Solana Eco Wallet Slope: Server-side logging removed after discovery of vulnerability, 1444 wallets may be traced to this vulnerability

Solana ecological wallet Slope said it had removed server-side logging after discovering a vulnerability caused by the centralized Sentry server. Currently, 1444 (15%) of the 9223 wallets affected may be traced to this vulnerability. Slope is working with audit partners and the Solana Foundation to uncover any potential additional attack vectors, and has notified relevant law enforcement agencies to initiate a criminal investigation of the attackers. Blockchain security agency OtterSec tweeted this afternoon, “In the past two days, more than $4 million in assets have been stolen from Solana wallets, and it has been confirmed that the Slope mobile app sends mnemonics to its centralized Sentry server via TLS. These mnemonics are then stored in clear text, which means that anyone with access to Sentry can access the user's private key. About 1,400 of these addresses were present in Sentry in this attack, though not all of them were compromised. Stealing addresses. We are still investigating possible other media. In addition, more than 5300 private keys not included in this vulnerability attack were found in the Sentry instance, and 2358 of them had tokens in the addresses. Slope users are advised to transfer funds as soon as possible. "