Syndicate: The security incident was caused by a private key leak leading to malicious upgrade of the bridging contract, resulting in a loss of $380k.

ME News Report, May 1st (UTC+8), Syndicate released an update regarding a previous security incident, stating that private key leakage led to malicious upgrades of bridge contracts on two chains, resulting in the theft of approximately 18.5 million SYND tokens (about $330k) and around $50k worth of customer tokens. Affected users will receive full compensation, and SYND holders will also receive additional rewards. The attack involved multi-stage reconnaissance, infrastructure mapping, vulnerability exploitation development, and precise timing, ruling out the possibility of internal personnel involvement. The root cause of the vulnerability was that the private key was stored in a password manager, and the upgrade process did not utilize multi-signature or hardware signatures. Syndicate is strengthening security measures, including adding encryption layers outside the password manager and adopting multi-signature or hardware signatures for upgrade paths. (Source: PANews)