ZurVault and zurcovers by Cowl of Zur

Candy wallet incident: what we know so far Starting at about 7:00 PM ET on Oct 11, SOL has been withdrawn from Candy-provided wallets into a single address that was first used for this attack: HLwZCJB8YU6Yvq8HNMMNNrLCo1xammz95bCa3jm2k75c. A first wave emptied about a dozen of the largest balances within minutes. A much larger wave began around 6:00 AM ET on Oct 12 and swept wallets of all sizes. At the time of writing, that's roughly 1,500 wallets and 400+ SOL. This was not caused by anything we signed. Connecting your wallet to, or approving a transaction on, Magic Eden, OpenSea or anywhere else only approves that one transaction. It doesn't give anyone ongoing access to your wallet, and it can never let anyone move your SOL later. The withdrawals were authorized with each wallet's own key, automatically, across many wallets at once. The keys for these wallets are held by the platform, so the evidence points to unauthorized access to those keys. Candy is investigating, and we'll defer to their findings on exactly how it happened. What this means for us: •Treat any Candy-provided wallet as compromised, including if you've imported it into Phantom or another app. It's the same key, and a wallet's key can't be changed, so the exposure is permanent. • Don't send SOL or NFTs to these wallets until Candy gives the all-clear. • Your NFTs are at lower risk than your SOL. The same access could technically move NFTs, but so far only SOL has been taken. Candy's collections include admin controls that let Candy freeze or return NFTs, which makes stolen NFTs much less useful to an attacker and gives Candy a way to fix things if any are moved. • Ignore anyone offering "recovery" help in DMs. That's a common follow-up scam. I'll update this as Candy shares more.