{"investigation":{"slug":"slope-wallet","entity_name":"Slope Wallet","trust_score":28,"severity_base":null,"score_modifier":16,"confidence":0.88,"status":"published","content_type":"investigation","summary":"Slope Wallet (Slope Finance) was a Solana-based mobile cryptocurrency wallet that suffered a catastrophic security breach on August 2, 2022, in which over 9,200 wallets were drained of approximately $4–8 million in assets due to the app transmitting users' unencrypted seed phrases to a third-party telemetry service (Sentry). The root cause was a severe security misconfiguration by Slope Finance, in which the mobile application logged plaintext private key material without proper scrubbing. No formal victim compensation was established, the team declined to publicly accept responsibility, and founder Leal Cheung subsequently launched a new project (zkME) without resolution for affected users.","sections":[{"content":"On August 2, 2022, beginning at approximately 22:37 UTC, a malicious actor drained assets from 9,229 Solana wallets over a period of roughly seven hours. The attack affected users of the Slope Wallet mobile application on both iOS and Android. Estimates of total stolen funds range from approximately $4.1 million (Slope Finance's own DFIR report) to $6–8 million across various security researchers, with discrepancies attributed to differing valuation timing and methodologies. The Solana Foundation confirmed that the exploit was not a protocol-level vulnerability and that no core code related to Solana Labs was involved. The Solana Foundation's incident update attributed the compromise specifically to Slope Finance's wallet applications.","heading":"The August 2022 Security Incident","sources":[{"url":"https://solana.com/news/8-2-2022-application-wallet-incident","name":"solana.com","type":"other","credibility":3},{"url":"https://www.coindesk.com/business/2022/08/03/solanas-latest-6m-exploit-likely-tied-to-slope-wallet-devs-say","name":"coindesk.com","type":"other","credibility":3},{"url":"https://slope-finance.medium.com/slope-wallet-sentry-vulnerability-digital-forensics-and-incident-response-report-d7a5904e5a39","name":"slope-finance.medium.com","type":"other","credibility":3},{"url":"https://hackmd.io/@prastut/SJoJUzKz3","name":"hackmd.io","type":"other","credibility":3}],"severity":"medium"},{"content":"Slope Finance's mobile wallet application used Sentry, a third-party application monitoring service, for event logging. Slope failed to configure Sentry to scrub sensitive user data before transmission. As a result, the application's toString() method — introduced in version 2.2 — inadvertently bypassed security filters and caused users' mnemonic seed phrases (private keys) to be transmitted in plaintext over TLS to Slope's centralized Sentry server, where they were stored unencrypted in an access-secured database. Security researchers at Otter Security, OtterSec, and Ackee Blockchain independently confirmed this finding. The Block reported that Solana security researchers found user seed phrases stored in plain text on Slope's servers. Despite these findings, Slope Finance's own Digital Forensics and Incident Response (DFIR) report concluded that the Sentry vulnerability 'cannot conclusively explain' the full exploit, as only 5,367 private keys were confirmed stored in the database, yet 9,229 wallets were drained — leaving 7,785 compromised wallets with no confirmed link to the Sentry database.","heading":"Root Cause: Sentry Telemetry Misconfiguration","sources":[{"url":"https://slope-finance.medium.com/slope-wallet-sentry-vulnerability-digital-forensics-and-incident-response-report-d7a5904e5a39","name":"slope-finance.medium.com","type":"other","credibility":3},{"url":"https://www.theblock.co/post/161425/slope-wallet-provider-saved-user-seed-phrases-in-plain-text-solana-security-researchers-find","name":"theblock.co","type":"other","credibility":3},{"url":"https://ackee.xyz/blog/2022-solana-hacks-explained-slope-wallet/","name":"ackee.xyz","type":"other","credibility":3},{"url":"https://blog.sentry.io/2022/08/10/slope-wallet-solana-hack/","name":"blog.sentry.io","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/experts-find-private-keys-on-slope-servers-still-puzzled-over-access","name":"cointelegraph.