Compromised signer key drains $625K from Swan Treasury on BNB Chain
Security & Exploits ·
Attacker used a leaked off-chain private key to forge signatures, buying STY tokens at a 100x discount before dumping them with flash-loan assistance.
Swan Treasury lost $625K after an attacker gained control of an off-chain signer private key, using it to forge valid-looking signatures that authorized purchases of STY tokens at a 100x discount to market price. The breach did not stem from a smart-contract flaw in the traditional sense but from a compromise of the signing infrastructure itself, allowing the attacker to bypass whatever authorization checks the treasury relied on to approve token sales.
Once the forged signatures were accepted, the attacker acquired STY at the deep discount and then used flash loans to help offload the tokens quickly, a combination that let the exploit convert underpriced tokens into extracted value before the treasury or the market could react. The contract address tied to the incident is visible on-chain, with activity recorded at the address on BscScan.
The mechanics point to a recurring weak point in treasury operations: off-chain signer keys, which sit outside the smart contract logic that most audits scrutinize, can become a single point of failure if compromised. Unlike an on-chain bug that might be caught through formal verification or code review, a leaked private key grants an attacker the same authority as a legitimate signer, making the forged transactions indistinguishable from normal operations until after funds move.
Coverage of the incident is limited, with two distinct sources describing the same sequence of events: a compromised signer key, discounted STY purchases, and flash-loan-assisted dumping. Neither account details how the key was obtained, whether it was a single-signer setup or part of a multisignature scheme, or what protections, if any, Swan Treasury had in place around key custody.
What remains unresolved includes whether Swan Treasury plans to reimburse affected parties, whether the STY token contract or treasury signing process will be redesigned in response, and whether the attacker's address has moved or laundered the extracted funds beyond the initial dump. Also unclear is whether other treasuries using similar off-chain signing arrangements face comparable exposure, a question likely to shape scrutiny of BNB Chain projects with analogous architectures in the near term.