Candy prepares a reimbursement, 420 SOL leaves the collection address
Candy says minted NFTs are locked and a reimbursement for the drained SOL is in preparation. 420 SOL moved to a new address. Who controls that address is not established.
On 12 October, Candy wrote on X that a security protocol locks minted NFTs. Candy says the lock stays until the platform is safe again and users control their assets again. The protocol blocks transfers and sales between wallets.
Candy is preparing to reimburse the drained SOL and to share plans for a platform reboot. The forensic review continues. Candy does not ask for a seed phrase or a private key, and it does not send a link to “secure” or “verify” a wallet.
Overnight into 13 October, exactly 420 SOL moved from the collection address HLwZCJB8YU6Yvq8HNMMNNrLCo1xammz95bCa3jm2k75c to FvNJKwKcVJahVCbKE6JFuic59FRWGqZBt3xgeVp9TFcz. The collection address signed the transaction. Who controls the new address is not established.
Shortly after, two addresses that start with FvNJ and end in Fcz sent 1,000 and 10,000 lamports to the collection address. An address that starts with HLwZ and ends in 75c sent 1,000 lamports to the new address. Copying the start and end of a real address is the pattern in Address poisoning on Solana.
At the query, the new address held 420.000001 SOL and the collection address held 5.991868581 SOL. The 12 October report has the earlier balance. The reimbursement amount, the process, and the cause are still open.
Note: This is reporting, not investment advice. It is not an offer to recover lost funds.
How we measured: getTransaction on the public mainnet RPC shows the transfer in slot 456,235,850. The block time is 12 October 2026, 23:58:22 UTC, which is 1:58 a.m. Berlin. The system instruction moves 420,000,000,000 lamports, and the fee is 5,012 lamports.
Right after that, the collection address held 5,991,857,580 lamports. getBalance at slot 456,371,896 showed 5,991,868,581 lamports there, and at slot 456,371,897 the new address held 420,000,001,000 lamports. Both accounts are owned by the System Program and have zero data.
The extra 11,001 lamports on the collection address are three incoming transfers. One lamport went to many recipients from an address that shares neither the start nor the end. Two lookalike addresses sent 1,000 and 10,000 lamports to the collection address, and a third sent 1,000 lamports to the new address.
Sources
- Candy — Community update, 12 October 2026, 10:56 p.m. Berlin · Article. The article text came from the public fxtwitter API. A direct fetch of x.com did not return it.
- Public mainnet RPC —
getTransaction,getSignaturesForAddress,getBalance,getAccountInfo, 13 October 2026 - 420 SOL transfer — slot 456,235,850, 1:58 a.m. Berlin, signature
- 1,000 lamports to the collection address — 1:59 a.m. Berlin, signature
- 1,000 lamports to the new address — 1:59 a.m. Berlin, signature
- 10,000 lamports to the collection address — 2:00 a.m. Berlin, signature
- 1 lamport to the collection address — 1:58 a.m. Berlin, signature
- SOLANA·HUB — 12 October outflows · Address poisoning on Solana