Kiln Security Breach Highlights Risks in External Staking Infrastructure

On September 8, 2025, a major security breach at Kiln, a prominent staking provider, resulted in the loss of customer funds. This incident, according to Fireblocks, was executed by a sophisticated attacker who managed to bypass multiple security protocols, including audits, penetration tests, and SOC 2 compliance. The breach has raised significant concerns about the security of external staking infrastructures.

Unraveling the Kiln Attack

The attack began with the compromise of a Kiln infrastructure engineer’s GitHub access token, which allowed the attacker to inject malicious code into the Kiln Connect API. This code alteration enabled the attacker to manipulate unstaking transactions by embedding hidden instructions that transferred withdrawal authority of stake accounts to their address. As a result, institutional customers unknowingly signed transactions that reassigned control of their staked assets.

This breach highlights a critical issue: institutions often rely on external decentralized applications (dApps) for staking, which involves blind-signing transactions they cannot fully verify. The Kiln incident serves as a stark reminder of the inherent risks associated with such practices and the need for more integrated and secure staking solutions.

Structural Vulnerabilities of External Staking

The Kiln incident exposes the systemic vulnerabilities in how institutions interact with external staking providers. When using these dApps, users initiate actions in third-party applications, receive serialized transaction data, and sign based on incomplete information. This process requires trusting that the backend, serialization layer, and payloads are secure, which may not always be the case.

For institutions with stringent compliance requirements, this model is fundamentally flawed. The risks associated with external dApps are incompatible with the secure functioning of digital asset operations.

Fireblocks’ Response and Native Staking Solution

In response to the Kiln breach, Fireblocks implemented immediate protective measures, including blocking compromised dApps, halting API integrations, and facilitating the migration of external staking positions to its native solution. Fireblocks emphasizes that its native staking platform is designed to prevent such attacks through a fundamentally different architecture.

Fireblocks’ native staking solution offers intent-based operations, policy engines for staking governance, human-readable transaction verification, and secure enclave serialization. These features ensure that every step of the staking process is controlled and validated, eliminating the possibility of unauthorized actions within the transaction flow.

Security by Design: The Future of Staking

The Kiln incident underscores the importance of security by design in staking infrastructure. As the cryptocurrency industry continues to grow and attract more sophisticated adversaries, the need for robust, architecturally secure solutions becomes paramount. Fireblocks’ approach ensures that even if external systems are compromised, the architecture itself prevents potential attack vectors from being exploited.

This incident serves as a catalyst for institutions to reassess their staking strategies and consider native solutions that offer enhanced security and operational efficiency.

Image source: Shutterstock