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On-chain investigator ZachXBT published analysis in October 2023 tracing the movement of funds stolen during the August 2022 Slope Wallet hack. According to ZachXBT's findings, the attacker transferred stolen cryptocurrency from Solana to Ethereum via Binance nested exchanges. The funds were then laundered through Tornado Cash, a sanctioned cryptocurrency mixer on Ethereum, in batches totaling approximately 322 ETH deposited at intervals throughout 2023. The attacker subsequently used SWFT, a cross-chain bridge, to move laundered assets from Ethereum to the TRON network, where the funds were distributed as USDT across multiple addresses suspected to be small peer-to-peer over-the-counter (OTC) services used to cash out. This laundering pattern was consistent with independent analysis by the SlowMist security team. A separate crypto.news report noted that ZachXBT characterized recovery of funds as 'unlikely' given the team's posture.","heading":"Fund Laundering and On-Chain Tracing","sources":[{"url":"https://crypto.news/slope-wallet-hacker-bridged-funds-to-tron-cashed-out-through-otcs/","name":"crypto.news","type":"other","credibility":3},{"url":"https://www.binance.com/en/feed/post/2023-10-10-slope-finance-s-4m-hack-funds-traced-in-recent-on-chain-analysis-by-zachxbt-1300002","name":"binance.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the incident, Slope Finance offered a 10% bounty to the attacker in exchange for returning 90% of the stolen funds within 48 hours, and threatened legal action — an appeal that went unanswered. Slope's own DFIR report acknowledged a 'grave security vulnerability' in the Sentry implementation but stopped short of formally accepting culpability for the full scope of the hack. No formal victim compensation program was established. Victims organized under slopeaction.org, a group with stated goals of obtaining reimbursement for all affected users, securing a public acknowledgment of culpability from Slope Finance, and assisting law enforcement. As of available reporting, no such reimbursement has occurred and no regulatory or law enforcement action has been publicly confirmed against Slope Finance.","heading":"Victim Response and Lack of Accountability","sources":[{"url":"https://beincrypto.com/slope-offers-solana-wallet-hackers-bounty-threatens-legal-action/","name":"beincrypto.com","type":"other","credibility":3},{"url":"https://slopeaction.org/","name":"slopeaction.org","type":"other","credibility":3},{"url":"https://slope-finance.medium.com/slope-wallet-sentry-vulnerability-digital-forensics-and-incident-response-report-d7a5904e5a39","name":"slope-finance.medium.com","type":"other","credibility":3}],"severity":"medium"},{"content":"ZachXBT publicly warned users in October 2023 to avoid interactions with zkME, a new cryptocurrency startup allegedly created by Slope Wallet founder Leal Cheung. According to ZachXBT's reporting, Cheung abruptly left Slope Finance following the August 2022 hack without resolution for affected victims and launched zkME, a zero-knowledge proof identity oracle project. The transition from a project that suffered a critical security failure due to plaintext seed phrase logging — with no established victim compensation — to founding a new identity and wallet product has been flagged as a trust and accountability concern. These allegations originate from ZachXBT's on-chain and open-source research and should be noted as reported claims pending independent verification.","heading":"Founder Conduct and Project Abandonment","sources":[{"url":"https://crypto.news/slope-wallet-hacker-bridged-funds-to-tron-cashed-out-through-otcs/","name":"crypto.news","type":"other","credibility":3},{"url":"https://www.binance.com/en/feed/post/2023-10-10-slope-finance-s-4m-hack-funds-traced-in-recent-on-chain-analysis-by-zachxbt-1300002","name":"binance.