SwissBorg’s API Flaw Exposes DeFi’s Weakest Link

SwissBorg, a Switzerland-based cryptocurrency wealth management platform, reported a $41.5 million loss in Solana (SOL) tokens following a security breach on September 8, 2025. The attack was traced to a vulnerability in a partner API, specifically affecting SwissBorg’s SOL Earn program. The stolen assets, amounting to approximately 192,600 SOL, were transferred to a newly created wallet now labeled as the “SwissBorg Exploiter” on Solscan. This incident, the largest breach for the company to date, represents nearly half of SwissBorg’s total Solana reserves, valued at $72.6 million [1]. The platform confirmed in an X post that the incident had no impact on its core systems or other services and emphasized that only about 1% of users were directly affected [2].

The breach originated from SwissBorg’s integration with staking provider Kiln, where attackers manipulated the API connection to siphon the funds. The company has since committed to using its Solana treasury to cover the majority of user losses, with final compensation amounts still under calculation. CEO Cyrus Fazel described the event as “a bad day, but not a fatal one,” underscoring the firm’s financial stability and operational resilience. SwissBorg is also collaborating with blockchain investigators, white-hat hackers, and security partners such as Fireblocks and the Solana Foundation to track down the stolen assets and prevent future breaches [1].

The attack has sparked broader industry discussions on API vulnerabilities and third-party integration risks, particularly in the decentralized finance (DeFi) space. According to data from the first half of 2025, DeFi protocols accounted for 76% of all breach cases, with security incidents rising despite increased awareness and audit efforts. The SwissBorg incident coincided with multiple high-profile breaches, including a $2.4 million exploit on the Sui blockchain’s Nemo Protocol and a $4.65 million rug pull in the Solana project Aqua. These events highlight the fragility of the DeFi ecosystem, particularly when it comes to cross-chain bridges, staking mechanisms, and smart contract dependencies [2].

In response to the breach, SwissBorg outlined immediate actions including the allocation of treasury funds for user compensation and the engagement of cybersecurity experts to assist in the recovery of stolen assets. The company has also announced plans to enhance its third-party risk oversight and strengthen overall security protocols. Despite the magnitude of the loss, the platform emphasized that its operations remain unaffected and that other Earn products and the SwissBorg app are secure. Users are being directed to the platform’s official X account for regular updates on the recovery plan [1].

The incident further underscores the growing challenges in the crypto industry regarding supply chain and on-chain security risks. Outside the DeFi sector, the JavaScript ecosystem was also impacted by a large-scale npm package compromise. Malicious code was injected into widely used packages like chalk and debug, which together receive over 2 billion weekly downloads. The attack involved a crypto-clipper malware that altered transaction recipient addresses across multiple blockchains, including Ethereum and Solana. Developers are advised to use secure build pipelines and pin affected packages to safe versions until patches are deployed [2].

Source: [1] SwissBorg Loses $41M in Solana Following API-Related Hack (https://crypto.news/swissborg-crypto-loses-solana-api-related-hack-2025/) [2] Swiss Crypto Platform SwissBorg Hit by $41.5M SOL Hack After Partner API Compromise (https://cryptorank.io/news/feed/92c8f-swiss-crypto-platform-swissborg-hit-by-41-5m-sol-hack-after-partner-api-compromise)