NFT collectibles platform Candy Digital is investigating unauthorized cryptocy withdrawals affecting an estimated 1,500 Solana wallets after more than 425 SOL was traced to a collection address. The company temporarily disabled its website, restricted NFT transfers and announced plans to reimburse affected users. Blockchain investigators subsequently identified a 420 SOL transfer to a second wallet, but the identity of the recipient remains unknown. The incident raises new questions about wallet security following Candy’s recent migration of its sports and entertainment collectibles to Solana.
Candy Digital, a digital collectibles company known for officially licensed NFTs tied to Major League Baseball, DC Comics and other entertainment properties, reported suspicious activity involving user wallets on October 12.
The company temporarily disabled Candy.io while investigating reports that SOL had been withdrawn from wallets associated with its platform.
Candy advised users to move any remaining SOL into newly created wallets that had never been connected to its services.
The company also warned customers about scammers impersonating support representatives.
The cause of the withdrawals has not been publicly established.
Blockchain investigators associated with DC3 reported that funds began moving from Candy-linked wallets on October 11.
Their analysis identified approximately 1,500 potentially affected wallets and more than 400 SOL transferred to a common destination.
A separate examination of Solana blockchain records by SOLANA·HUB identified:
1,547 successful transactions involving the collection address.
425.99 SOL held at that address during the October 12 investigation.
A major concentration of incoming transactions during the morning of October 12.
The transaction count does not necessarily equal the number of unique affected wallets.
Investigators reported that the withdrawals appeared to have been signed using the wallets’ corresponding keys, raising concerns about access to wallet credentials.
However, Candy has not confirmed how the unauthorized transactions were initiated.
The investigation took another turn when 420 SOL moved from the collection address to a new Solana wallet shortly before midnight UTC on October 12.
Blockchain records show the transaction was authorized by the sending wallet.
However, investigators could not establish who controlled the receiving address.
The transfer therefore cannot be classified as a confirmed recovery, repayment or movement by the attacker.
Researchers also identified several small transactions involving wallet addresses designed to resemble the original addresses.
This activity is consistent with address poisoning, a scam technique in which attackers create lookalike wallet addresses hoping users will mistakenly copy them when sending cryptocy.
There is no confirmed evidence that these small transactions caused the original Candy wallet withdrawals.
In an October 12 community update, Candy announced additional protections intended to prevent further disruption.
The company activated a security protocol that temporarily restricted transfers and sales of minted NFTs between wallets.
Candy said two internal audits had found no evidence of missing NFTs.
The company also announced plans to reimburse SOL withdrawn during the incident and provide additional information about restarting its platform.
However, several questions remain unanswered:
How much SOL will ultimately be reimbursed?
When will affected users receive compensation?
What caused the unauthorized withdrawals?
Who controls the wallet that received 420 SOL?
The reimbursement announcement represents a commitment to a future process, not confirmation that customers have already received their funds.
The security incident comes only months after Candy announced a major transition to the Solana blockchain.
In April 2026, Candy revealed plans to migrate its licensed digital collectibles to Solana using Metaplex Core, an NFT standard designed to support onchain ownership and creator royalties.
The migration was intended to give collectors greater control over their assets and access to a broader marketplace ecosystem.
Candy promoted several benefits:
Lower transaction costs compared with more expensive blockchain networks.
Self-custody wallets for eligible collectors.
Third-party marketplace access, including Magic Eden.
Onchain royalty protections for creators and intellectual-property owners.
The company began migrating collectibles in phases during 2026.
The recent incident raises questions about the security of wallet arrangements used during that transition.
Importantly, a security issue involving platform-provided wallet credentials does not establish that the underlying Solana blockchain was compromised.
The incident highlights an important distinction between self-custody and wallets whose credentials may be managed or accessible through a platform.
With genuine self-custody, users exclusively control the private keys required to authorize transactions.
With embedded or platform-managed wallets, users may depend on a service provider’s infrastructure for some aspects of wallet access and security.
Investigators suggested that Candy’s wallet arrangements could have exposed users to additional risks if unauthorized parties gained access to signing credentials.
However, the exact security failure has not been confirmed.
Simply importing an existing wallet into another application does not change its private key.
If a wallet’s credentials may have been compromised, users generally need a new wallet with new credentials, rather than merely switching wallet applications.
As the investigation continues, Candy has warned users to be cautious of fraudulent recovery services and impersonators.
The company says it will not request customers’ seed phrases, private keys or passwords through unsolicited messages.
Users should verify security instructions through Candy’s official channels and avoid clicking unexpected links promising reimbursement.
Anyone potentially affected should also review the company’s official guidance before attempting to move or manage assets subject to the temporary security restrictions.
Candy Digital’s transition to Solana was designed to give NFT collectors greater control over their digital assets and expand access to blockchain marketplaces.
The unauthorized withdrawals now present a significant challenge to that strategy.
Although Candy reports that its internal audits have not identified missing NFTs, the apparent loss of SOL from platform-associated wallets has raised concerns about wallet management and the security of the migration process.
The company’s reimbursement plan may help affected users, but important details remain unresolved.
Artificial intelligence company Anthropic is warning that AI models could soon become capable of copying…
French cryptocy hardware wallet manufacturer Ledger has unveiled the Ledger Atom, an Android-powered device that…
Mastercard has officially launched its Global Money Platform, combining traditional currencies and stablecoins into a…
Cryptocy hardware wallet manufacturer Ledger has ordered resellers and distributors across seven Asian markets to…
Richard Heart, the controversial founder of HEX, PulseChain and PulseX, was reportedly arrested in Istanbul,…
Patrick Witt, the White House's top cryptocy policy adviser and executive director of the President's…