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Slope Finance launched its wallet in September 2021 and reported 1,000,000 downloads and 850,000 monthly active users by January 2022. In February 2022 — approximately six months before the hack — Slope Finance closed an $8 million Series A funding round co-led by Solana Ventures and Jump Capital. Additional participants included Sequoia China Investment Management, Genesis Global Trading, CMS Holdings, Spartan Group, Fenbushi Capital, Mirana Ventures, Circle Ventures, Wave Financial, Huobi Global, OKX Blockdream Ventures, and Gate.io. The funding was intended to expand the U.S. team and pursue growth in GameFi, SocialFi, and e-commerce verticals. The wallet positioned itself as 'The Gateway to Web3' for the Solana ecosystem.","heading":"Funding and Background","sources":[{"url":"https://www.globenewswire.com/news-release/2022/02/24/2391653/0/en/Slope-Finance-announces-the-close-an-8m-Series-A-funding-co-lead-by-Solana-Venture-and-Jump-Capital","name":"globenewswire.com","type":"other","credibility":3},{"url":"https://www.coindesk.com/business/2022/02/23/solana-wallet-slope-finance-raises-8m","name":"coindesk.com","type":"other","credibility":3},{"url":"https://cointelegraph.com/press-releases/slope-finance-completes-8m-series-a-funding-led-by-solana-ventures","name":"cointelegraph.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Sentry, the third-party error monitoring platform whose service was implicated in the Slope Wallet incident, published its own post-mortem on August 10, 2022. Sentry's analysis clarified that the vulnerability arose from Slope Finance's failure to configure Sentry's data scrubbing settings to exclude sensitive fields. Sentry emphasized that the platform offers built-in data scrubbing tools and that the exposure of seed phrases was a result of Slope's integration choices, not a breach of Sentry's own infrastructure. This position was consistent with Slope Finance's DFIR report, which acknowledged the Sentry configuration failure on Slope's part.","heading":"Sentry's Post-Incident Analysis","sources":[{"url":"https://blog.sentry.io/2022/08/10/slope-wallet-solana-hack/","name":"blog.sentry.io","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2021-09","event":"Slope Finance launches Slope Wallet mobile application on Solana.","source":""},{"date":"2022-02-24","event":"Slope Finance closes $8 million Series A funding round co-led by Solana Ventures and Jump Capital.","source":""},{"date":"2022-08-02","event":"Attack begins at 22:37 UTC. Attacker drains 9,229 wallets over approximately 7 hours, stealing an estimated $4.1–8 million in assets.","source":""},{"date":"2022-08-03","event":"Solana developers and security researchers publicly attribute the exploit to Slope Wallet's Sentry misconfiguration. Solana Foundation confirms no protocol-level vulnerability.","source":""},{"date":"2022-08-03","event":"Slope Finance offers a 10% bounty to the attacker for return of 90% of stolen funds within 48 hours. No response from attacker.","source":""},{"date":"2022-08-04","event":"Security firm OtterSec and others confirm that Slope's app transmitted seed phrases in plaintext to centralized Sentry servers. The Block publishes findings.","source":""},{"date":"2022-08-10","event":"Sentry publishes its own post-mortem, clarifying that Slope Finance failed to configure available data-scrubbing settings.","source":""},{"date":"2022-08","event":"Slope Finance publishes its Digital Forensics and Incident Response (DFIR) report acknowledging the Sentry vulnerability but concluding it cannot 'conclusively explain' the full hack.","source":""},{"date":"2022-08","event":"Victims organize under slopeaction.org seeking reimbursement and a formal acknowledgment of culpability.","source":""},{"date":"2023-03","event":"ZachXBT observes hacker addresses becoming active again, laundering funds from original theft addresses on Solana.","source":""},{"date":"2023-10","event":"ZachXBT publishes on-chain analysis tracing stolen funds from Solana through Binance nested exchanges, Tornado Cash (322 ETH), SWFT bridge to TRON, and into OTC cash-out addresses.","source":""},{"date":"2023-10","event":"ZachXBT warns the public to avoid zkME, a new project allegedly founded by Slope Wallet's Leal Cheung following abandonment of Slope