Kiln

Kiln builds the staking layer that other companies put their brand on. A wallet or exchange integrates Kiln's Connect API or no-code widget, users press stake, and Kiln's validators (dedicated or shared) do the work across 30+ networks. The client, or its custodian, keeps the keys that control withdrawals. Kiln also sells an ETH staking contract product (Onchain) and routes stablecoin deposits into lending protocols such as Aave, Morpho and Compound.

Customers named on its site include Ledger, Fireblocks, BitGo, Bitpanda, Trust Wallet and VanEck. In August 2025 India's CoinSwitch picked Kiln for staking across its 20 million users. In February 2026 Kiln became a node operator for Lido v3.

On 8 September 2025 SwissBorg and Kiln announced that SOL had been removed from a wallet used for SwissBorg's Solana Earn staking. Onchain analysis put the loss at about 192,600 SOL, roughly $41 million.

Kiln's own write-up (7 October 2025) traced it to a compromised GitHub access token belonging to one of its infrastructure engineers. The attacker used it to run CI/CD workflows, collect cloud credentials and plant code in the Kiln Connect API. The altered endpoint added a hidden transaction to routine "deactivate stake" requests for Solana stake accounts holding more than 150,000 SOL, handing withdrawal authority to the attacker. According to one analysis, a request that looked like a 975 SOL unstake on 31 August carried eight extra instructions. The client signed it in its custody system without decoding it, and the funds were drained on 8 September.

Kiln then exited all its Ethereum validators as a precaution. That took 10 to 42 days in the exit queue plus up to nine days for withdrawals; no ETH was lost. SwissBorg paused SOL Earn and said it would reimburse affected users itself.

After the review with Sygnia, Kiln listed six changes: zero-trust access, hardened CI/CD, blast-radius isolation, container hardening, 24/7 monitoring and stronger validator key protection. Its public advice to clients was blunt: decode every transaction before signing.

The 2025 incident was an infrastructure breach, not a slashing. Kiln publishes anti-slashing guidance under a "better down than slashed" rule: a validator it is unsure about is taken offline rather than risk signing twice. Since May 2023 it has given every customer a base level of slashing cover, and clients can buy more from Chainproof, which is reinsured by Munich Re. The public post does not state limits. Institutional clients should ask for the policy.