SECURITY ALERT

The keys were never meant to be in the logs.

They were, and the logs were on the open internet.

Proxima, a Solana trading app, said in a post-mortem on X at 22:16 UTC on Saturday that an attacker drained 5,324.2 SOL from 870 wallets belonging to 181 users, about 0.1% of its wallets, between 03:22 and 05:42 UTC on 14 Nov. It says every confirmed loss has been covered from its own treasury and the platform is operating again.

Our first report carried Proxima’s early estimate of $200,000 to $250,000. The figures below come from the company’s own report, and we have not checked them on chain.

What Proxima says went wrong

Proxima says three things combined.

First, private key material was written to diagnostic logs. A debug-level log line added during development for private-beta features was meant never to run in production. It did, the report says, when the production log level was lowered from info to debug to monitor performance. Keys were logged between 3 Nov and 13:20 UTC on 10 Nov, when the logging was switched off.

Second, the logs were kept for 15 days in a SigNoz monitoring instance. SigNoz is a third-party monitoring tool. Proxima says its version had a publicly disclosed vulnerability that allowed unauthenticated access to stored data, and that an external consultant had set it up months earlier. It says the upgrade had been “repeatedly postponed”.

Third, a Cloudflare firewall rule meant to keep the instance off the public internet “was inadvertently removed”, it says.

Proxima says the attacker pulled the logs between 02:16 and 05:30 UTC on 14 Nov and drained wallets while the extraction was still running. It says its primary databases and core systems were not directly breached.

Proxima’s account is the only one we have. We found no statement from SigNoz or the consultant.

The timeline Proxima gives

  • 03:22 UTC, 14 Nov: first confirmed unauthorised drain.
  • About 04:45: Proxima begins receiving alerts.
  • 05:23: it starts moving funds out of exposed wallets while the attack continues.
  • 05:42: last confirmed drain.
  • Later that day: the app goes offline, is secured, and returns in the evening with refunds credited.

The number that does not match

The report gives the loss in SOL and no dollar figure. Kraken’s SOL price traded between about $74.7 and $76.3 across the attack window. At $75 to $76, 5,324.2 SOL is worth about $400,000. That is our own calculation.

It is roughly double the $200,000 to $250,000 Proxima gave at 06:48 UTC on Saturday, when it also said that was less than 5% of total funds. The post-mortem does not say why the figures differ. It may reflect a different basis for valuing the coins. We do not know.

What changes for users

Proxima says it replaced each exposed wallet with a new one under the same account, linked to the same launches, and labelled old wallets “Compromised” or “Possibly exposed”. It says wallets created after 13:20 UTC on 10 Nov were not affected by this exposure, and that wallet age alone does not decide whether a wallet was exposed.

It paused automated sessions, including autobuy, autosell and market-making, so users must restart them on the new wallets. It invalidated sessions, rotated credentials and now requires two-factor authentication for private key exports.

A small number of unusually large token positions were left in the original wallets “to avoid disrupting their markets”, it says, and will be handled with their owners.

Protect yourself

  • Stop using any wallet Proxima labels Compromised or Possibly exposed, and do not send funds to it.
  • If you used one of those wallets outside Proxima, treat its private key as compromised everywhere.
  • Check your paused automations before restarting them on the replacement wallets.
  • Ignore refund or recovery offers sent by direct message. Proxima lists its support contact in the post-mortem.

Another incident this weekend, with a different cause: Unocoin said its own paper backup keys were compromised.

Corrections and new evidence: [email protected]

This article is for information only and is not investment advice.