Finance.","source":""}],"sources_used":[{"url":"https://solana.com/news/8-2-2022-application-wallet-incident","name":"solana.com","type":"other","archive_url":"http://web.archive.org/web/20260509142247/https://solana.com/news/8-2-2022-application-wallet-incident","credibility":3,"archive_timestamp":"2026-05-09T14:22:47+00:00"},{"url":"https://www.coindesk.com/business/2022/08/03/solanas-latest-6m-exploit-likely-tied-to-slope-wallet-devs-say","name":"coindesk.com","type":"other","archive_url":"http://web.archive.org/web/20260505063053/https://www.coindesk.com/business/2022/08/03/solanas-latest-6m-exploit-likely-tied-to-slope-wallet-devs-say","credibility":3,"archive_timestamp":"2026-05-05T06:30:53+00:00"},{"url":"https://slope-finance.medium.com/slope-wallet-sentry-vulnerability-digital-forensics-and-incident-response-report-d7a5904e5a39","name":"slope-finance.medium.com","type":"other","archive_url":"http://web.archive.org/web/20251118153730/https://slope-finance.medium.com/slope-wallet-sentry-vulnerability-digital-forensics-and-incident-response-report-d7a5904e5a39","credibility":3,"archive_timestamp":"2025-11-18T15:37:30+00:00"},{"url":"https://hackmd.io/@prastut/SJoJUzKz3","name":"hackmd.io","type":"other","archive_url":"https://web.archive.org/web/20260830042839/https://hackmd.io/@prastut/SJoJUzKz3","credibility":3,"archive_timestamp":"2026-08-30T04:28:39+00:00"},{"url":"https://www.theblock.co/post/161425/slope-wallet-provider-saved-user-seed-phrases-in-plain-text-solana-security-researchers-find","name":"theblock.co","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://ackee.xyz/blog/2022-solana-hacks-explained-slope-wallet/","name":"ackee.xyz","type":"other","archive_url":null,"credibility":3,"archive_error":"error:invalid-host-resolution","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://blog.sentry.io/2022/08/10/slope-wallet-solana-hack/","name":"blog.sentry.io","type":"other","archive_url":null,"credibility":3,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://cointelegraph.com/news/experts-find-private-keys-on-slope-servers-still-puzzled-over-access","name":"cointelegraph.com","type":"other","archive_url":"http://web.archive.org/web/20260829130810/https://cointelegraph.com/news/experts-find-private-keys-on-slope-servers-still-puzzled-over-access","credibility":3,"archive_timestamp":"2026-08-29T13:08:10+00:00"},{"url":"https://crypto.news/slope-wallet-hacker-bridged-funds-to-tron-cashed-out-through-otcs/","name":"crypto.news","type":"other","archive_url":"http://web.archive.org/web/20250914144321/https://crypto.news/slope-wallet-hacker-bridged-funds-to-tron-cashed-out-through-otcs/","credibility":3,"archive_timestamp":"2025-09-14T14:43:21+00:00"},{"url":"https://www.binance.com/en/feed/post/2023-10-10-slope-finance-s-4m-hack-funds-traced-in-recent-on-chain-analysis-by-zachxbt-1300002","name":"binance.com","type":"other","archive_url":"https://web.archive.org/web/20260829143931/https://www.binance.com/en/square","credibility":3,"archive_timestamp":"2026-08-29T14:39:31+00:00"},{"url":"https://beincrypto.com/slope-offers-solana-wallet-hackers-bounty-threatens-legal-action/","name":"beincrypto.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://slopeaction.org/","name":"slopeaction.org","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-job","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.globenewswire.com/news-release/2022/02/24/2391653/0/en/Slope-Finance-announces-the-close-an-8m-Series-A-funding-co-lead-by-Solana-Venture-and-Jump-Capital","name":"globenewswire.com","type":"other","archive_url":"https://web.archive.org/web/20260830005339/https://www.globenewswire.com/news-release/2022/2/24/2391653/0/en/slope-finance-announces-the-close-of-an-8m-series-a-funding-co-lead-by-solana-venture-and-jump-capital.html","credibility":3,"archive_timestamp":"2026-08-30T00:53:39+00:00"},{"url":"https://www.coindesk.com/business/2022/02/23/solana-wallet-slope-finance-raises-8m","name":"coindesk.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://cointelegraph.com/press-releases/slope-finance-completes-8m-series-a-funding-led-by-solana-ventures","name":"cointelegraph.com","type":"other","archive_url":"http://web.archive.org/web/20250816131358/https://cointelegraph.com/press-releases/slope-finance-completes-8m-series-a-funding-led-by-solana-ventures","credibility":3,"archive_timestamp":"2025-08-16T13:13:58+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":true,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:48.563708+00:00","updated_at":"2026-08-30T05:14:12.88625+00:00"}}