Swan Treasury, a decentralized asset management protocol on BNB Chain, lost about $625,000 after a private key leak, according to monitoring by Defimon Alerts. The tracker said the attacker forged a valid signature to an address they controlled and bought STY at a 100x discount. The trade was carried out through a PancakeSwap flash loan, using roughly 19,700 USDT to acquire about 687,000 STY. The attacker then forged claim() and transfer signatures on a sibling contract and dumped the tokens into the STY/USDT pool, walking away with about 625,000 USDT in profit. Defimon Alerts said every ecrecover in the transaction resolved to a specific hardcoded signer, which points to a compromised key rather than a flaw in the signing logic. The incident was reported in a post linked by Foresight.
Swan Treasury, a decentralized asset management protocol on BNB Chain, lost about $625,000 after a private key leak, according to Defimon Alerts.
Defimon Alerts said the attacker forged a valid signature to an address under their control and bought STY at a 100x discount. The purchase was made through a PancakeSwap flash loan, using about 19,700 USDT to acquire roughly 687,000 STY.
The attacker then forged claim() and transfer signatures on a sibling contract, before dumping the STY into the STY/USDT pool. The trade generated about 625,000 USDT in profit.
Tracker points to compromised key
Defimon Alerts said each ecrecover in the transaction resolved to a specific hardcoded signer. In its view, that confirms the key itself was exposed, rather than the signing logic being flawed.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
