TL;DR
- Swiss wealth management platform SwissBorg lost approximately $41.5 million in a supply chain attack
- The breach targeted Kiln, a trusted third-party Solana staking provider, rather than SwissBorg directly
- Attackers seized control of nearly 193,000 SOL by embedding malicious instructions in a standard unstaking request
- The incident highlights growing risks of third-party dependencies in crypto infrastructure
- September 2025 saw roughly $127 million lost across 20 major crypto exploits
Swiss wealth management platform SwissBorg has become the victim of one of the largest crypto security breaches of September 2025, losing approximately $41.5 million in a sophisticated supply chain attack that exploited its third-party staking provider, Kiln. The attack, which occurred in the third week of September, did not target SwissBorg’s own infrastructure directly but instead compromised the trusted intermediary that handles Solana staking operations on its behalf.
How the Attack Unfolded
The attackers identified Kiln, a widely used staking infrastructure provider, as the weakest link in the chain. Rather than attempting to breach SwissBorg’s own security measures, they infiltrated Kiln’s systems and embedded malicious instructions within what appeared to be a routine unstaking request.
When the request was processed, the hidden payload granted the attackers control over nearly 193,000 SOL, valued at approximately $46.2 million at September 2025 prices near $239 per token. The malicious code was carefully concealed within the normal data flow of the unstaking process, making it extremely difficult to detect through standard monitoring.
The Supply Chain Vulnerability
This attack exemplifies a growing trend in crypto exploitation: targeting the interconnected web of service providers rather than the primary platforms themselves. As the crypto ecosystem has matured, projects increasingly rely on specialized infrastructure providers for staking, custody, and data services. Each of these relationships creates a potential attack surface.
Kiln, as a staking provider, had privileged access to customer funds by the very nature of its service. When that trust was compromised, the downstream effects cascaded to SwissBorg and its users. The attack demonstrates that a platform’s security posture is only as strong as its most vulnerable third-party dependency.
September 2025 Security Landscape
The SwissBorg-Kiln incident was part of a broader wave of crypto exploits during September 2025. According to blockchain security firm PeckShield, approximately 20 major crypto exploits occurred during the month, resulting in combined losses of $127 million. While this figure represents a 22% decline from August’s $163 million in losses, the month still underscored persistent vulnerabilities across the ecosystem.
Other significant September incidents included the UXLINK exploit, which ultimately cost the Web3 social project approximately $44 million through a compromised multisig wallet, and a phishing attack on the Venus lending platform that cost a single user $13 million.
Broader Trends in 2025
The SwissBorg breach fits into a troubling pattern for 2025. Blockchain security firms report that over $3.1 billion was stolen in the first half of the year alone, already surpassing the full-year total of $2.85 billion in 2024. Supply chain attacks and access control failures have emerged as dominant vectors, with wallet compromises accounting for approximately 69% of losses by value in the first half of the year.
The year has also seen a shift in attacker methodology. Rather than focusing solely on smart contract vulnerabilities, threat actors increasingly exploit operational weaknesses: compromised private keys, social engineering, and supply chain infiltration. The $1.5 billion Bybit breach in Q1 2025, attributed to North Korean-linked actors, exemplified this trend on a massive scale.
Why This Matters
The SwissBorg-Kiln attack serves as a stark reminder that decentralization does not eliminate centralized points of failure. While blockchains themselves may be secure, the infrastructure built around them often relies on trusted intermediaries that can become single points of compromise.
For users, the incident underscores the importance of understanding how and where their assets are custodied. For platforms, it highlights the critical need for rigorous due diligence on third-party providers, regular security audits of supply chain relationships, and contingency plans for when trusted partners are compromised.
As Bitcoin trades near $115,700 and Ethereum hovers around $4,480, the growing value locked in crypto ecosystems makes every vulnerability more lucrative for attackers. The industry’s security practices must evolve at least as quickly as the threats they face.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Always conduct your own research before making investment decisions.
193k SOL moved on a single signed transaction from Kiln. no multisig on an unstaking flow handling 9 figures is beyond reckless
Kiln validated the transaction format but not the semantics. basic output validation on the unstaking instruction would have caught the malicious payload instantly
teams audit their own contracts then hand signing keys to a third party with zero verification. the supply chain is always the weakest link
Liquid staking derivatives are the backbone of modern DeFi
193k SOL moved through a single signed unstaking request. no timelock, no multisig, no output validation. basic circuit breaker would have saved 41.5M
the embedded malicious instructions in a standard unstaking request is the scary part. looks completely normal on the surface until you decode the payload
Cross-chain DeFi is the next frontier
supply chain attacks targeting staking providers specifically because they hold massive pooled assets. low effort high reward
Ines Moreau the $127M lost in September 2025 alone from supply chain attacks. protocols trust their staking providers but who audits the providers
stake_risk_ nobody audits the providers because due diligence in crypto means checking if the website looks professional. its security theater all the way down
AMM innovations like concentrated liquidity changed everything
Smart contract audits have improved dramatically since 2022
193K SOL stolen through a staking provider not the exchange itself. third party dependency risk is the real threat here
kiln burns 193K SOL through a malicious unstaking request. the attack was hidden inside a normal operation. supply chain attacks are the new flash loan exploits
kiln_ burns_ 193K SOL through a single unstaking request. the attack surface of pooled staking is massively underestimated
supply chain attacks will keep happening until protocols start treating third party integrations like untrusted code. trust but verify is not enough in crypto
193k SOL gone because nobody thought to verify the unstaking payload from their own provider. multi-sig on treasury but blind trust on the staking layer
Ottilia R. this is the real problem. teams audit their own contracts then hand keys to a third party with zero verification
127M across 20 exploits in september alone and this wasnt even the biggest one. supply chain attacks are the new bridge exploits
SwissBorg lost 41.5M because Kilns unstaking flow had no multi-signature requirement on output. 193k SOL moved on a single signed transaction
kiln_burned_ the malicious instructions were embedded in what looked like a standard unstaking request. Kiln validated the format but not the semantics. basic schema checking would have caught it
Solene P. schema validation catching format but not semantics is the oldest bug in integration testing. every team says theyll add semantic checks after the incident
127M lost across 20 exploits in September 2025 alone and third-party providers were involved in most of them. the supply chain is the weakest link in crypto security
kiln handling 193k SOL with no multisig on the output destination is the kind of thing that sounds insane in hindsight but nobody questions during normal operations
relay_fault_trace_ Kiln handling 193k SOL with no multisig on output is the kind of thing every staking provider is guilty of. until someone loses 9 figures nobody upgrades their flow