Syndicate Labs suffered a private key breach attack, and its cross-chain bridge was maliciously upgraded, resulting in the transfer of approximately 18.5 million SYND tokens.

Syndicate Labs disclosed a security incident: attackers compromised the system by leaking private keys and maliciously upgraded cross-chain bridge contracts on two chains, resulting in the transfer of approximately 18.5 million SYND tokens and about $50,000 in user assets. The attack originated from a compromised development endpoint, where attackers used production environment privileges to upgrade the bridge contract to a malicious version. Other chains were unaffected. Losses included: Commons bridge: approximately 18.5 million SYND tokens were transferred and sold, equivalent to approximately $330,000; Appchain: approximately $50,000 in user assets were transferred. Syndicate Labs stated that affected SYND holders will receive full compensation plus additional overpayments, resulting in overall holdings exceeding pre-incident levels; affected Appchain users will also receive full compensation for their losses.