Syndicate Labs Confirms Attack Originated from Private Key Leak

On May 1, Syndicate announced the results of its investigation into a previous attack, revealing that the incident stemmed from a private key leak. After obtaining the private keys, hackers upgraded cross-chain contracts on two chains, resulting in the theft of 18.5 million SYND tokens and other tokens worth $50,000 from the Commons bridge. Syndicate stated that affected users will receive full compensation of 18.5 million SYND tokens along with additional compensation. The company noted that the private keys were stored in a password manager, accessible only to a few individuals, but did not employ an additional encryption layer outside of the password manager. Furthermore, Syndicate had set up alerts and circuit breakers for the cross-chain bridge, but these did not cover upgrade scenarios. Syndicate indicated that it is taking measures to enhance security, including implementing additional encryption for developer keys outside of the password manager and further restricting access to these keys.