Syndicate Labs private key leak leads to attack: approximately 18.5 million SYND transferred, promising full compensation to users

BlockBeats News, May 1st, according to official sources, Syndicate Labs disclosed that due to private key leakage, the cross-chain bridge contract was maliciously upgraded on two chains. The attacker transferred and sold approximately 18.5 million SYND (about $330k) and about $50k worth of user tokens. The incident only affected specific chains, and other chains were not impacted.

Syndicate Labs stated that this attack involved multi-stage reconnaissance, infrastructure mapping, and meticulous execution, with a high level of technical complexity, and ruled out internal personnel involvement. The root cause was that private keys were stored in a password management tool without additional encryption layers. Additionally, the upgrade process did not use multi-signature or hardware signing mechanisms, nor did it have early warning or circuit breaker measures for contract upgrades.

Syndicate Labs announced that they will fully compensate all affected users, including returning 18.5 million SYND and providing additional compensation, as well as fully compensating affected application chain clients. The company has initiated security upgrade measures, including strengthening private key encryption, tightening access permissions, and plans to introduce hardware or multi-signature mechanisms and upgrade path monitoring to prevent similar incidents from happening again.