Curriculum·G205 Monitoring, Alerting, and Response·about 31 min

The compromise that leaves no on-chain trace

By the end of this lesson you can

→Explain why some compromises produce no on-chain signal: the drain looks like a legitimate signature
→Explain how the Slope wallet leaked thousands of seed phrases to a logging server with nothing visible on-chain
→Compute what on-chain monitoring can and cannot see, and which risks live entirely off-chain
→Identify the off-chain signals a user must watch: where secrets are stored and what their tools do with them

Graduate · enrolled learners

This lesson opens with Slope wallet, 2 August 2022.

What happened: Over the night of 2 to 3 August 2022, thousands of Solana wallets were drained at once, roughly 9,000 addresses for on the order of several million dollars. There was no smart-contract exploit and no flaw in Solana. The cause was found off-chain: the Slope mobile wallet transmitted users' seed phrases, the master secret that controls a wallet, in plaintext to the company's own centralized logging servers, where they sat readable. Whoever obtained those logs held the keys to every wallet in them and simply signed transactions to empty each one. On-chain, every drain looked exactly like a legitimate owner moving their own funds, because with the seed phrase it was a legitimate signature. Nothing on the chain revealed how the keys had been obtained, because the compromise had never touched the chain at all.
The decision point: The Slope victims were monitorable on-chain and it would not have helped them understand the cause, because the cause left no on-chain trace. The seed phrases leaked through a logging server; the chain saw only valid signatures draining wallets, indistinguishable from their owners spending. This is the limit of on-chain monitoring, and the reason it is not the whole of watching. A user's most catastrophic exposure, the master secret itself, is compromised off-chain, through what their wallet software does with the seed, where it is stored, what a browser extension can read, what a phishing page can capture. Those risks never appear on a block explorer. Watching them means watching a different surface, the handling of the secret, and knowing that a wallet which sends your seed anywhere has already lost the game no on-chain alarm can win back.
Recorded loss: $5,000,000

What you will be able to answer

→What caused the Slope wallet drain?
→Why did the Slope drains look legitimate on-chain?
→What is the limit of on-chain monitoring?
→How do you watch the off-chain surface?

Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.

It is free. We do not sell the list and there is nothing to buy at the end of it.

Enroll, it is free Sign in Start at the beginning

Terms used here

Seed phrase Phishing

Sources and review

Confidence high·Volatility medium·Reviewed 2026-09-14·Owner unassigned

Contested

The Slope incident affected roughly 9,000 wallets for a loss estimated between about 4 and 8 million dollars; the figures vary by source and by asset prices at the time. The plaintext transmission of seed phrases to Slope's logging servers was identified by multiple security teams as the cause.

Not every affected wallet was necessarily a Slope wallet, and the full population of leaked seeds was not perfectly bounded; the lesson uses the incident for the on-chain-invisibility point, which the leak mechanism supports regardless of the exact count.

← What to watch, and the outflow nobody watched Detection is the longest clock →