A Tokenized Silver Issuer Can Remove Tokens From Your Wallet. The SILV Hack Shows What RWA Ownership Really Means

Dominion Market launched SILV as a Solana-native token backed by physical silver. Each token was designed to track one troy ounce held in vault custody, with 24/7 trading and self-custody on a public blockchain.

Then its signing infrastructure was compromised.

On September 11, an attacker gained enough keys to control Dominion’s multisig arrangements, drained treasury assets and dumped SILV into decentralized exchange pools. Dominion responded by freezing thousands of token accounts and later said SILV acquired between 01:00 and 14:00 UTC that day would be removed from wallets, with affected buyers offered a USDC refund process.

The incident is an exploit story. The more important blockchain story is that the recovery is possible at all.

Self-Custody Did Not Mean the Issuer Had No Control

SILV uses Solana’s Token-2022 framework. Independent onchain analysis and a SolidProof review show that the mint carries both a freeze authority and a permanent delegate.

Those permissions are powerful by design. Solana’s own documentation says a permanent delegate can authorize transfers and burns from any token account for that mint, and the account owner cannot revoke that delegate. A freeze authority can stop a token account from transferring.

In other words, a holder can control the wallet’s private key while the issuer still retains defined powers over the token balance inside it. The wallet is self-custodied. The asset is not permissionless in the same sense as native SOL or BTC.

The Hack Was a Key-Management Failure Before It Was a Token Failure

Bitquery’s reconstruction says Dominion used two three-of-five multisigs with the same five signers. One controlled treasury functions and minting/redemption switches. The other controlled token-level powers including freezing accounts and moving SILV through the permanent delegate.

An attacker obtained three signing keys — enough to satisfy the threshold. That is the core failure. Multisig only distributes authority when the keys are genuinely independent. Five addresses do not create five security domains if three can be compromised together.

The SolidProof review had already highlighted authority concentration as a material risk in the deployment it examined, noting that freeze and seizure powers must be protected by robust multisig and governance controls. The exploit turned that architecture from an audit note into an operational lesson.

The Same Power That Creates Centralization Risk Can Be a Compliance Feature

It would be too simple to conclude that freeze or clawback authority makes a tokenized real-world asset illegitimate.

Real-world assets live under legal systems. A regulated security, stablecoin or commodity token may need to respond to court orders, sanctions, stolen credentials, redemption disputes or a legally required cancellation. Solana’s own institutional tooling explicitly describes freeze, seize and force-transfer capabilities as compliance workflows.

The trade-off is that these controls change the holder’s risk model. Users are no longer evaluating only smart-contract code and reserve backing. They are also evaluating who holds administrative authority, how many signatures are required, whether those signers are operationally independent, what legal process governs intervention and whether the issuer can reverse a transaction after the market has treated it as final.

Tokenization Does Not Automatically Turn a Claim Into the Underlying Asset

Dominion’s own launch material makes another distinction worth preserving. The silver sits in custody while SILV moves on Solana. The token provides economic exposure to the arrangement; it does not turn the holder into the legal owner of one specific bar sitting in a vault.

That distinction is becoming central across tokenized finance. Optimisus recently covered the SEC proposal that could allow the corporate share register itself to live on a blockchain. That is structurally different from a token that represents a claim on an offchain record or reserve.

The market uses the word tokenized for both models. The legal and technical rights are not the same.

What RWA Holders Should Check Before the Next Incident

The SILV case gives investors and builders a practical checklist. Check whether the token has mint authority, freeze authority, a permanent delegate or upgrade authority. Check who controls each role. Check the multisig threshold and whether the signers are genuinely separated. Check whether reserves are continuously verifiable or periodically audited. Check whether redemption is contractual, discretionary or not yet live.

Then check what the token actually represents. Optimisus has covered increasingly sophisticated onchain products, from institutional credit strategies issued natively onchain to tokenized equity exposure on Mantle. As those markets mature, the quality of the permission model will matter as much as the chain they run on.

The lesson from SILV is not that blockchain failed to provide ownership. It is that blockchain exposed exactly which powers still existed — and the market had to discover what those powers meant during a crisis.

This is not financial advice.

Sources

• Bitquery Research — Dominion SILV hack onchain investigation — Detailed reconstruction of the multisig compromise, account freezes and permanent-delegate test.
• SolidProof TrustNet — Dominion smart-contract analysis — Audit findings on freeze authority, permanent delegate and authority concentration.
• Solana Documentation — Permanent Delegate — Primary documentation describing mint-level transfer and burn authority.
• Solana Documentation — Token Extensions — Primary documentation for Token-2022 extension architecture.
• Dominion Market — SILV documentation — Issuer documentation on backing, custody and token structure.