Solflare's Solana (SOL) Validator Goes Delinquent With 1.56 Million SOL Staked

Security Incident Stops Validator Rewards

Solflare's staking validator on Solana (SOL) stopped generating rewards after the third-party provider operating the node reported a security incident involving the validator's keys. The non-custodial wallet disclosed the problem in a post on X published at 7:26 p.m. ET on Tuesday, October 27, writing that its staking provider had notified it of “a security incident on their side, affecting the keys they hold for the Solflare validator.” The provider, which Solflare has not named, is investigating. The company gave no time for when the incident occurred and has not explained how the keys were affected.

Validator tracking data put 1,559,012 SOL under delegation to the Solflare validator as of 13:05 UTC on Wednesday, with the node marked delinquent and zero vote credits recorded in epoch 1070 so far. A second tracking service showed roughly the same stake total and the same delinquent flag. Vote credits count the block votes a validator lands in an epoch, the roughly two-day period into which the network splits its clock, so a zero reading means the node has not voted at all since the current epoch began. A delinquent validator is one that fails to vote on blocks, the work through which validators on Solana (SOL) earn rewards for themselves and their staking delegators. Rewards stop the moment voting stops, which is why delegators see their income flatline while their balance stays put. The Solana (SOL) price itself sits outside this event, which is operational rather than market-driven.

Principal is a separate matter. Solflare stated that delegated SOL sits in each user's own stake account and is controlled solely by that user's keys, and that the network's delegated proof of stake design prevents whoever holds a validator's keys from pulling stake out of a delegator's account. “No user funds were touched,” the company wrote.

Migration to a New Validator

Solflare is switching to a new validator, and users' delegated stake will have to move with it. The company said no action is required from stakers yet and that an upcoming app update will walk them through the move, though it has not given a date for that release. Rewards stay paused until the delegated stake is active on the replacement validator, so the income gap widens with each day the migration has not started. To soften the gap, Solflare is “working on a compensation plan for everyone who migrates,” but it has not said how large the payments will be or how they will be calculated.

The company also drew a hard line on how the move may happen: only through the Solflare app itself. It said it will never contact users by direct message and will never send them a link about the migration, a warning that matches the phishing patterns that typically follow any announcement touching wallet addresses and stake accounts. Solflare said it will post on X as soon as the migration path goes live. Solana's delegation model lets users redelegate at any time, but Solflare is steering everyone through its own update rather than leaving the move to manual redelegation.

The episode also turns attention to the layer most stakers never see: whoever physically runs the node. Solflare built its validator on an external staking operator, so the security of the delegation depends in part on infrastructure the wallet company does not itself control. That arrangement is common among wallet-run validators, but it concentrates operational key risk with a single provider, as this week demonstrated. For readers setting up or reviewing a position, our guide to how to stake SOL on Solflare covers the staking flow end to end, and our comparison of the best Solana wallets in 2026 places the wallet among the leading non-custodial options for the network.

The incident draws a clean line between validator-key compromise and depositor risk. Keys that must stay online to vote can fail without ever exposing principal, and that separation is exactly what delegated proof of stake was built to deliver. It also separates validator operational keys, a shared hot surface run by an outside operator, from a saver's own cold wallet custody. The open items are the disclosure gaps: the provider stays unnamed, the timing of the key incident is unknown, and the compensation formula is blank. Until the app update ships and stake reactivates on the replacement validator, the roughly 1.56 million Solana (SOL) earning nothing is the figure to track.