Swan Treasury on BNBChain Loses $625,000 Due to Private Key Leak

iconChaincatcher
Share
This is the logo of the coin.
BNB
$613.760.38%
AI summary iconSummary
Swan Treasury on BNBChain lost $625,000 after a private key leak enabled attackers to exploit on-chain data. Malicious actors forged valid signatures to purchase STY at a 100x discount, using PancakeSwap flash loans to acquire 687,000 STY with 19,700 USDT. They then dumped the tokens into the STY/USDT liquidity pool, profiting 625,000 USDT. The ecrecover function in each transaction resolved to the exact hardcoded signer, confirming the key was compromised—not a flaw in the signature logic. As altcoins face new risks, this incident underscores the critical importance of secure key management.

ChainCatcher report: On BNBChain, the decentralized asset management protocol Swan Treasury suffered a loss of approximately $625,000 due to a private key compromise. The attacker forged valid signatures to purchase STY at a 100x discount, using a flash loan of approximately 19,700 USDT on PancakeSwap to acquire around 687,000 STY. Subsequently, they forged claim() and transfer signatures on a sibling contract, dumping all STY into the STY/USDT liquidity pool and profiting approximately 625,000 USDT. Each ecrecover call in the transaction resolved to a hardcoded signer, confirming that the private key itself was compromised, not a flaw in the signature logic.

Source:Show original
Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information. Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.