Swan Treasury on BNBChain lost approximately $625,000 due to a private key leak

The decentralized asset management protocol Swan Treasury on BNBChain suffered a loss of approximately $625,000 due to a private key leak. The attacker forged a valid signature using their own address to purchase STY at a 100x discount and bought approximately 687,000 STY with about 19,700 USDT through a PancakeSwap flash loan.

Subsequently, they forged claim() and transfer signatures on a brother contract, dumping STY into the STY/USDT pool and profiting approximately 625,000 USDT. Each ecrecover in the transaction was resolved to an exact hardcoded signer, confirming that the key itself had been leaked, rather than a flaw in the signature logic.