$2M Stolen from Bofur Capital via Sophisticated Address Poisoning Attack

A decentralized lending protocol user, Bofur Capital, lost nearly $2 million to an address poisoning attack just minutes after withdrawing funds from Compound Finance.

The attacker pre-seeded a dust transaction in the victim's wallet history a day earlier, exploiting the UI's address abbreviation feature that can lead users to copy-paste incorrect addresses.

After receiving the 2 million USDC through the withdrawal, the attacker quickly rotated it into MakerDAO's DAI stablecoin to break the paper trail.