What happened
SwissBorg disclosed a September 2025 incident affecting more than 192,000 staked SOL through its provider Kiln. Kiln reported that a malicious transaction was signed on August 31 and unauthorized activity was detected on September 8. SwissBorg said its own custody infrastructure was not breached.
Technical root cause
A compromised transaction-construction service supplied malicious instructions that were approved by legitimate customer signers. Kiln identified the GitHub token compromise but did not establish how the token itself was stolen.
How it happened
- Kiln's investigation identified a compromised engineer's GitHub access token as the entry point.
- The attacker triggered CI workflows to obtain infrastructure credentials and modified a running Kiln Connect API service.
- For sufficiently large Solana stake accounts, the service returned a malicious transaction changing withdrawal authority alongside the expected unstaking transaction.
- The customer approved the transaction through its custody signers. The altered authority gave the attacker control over the affected stakes.
Protocol details
Classification
Infrastructure / Exchange (DEX) / Frontend & Infrastructure
Protocol Type
CEX
Affected asset / contract
BORG
Protocol links
Website
@swissborg
Evidence
- report @rishabhsrishi incident report x.com
- report @swissborg incident report x.com
- report @BlockFlow_News incident report x.com
- analysis Website reference cryptorank.io
- analysis DeFiLlama defillama.com
- analysis SwissBorg security impact from Kiln breach swissborg.com
- analysis Kiln incident findings and service re-enablement kiln.fi
- analysis Kiln and SwissBorg joint statement swissborg.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
