SOON has completed its security incident review, confirming that neither the protocol nor user assets were affected, and its mainnet RPC has been restored.

Solana Optimistic Network (SOON) announced that the security incident detected on July 12 has been fully investigated and resolved. The incident did not involve vulnerabilities in the SOON protocol, sequencer, or user-facing smart contracts, and no user funds were lost. SOON noted the root cause was a security issue in its off-chain operational environment. According to third-party security firm BlockSec, external attackers gained unauthorized access via a misconfigured service, then penetrated parts of the internal environment due to insufficient access controls. The incident was limited to certain operational infrastructure and related processes, with no impact on on-chain user assets, user smart contracts, or SOON network security. Post-incident, SOON suspended its sequencer and some services and launched a full security review. During this period, functions including NFT minting, token claiming, and on-chain withdrawals were temporarily disabled. SOON restored NFT minting and token claiming on July 21, and resumed mainnet RPC services and block production on July 27. The network has now returned to normal operation.