A single threat actor has compromised multiple Solana-native teams, gaining access through internet-reachable vulnerable services on development infrastructure to steal credentials and pivot toward funds. Initial entry points are primarily on managed bare metal systems reliant on individual hardening.
What the attacker does
-
Runs broad, provider-wide vulnerability scans against IP space known to host a dense
concentration of Solana teams (validators, stakers, DeFi, trading infra, tooling) to identify:
- Default logins
- Known CVEs
-
Publicly exposed data/metrics (file shares, Prometheus metrics, etc.)
- Utilized for further enumeration of assets and internal pivot points.
- Identifies internet-reachable vulnerable services and exploits them, using LLM-assisted tooling to adapt public PoCs/CVEs to the target.
- Once on a box, performs an LLM-assisted sweep for long-lived credentials, cached sessions, SSH keys, and cloud/API tokens.
- Uses harvested access to move laterally: first from the development host to CI/CD and deployment infrastructure, then to as many additional hosts as those credentials allow.
- Plants persistence via an attacker-controlled SSH key and/or a rogue local user or CI runner.
- Analyzes the newly reachable infra for hot-wallet and exploitable keys and begins scripted extraction of funds.
Why it's effective
-
In many observed cases, the initial vulnerable service was exposed to the internet by an AI
coding agent operating in an unsandboxed "auto-run" mode, without the operator being aware of
the resulting exposure.
- This means that the service is unlikely to be patched as its existence is either unknown, or seen as "only testing"
-
Targeting appears to be by infrastructure concentration, not by brand or TVL
- A hosting provider known for a dense cluster of Solana teams gets scanned wholesale, so being low-profile does not put you out of scope.
-
First stage techniques are off the shelf and well documented
- Commodity vulnerability scanning
- Default credentials
- Public CVEs/PoCs
- LLM assistance lets the attacker move through discovery, exploitation, and lateral movement quickly and largely hands-off.
- Long-lived credentials and standing SSH trust sitting on a single box let one foothold cascade into broad infrastructure access.
Indicators of compromise
- Attacker IPs, seen across multiple victims
-
64.34.85.235(Torn Down)114.80.39.74123.115.217.149103.219.171.171 - Operational identifier
op59This may be the internal campaign designator
- Persistence SSH key
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAOwqx0YSslGeZVYSz0Zwyf2BUyEw5xg0+q0dhSH5BR9 op59-runner-access- Malicious git commits authored/committed as
-
op@<your-domain>orci@<your-domain> - Data exfiltration via http calls to
-
https://webhook.site/This is a legitimate site being utilized to stand up a data exfiltration location disconnected from other C2 infrastructure