SwissBorg’s API Breach Exposes Crypto’s Infrastructure Weakness

SwissBorg, a Switzerland-based crypto wealth management platform, lost approximately $41 million in Solana (SOL) tokens following a security breach involving its staking partner, Kiln. The incident, reported on September 8, 2025, impacted the company's Solana Earn program but did not affect its broader app or other Earn programs. According to on-chain investigator ZachXBT, hackers stole around 192,600 SOL, valued at the time at $41.5 million [1]. The breach reportedly originated from a compromised API within Kiln’s infrastructure, which SwissBorg used to communicate with Solana’s staking network [1].

SwissBorg confirmed that the stolen funds were drained through a vulnerability in the API, allowing hackers to manipulate requests and siphon off SOL. The company emphasized that the breach did not affect its financial stability or the integrity of its other services. "Daily operations are unaffected, and the affected users will be contacted directly by email," SwissBorg stated in its public announcement [1]. The company’s CEO, Cyrus Fazel, described the event as a “bad day” but clarified that it was not a fatal blow to the business, noting that the affected users represented less than 1% of the total customer base and 2% of total assets [2].

To mitigate the impact on users, SwissBorg has pledged to use its SOL treasury to compensate affected customers for the majority of their losses. Final figures for the reimbursement are pending, but the company has already engaged white-hat hackers and security partners to recover the funds. The company is also collaborating with international agencies and exchanges to trace the stolen assets and block further transactions [1]. Blockchain data indicates that the stolen funds were transferred to a Solana wallet now marked as the “SwissBorg Exploiter,” with warnings urging users to exercise caution when interacting with it [3].

This incident occurred amid a wave of high-profile security breaches in the crypto ecosystem, including a supply chain attack on npm, a package manager used widely in JavaScript development. The npm breach, attributed to a phishing attack on a trusted developer, resulted in the distribution of malicious code that altered transaction addresses to redirect funds to attacker-controlled wallets. Ledger’s CTO, Charles Guillemet, advised crypto users to avoid executing on-chain transactions unless using hardware wallets, which require manual approval for each transaction [2].

SwissBorg’s response to the hack reflects a broader industry trend of prioritizing user compensation and transparency in the wake of security incidents. The company’s commitment to reimbursing users from its treasury underscores its financial resilience and dedication to maintaining trust in its platform. The incident also highlights the growing complexity of crypto security, with attacks increasingly targeting infrastructure providers and APIs rather than individual users. As the industry continues to evolve, companies like SwissBorg are under increasing pressure to enhance their security protocols and collaborate with external experts to recover stolen assets and prevent future breaches [1].

Source:

[1] SwissBorg hacked for $41M in Solana after Kiln API compromise (https://cointelegraph.com/news/swissborg-hacked-41m-sol-api-compromise)

[2] New Security Breach Threatens Crypto And Everyday Apps (https://www.forbes.com/sites/digital-assets/2025/09/08/new-security-breach-threatens-crypto-and-everyday-apps/)

[3] SwissBorg loses 193K SOL in Solana exploit (https://cryptobriefing.com/swissborg-loses-193k-sol-s41m-solana-exploit/)