Verify a decision

{"actor":"system:backfill","investigation_id":"94e3f575-5e6e-4ba6-b37e-1d68beb43640","kind":"publish","page_slug":"solflare","published_at":"2026-11-05T17:58:48.016Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Solflare","sections":[{"content":"On 27 October 2026 Solflare announced that a security incident at an unnamed staking provider involved private keys the provider held for the Solflare validator. As a result the validator can no longer earn or distribute rewards to its delegators. Solflare stated that user funds were not affected, that delegated stakes remain in each user's own stake account, and that it was preparing an app update to help users migrate stake to a new validator. It said it plans compensation for users who complete the migration, but no amount or formula had been disclosed. The report notes that the funds-safe claim rests on Solflare's own statements and that CoinDesk and The Block had not yet covered the incident. The provider was not named and the cause and extent of the incident are not independently verified.","heading":"October 2026 staking provider security incident","severity":"medium","sources":[{"credibility":2,"name":"Crypto Briefing: Solflare says staking provider security incident halted its validator's rewards","type":"news_article","url":"https://cryptobriefing.com/solflare-staking-provider-security-incident-rewards/"},{"credibility":2,"name":"DailyCoin: Solflare security incident alert","type":"news_article","url":"https://dailycoin.com/solflare-security-incident-alert-what-sol-stakers-need-to-know/"}]},{"content":"A CryptoSlate review describes the wallet as partially open source: the SDK, token utilities, blocklist and MetaMask Snap code are published on GitHub, but this does not show that the full mobile and browser apps can be rebuilt from public code. The only third-party audit that review identified is a August 2023 Consensys Diligence review of specific MetaMask Snap repositories, which explicitly excluded the wallets interfacing with those Snaps. No published third-party audit of the core extension or mobile wallet was found, though this absence is based on secondary reviews and not exhaustive.","heading":"Audit status and code openness","severity":"medium","sources":[{"credibility":2,"name":"CryptoSlate: Solflare wallet review","type":"research","url":"https://cryptoslate.com/crypto-wallets/solflare-wallet-review/"}]},{"content":"CryptoSlate reports that Solrise Finance Ltd provides the wallet software, lists a British Virgin Islands address, and that a Croatian affiliate, Blockadopt d.o.o., operates the webshop and serves as EU privacy representative. TechRound lists Filip Dragoslavic and Vidor Gencel as co-founders and co-CEOs. Sources conflict on launch year (2020 versus 2021) and on origin; one Solana Compass page's claim that Solana Labs developed the wallet conflicts with other sources and is not relied on. A CB Insights record giving a 2007 founding in Tokyo appears to refer to a different entity. The Breakpoint 2026 agenda listing was not independently verified in this research. No allegations concerning any individual were found.","heading":"Corporate entity and leadership","severity":"low","sources":[{"credibility":2,"name":"CryptoSlate: Solflare wallet review","type":"research","url":"https://cryptoslate.com/crypto-wallets/solflare-wallet-review/"},{"credibility":3,"name":"TechRound 100: Solflare","type":"news_article","url":"https://techround.co.uk/techround-100/77-solflare/"}]},{"content":"Third-party trackers flag several domains impersonating Solflare, including web-solflare.to and solflare.app, as phishing sites. PCrisk also describes fake Solflare sites that record information entered into them. These are attacks on users by third parties, not alleged wrongdoing by Solflare. Solflare's help center states it cannot investigate or recover stolen funds. No direct breach of Solflare's own wallet software was found.","heading":"Impersonation and phishing sites","severity":"medium","sources":[{"credibility":3,"name":"PhishDestroy: web-solflare.to","type":"community_report","url":"https://phishdestroy.io/domain/web-solflare.to"},{"credibility":3,"name":"PCrisk: Solflare scam","type":"community_report","url":"https://pcrisk.com/removal-guides/22450-solflare-scam"},{"credibility":2,"name":"Solflare Help Center: what to do if your wallet is compromised","type":"official","url":"https://help.solflare.com/en/articles/13522176-what-should-i-do-if-my-solflare-wallet-is-compromised-or-funds-are-stolen"}]}],"sources_used":[{"credibility":2,"name":"Crypto Briefing: Solflare staking provider incident","type":"news_article","url":"https://cryptobriefing.com/solflare-staking-provider-security-incident-rewards/"},{"credibility":2,"name":"DailyCoin: Solflare security incident alert","type":"news_article","url":"https://dailycoin.com/solflare-security-incident-alert-what-sol-stakers-need-to-know/"},{"credibility":2,"name":"CryptoSlate: Solflare wallet review","type":"research","url":"https://cryptoslate.com/crypto-wallets/solflare-wallet-review/"},{"credibility":3,"name":"TechRound 100: Solflare","type":"news_article","url":"https://techround.co.uk/techround-100/77-solflare/"},{"credibility":3,"name":"PhishDestroy: web-solflare.to","type":"community_report","url":"https://phishdestroy.io/domain/web-solflare.to"},{"credibility":3,"name":"PCrisk: Solflare scam","type":"community_report","url":"https://pcrisk.com/removal-guides/22450-solflare-scam"},{"credibility":2,"name":"Solflare Help Center: compromised wallet guidance","type":"official","url":"https://help.solflare.com/en/articles/13522176-what-should-i-do-if-my-solflare-wallet-is-compromised-or-funds-are-stolen"}],"summary":"Solflare is a non-custodial wallet for the Solana blockchain, operated by Solrise Finance Ltd according to secondary sources. No regulatory action or direct breach of the wallet software was found in this research. In October 2026 Solflare reported a security incident at a third-party staking provider that stopped its validator from earning rewards. The company states user funds were not affected, a claim not yet independently confirmed.","timeline":[{"date":"2023-08","event":"Consensys Diligence reviews Solflare's MetaMask Snap repositories (excluding the wallets themselves).","source":"CryptoSlate","source_url":"https://cryptoslate.com/crypto-wallets/solflare-wallet-review/"},{"date":"2026-10-27","date_evidence":"Tue 27 Oct 2026 · 19:42 EDT","event":"Solflare announces a security incident at a third-party staking provider that halted its validator's rewards; says user funds are not affected.","source":"Crypto Briefing","source_url":"https://cryptobriefing.com/solflare-staking-provider-security-incident-rewards/"}]},"v":1}