Candy posted a community update on its blog on Thursday, October 15, at 11:47 a.m. ET, titled "Candy Community Update: Securing Your Collection and What Comes Next." Candy shared it on X at 11:48 a.m. ET, describing it as an update on "where things stand on securing your NFTs, restoring your SOL, your personal information, and what's next for the Candy platform." The update opens: "Thank you for your patience while we work to secure your NFTs and restore the SOL taken from your wallets."

Earlier updates

On Sunday, October 11, at 8:22 p.m. ET, Candy posted on X that it was "aware of an issue impacting some Candy users" and was "temporarily locking down the site while our team investigates and works toward a resolution." On Monday, October 12, at 7:55 a.m. ET, Candy posted: "We've seen more SOL taken from Candy wallets as of this morning."

Candy published a community update on its blog that afternoon at 4:56 p.m. ET. In it, Candy said it had "initiated a security protocol intended to lock minted NFTs in place" and that the protocol "prohibits transfers or sales between wallets." Candy wrote that "two of our internal audits have given us no reason to believe that anyone's NFTs have been lost." It also said it was "preparing to reimburse customers for their drained Solana as well as communicate plans for a platform reboot."

Solana Hub reported on October 13 that exactly 420 SOL moved from what it calls "the collection address" to a new address on October 12 at 23:58 UTC, which is 7:58 p.m. ET. Solana Hub reported that who controls the new address "is not established." Candy's October 15 update does not mention that transfer.

New wallets

Candy wrote that its "first step is setting up a new wallet for each of you through a third party with proven security," adding: "That work is making good progress." The update does not name the third party.

"If all goes well with testing, we expect to migrate your NFTs to your new wallets next week," Candy wrote. After the migration, Candy said it "will invite you to sign up for and sign into your new wallet and access your NFTs." From that point, according to Candy, "you will be able to connect your wallet to OpenSea and other marketplaces to view and trade your own NFTs outside of Candy."

Restoring SOL

"We will restore your stolen SOL to the same wallet as your NFTs," Candy wrote. "This will happen once we are confident the transfer will work securely, and only after your NFTs are there."

Personal information

Candy wrote that it "does not store credit card numbers, Social Security numbers, home addresses, or other sensitive personal information on our systems." It said payments "are handled by our third-party payment processor," and that card details never pass through or sit on Candy's servers. "You do not need to cancel or replace your cards because of this incident," the update reads. Candy added that it is "still reviewing whether any account information, such as email addresses, was accessed, and we will tell you as soon as we know."

A new Candy platform

Candy said it is "building a new Candy platform for finding, buying, and selling NFTs." It plans to roll it out in stages: "a clean, working site first, then meaningful improvements with each passing week." "We are not rushing this. Version one will take a number of weeks," Candy wrote.

Candy said the new platform is being re-architected "with the benefit of lessons learned and valuable feedback from our community," including "not relying too heavily on secondary marketplaces for search, smoother fiat payments, and designing for far greater resiliency after our own recent experience."

"We are not planning any primary sales, Quests, or Buybacks until, at the earliest, the new site launches," the update says.

Candy also wrote that it "will never DM you, ask for your seed phrase or private key, or send you a link to 'secure' or 'verify' your wallet."

What Candy has not disclosed

Candy has not disclosed how much SOL was taken. Candy has not disclosed how many wallets were affected. Candy has not disclosed the cause. Candy has not named the third party building the new wallets. Candy has not given a date for restoring SOL.

In the update's final section, Candy wrote: "We will communicate regularly on our progress to restore your collection's security and the tools to enjoy it."