In an incident that has rocked parts of the crypto staking ecosystem, SwissBorg recently disclosed a major exploit wherein about 192,600 SOL, worth roughly US$41.5 million, was siphoned from an external wallet tied to its SOL Earn product. The attack did not stem from a breach of SwissBorg itself but from a compromised API belonging to one of its partners.
What Happened with SwissBorg
- The attack was traced to a partner’s API which had been compromised. Through that API, malicious actors were able to access the wallet tied to SwissBorg’s SOL Earn offering and withdraw the funds.
- Though the amount stolen is large, SwissBorg reported that the exploit affected fewer than 1% of its users and represented about 2% of SwissBorg’s total assets under management.
- SwissBorg emphasized that all other funds and strategies remain secure. They have committed to covering the losses and ensuring that no user is harmed financially.
- As part of its response, SwissBorg paused SOL Earn redemptions, initiated recovery efforts, and is working with security firms, white-hat hackers, and law enforcement. A full incident report is expected.
This incident raises broader concerns not only about partner / third-party API security, but about architectural choices around transaction creation and who controls what part of the staking and funds flow.
Transaction-Crafting APIs: Why They’re Risky
An analysis by Chorus One throws light on the fundamental vulnerabilities associated with transaction-crafting APIs – a design pattern increasingly used in staking and DeFi services.
Here are the key points:
- Security by assumption vs. security by design: Many systems assume third parties (validators, API providers) will behave correctly. But Chorus One argues that architecture should enforce safety in such a way that even if a partner is compromised, funds are not immediately at risk.
- Transaction crafting explained: On Solana, staking involves creating transactions (e.g. delegate, deactivate, withdraw), which are encoded, signed, and broadcast. These transactions include parameters like which validator to use, how much SOL, etc.
- Libraries vs. APIs: Using a library (SDK) incorporated into the code of your own system means you can inspect and verify what it does. By contrast, a remote API that crafts a transaction and returns it to you introduces a dependency: you see the result, but you don’t control how it is generated—or whether it was maliciously altered.
- Even verifying every response from an API is nontrivial; malicious responses may not be obviously wrong and the cost of blindly trusting a third party can be very high in terms of financial exposure.
Chorus One’s position is that while APIs are useful for many purposes (such as broadcasting or querying the chain), transaction‐crafting APIs are an unnecessary risk, especially when alternative patterns (like SDKs or embedding open-source libraries) exist.
What This Means for the Industry
- Reconsider architectural choices: Platforms offering staking, yield products, or other DeFi services need to critically assess whether parts of their infrastructure should depend on third-party APIs that craft transactions. The SwissBorg incident shows the threat is not hypothetical.
- Transparency and control: Using open-source libraries or SDKs that allow auditability gives more assurance. Institutions or apps that build features should demand visibility into the code path that handles fund movement or transaction parameters.
- Risk mitigation and contingency: Even with safe design, compromises can occur. Layered security, such as limiting what an API can do, least privilege, monitoring, verifications, and temporary pauses (as SwissBorg did), is essential.
- Regulatory scrutiny may increase: As larger losses emerge from API or third-party compromises, regulators and users may demand higher standards and possibly audits of these components of crypto staking / yield providers.
The SwissBorg loss is a stark reminder that the weakest link in a complex system doesn’t have to be the core platform itself – it can be a partner, an API, or any component with permissions over funds or transaction logic. While APIs provide convenience and scalability, their use in crafting transactions entails serious trust assumptions that may not be acceptable for funds at scale.
Going forward, the industry might shift more toward security-by-design approaches: encoded, auditable components; more SDK or library-based integration; fewer black-box APIs with high privilege. These design choices may cost more up front, but the alternative – massive losses and reputational damage – is far costlier.
