Bofur Capital loses $2M in address poisoning attack after Compound withdrawal

BitcoinWorld

Bofur Capital loses $2M in address poisoning attack after Compound withdrawal

A cryptocurrency entity known as Bofur Capital has lost approximately $2 million in an address poisoning attack, according to blockchain security firm PeckShield. The incident occurred shortly after the victim withdrew funds from the decentralized lending protocol Compound, highlighting the growing sophistication of wallet-targeting scams.

How the attack unfolded

PeckShield reported that the attacker initiated the scheme by sending a small ‘dust’ transaction of 0.0002 USDC to the victim’s wallet. This transaction was designed to create a fake address in the victim’s transaction history, which closely resembled a legitimate address the victim had previously used. When the victim later attempted to transfer funds, they copied the fraudulent address from their history and sent the funds to it, resulting in the loss of $2 million.

The stolen assets were subsequently swapped into 2 million DAI and are currently held at the address 0xe2eB…1816a, according to PeckShield. The funds have not yet been moved, but the incident underscores the irreversible nature of blockchain transactions.

Address poisoning: a growing threat in DeFi