A NullMeridian record Andromeda Logs

NullMeridianLog

8 Sep 2025

SwissBorg SOL Earn: Kiln Connect API Injected Malicious Unstake Instructions

SwissBorg: on 8 Sep 2025 a Kiln Connect API compromise during an unstake changed withdrawal authority on >150,000 SOL stakes. ~192,000 SOL affected. SwissBorg says its own custody was not breached.

  • Event date
  • Incident typeThird-party staking API compromise
  • Bug classSupply chain
  • Published

Loss, as sourced

Over 192,000 SOL unstaked via a fraudulent transaction, per SwissBorg. Schema description on the same page cites ≈$41M; SwissBorg's body text states the SOL figure.

Traceability

Primary sources

  1. 01swissborg.comSwissBorg security update on Kiln breach, 17 Nov 2025 (opens in a new tab)
  2. 02kiln.fiKiln security incident information (opens in a new tab)

In brief

Root cause: Per SwissBorg citing Kiln: compromise of a GitHub access token belonging to a Kiln infrastructure engineer; malicious payload in Kiln Connect API added instructions during deactivate that transferred stake withdrawal authority for orgs holding >150,000 SOL.

Timeline, as sourced: Per SwissBorg: 8 Sep Kiln sales outreach about large unstake; fraudulent tx detected within minutes; SEAL 911 opened; forensics concluded within hours that tampering was inside Kiln, not SwissBorg.

Account, as sourced

Claimed (SwissBorg) (update (opens in a new tab)): wallets and MPC custody remain secure; incident entirely within Kiln.

Claimed (SwissBorg): SwissBorg was first Kiln client to sign an unstake on a wallet holding >150k SOL.

Unknown: final recovery accounting.

Summaries of public sources as of the published date; except where marked (on-chain), not independently verified by NullMeridian. Figures are the sources’ own and are attributed; where sources disagree, each is given. Sources may since have changed. Not legal, financial or investment advice.

Permalinkhttps://andromeda.observer/e/swissborg-kiln-sol-unstake-2025