Bofur Capital Hit by $2M Address Poisoning Scam: PeckShield Investigation

Crypto firm Bofur Capital lost $2 million in an address poisoning attack, security firm PeckShield reported. The scam occurred after a withdrawal from Compound.

The attacker sent a tiny dust transaction that mimicked a real payee entry saved in the victim's transaction history. The victim then copied this lookalike entry for a large transfer instead of the correct one, sending 2 million USDC to the scammer.

PeckShield found that the attacker used homoglyph token contracts, fake tokens with Cyrillic characters and invisible symbols designed to look identical to real USDC in a wallet's transaction list. This created three separate lookalike entries that appeared in the victim's history before the theft.

The scammer even dusted its own wallet minutes after moving the stolen funds, sending 0.0008 to a freshly mined look-alike and then relaying 0.0002 to the target. Records show the controller has sent over 126,000 dust transfers to more than 80,000 distinct addresses since late May.