchanges or hardware wallets.

However, both approaches have their drawbacks. Centralized exchanges generally suffer from a lack of autonomy over their assets, as the exchange can suspend withdrawals without notice. On the other hand, physical portfolios can be quite expensive.

In the event that you don’t have access to either of these options, Foobar recommended limiting any upstream telemetry by turning off the device that holds your wallets.