Candy locks its site after SOL leaves Candy wallets
Candy says more SOL was taken from Candy wallets and the site stays locked. DC3 counts about 1,500 wallets. An RPC query shows 1,547 transactions into one address and a balance of 425.99 SOL.
On 12 October, Candy wrote on X that more SOL had been taken from Candy wallets. candy.io stays locked while the team investigates. Candy asks users to send SOL to a new wallet that has never been linked to Candy.
In the first post the same day, Candy names an issue affecting some users and a precautionary lockdown of the site. The contact address is fan-help@candy.io. Opening candy.io on 12 October showed a notice that the site was temporarily offline for maintenance.
For the move, Candy names the Phantom app or extension, signed in with the same login used for Candy. The next step Candy describes is a new wallet that was never linked to Candy. Candy says it will never DM first, and it will not ask for a seed phrase, private key, or password. It will not send a link to “verify” or “secure” a wallet. Candy says a message that does that is a scam.
Note: This is reporting, not investment advice. It is not an offer to recover lost funds.
Scope according to DC3, checked onchain
Neither Candy post gives a count, a recipient address, or a cause. The same day, DC3 wrote that from about 7 p.m. Eastern Time on 11 October, SOL moved out of Candy-provided wallets into one address: HLwZCJB8YU6Yvq8HNMMNNrLCo1xammz95bCa3jm2k75c. DC3 counts about 1,500 wallets and more than 400 SOL. DC3 says a first wave emptied about a dozen of the largest balances, and a larger wave began around 6 a.m. Eastern Time on 12 October. As of that post, DC3 says only SOL had moved.
DC3 says the withdrawals were signed with each wallet’s own key. DC3 writes that the platform holds those keys, and that this points to unauthorized access to them.
A wallet whose key only the holder knows is self-custody. An embedded wallet, or one a platform manages, is tied to that platform’s login. The platform can sign, or it holds the key. Loading the same key into another app keeps the same address. A new address needs a new wallet. DC3 says that about the Candy wallets: importing one into Phantom is the same key, and a wallet’s key cannot be changed.
Mainnet RPC query
On 12 October, getSignaturesForAddress on the public mainnet RPC returned 1,547 successful transactions for the address DC3 named, none of them failed. The oldest is 11 October at 23:02 UTC. The newest is 12 October at 11:22 UTC. By UTC hour: 13 transactions from 23:00 on 11 October, one at 01:00, then 109 from 09:00, 394 from 10:00, and 1,030 from 11:00 on 12 October.
Five samples, including the oldest and the newest transaction, are SOL transfers from other addresses to this one. None of the samples showed SOL leaving it. getBalance at slot 456,146,498 returned 425,991,862,592 lamports, which is 425.991862592 SOL. The query counts transactions, not unique senders.
What to watch
- The cause. Candy is investigating and has not named one
- Whether Candy confirms DC3’s count and address
- Whether SOL left the address after this query
Sources
- Candy — Security update, 12 October 2026, 1:55 p.m. Berlin · First post, 12 October 2026, 2:22 a.m. Berlin
- DC3 — Post, 12 October 2026, 4:25 p.m. Berlin
- candy.io — opened 12 October 2026, maintenance notice, candy.io/terms not readable
- Public mainnet RPC —
getSignaturesForAddress, fivegetTransactioncalls,getBalance, 12 October 2026, slot 456,146,498
Update, 13 October 2026: Overnight, exactly 420 SOL left the collection address for a new address. Candy says it is preparing to reimburse the drained SOL and that minted NFTs are locked. Candy prepares a reimbursement, 420 SOL leaves the collection address