Hacker heist hits Kiln and delays Ethereum staking and unstaking

Kiln API breach causes SwissBorg to lose $41 million. Ethereum’s staking and unstaking queues exceed 45 days. No issues for CheckSig staking.

Kiln, a leading staking infrastructure provider, began an “orderly unstaking exit” of all Ethereum validators on September 10, 2025. The precautionary move follows a security breach that compromised SwissBorg’s Solana Earn program, resulting in the theft of roughly $41 million.

The exploit targeted Kiln’s application programming interface (API), enabling attackers to drain funds from SwissBorg. While Kiln’s Ethereum validators themselves were not compromised, the provider is exiting them as a precaution while the investigation continues.

This mass unstaking has created congestion in Ethereum’s validator queue:

• Unstaking now takes more than 45 days to complete.
• Staking requires more than 15 days.

Updated timelines are always available on validatorqueue.com.

SwissBorg Hack

• On September 8, 2025, SwissBorg confirmed that hackers exploited a vulnerability in Kiln’s API, draining 193,000 SOL (worth about $41 million).
• The attack targeted a single wallet used for Solana staking, affecting only Solana Earn users—around 1% of customers and 2% of assets under management.
• Both SwissBorg and Kiln activated emergency protocols, halted Solana staking operations, and contained further damage.
• SwissBorg committed to fully reimbursing affected users using its Solana treasury.
• Efforts are ongoing to track the stolen funds, now labeled as the “SwissBorg Exploiter” wallet on Solscan, with several exchanges freezing related transactions.

Kiln’s Response

• Suspended access to certain services, including its dashboard, widget, and API, to reinforce security.
• Confirmed no further losses beyond the SwissBorg incident.
• CEO Laszlo Szabo stressed that exiting Ethereum validators is a responsible safeguard to ensure stakers’ protection.
• The validator exit process will take 10–42 days; staking rewards will continue to accrue during this time.
• Withdrawals, once initiated, may require up to nine days to settle.
• A full post-mortem report will be published once the investigation concludes.

How CheckSig Uses Kiln

• CheckSig relies on Kiln’s infrastructure but our clients’ funds were never at risk, as we connect to Kiln via Hardware Security Modules (HSMs), not APIs.
• All client funds remain protected, covered both by CheckSig’s insurance and Kiln’s insurance.
• As always, we apply the highest security and operational standards to safeguard client assets.
• Thanks to redundancy and backup systems, staking and unstaking with CheckSig continue to operate normally—albeit more slowly due to Ethereum network congestion.