Bofur Capital Hit with $2M Address Poisoning Attack after Compound Withdrawal

A cryptocurrency entity known as Bofur Capital has suffered an address poisoning attack, resulting in the loss of approximately $2 million.

The attack occurred shortly after the victim withdrew funds from the decentralized lending protocol Compound, highlighting the growing sophistication of wallet-targeting scams.

According to PeckShield, a blockchain security firm, the attacker initiated the scheme by sending a small 'dust' transaction of 0.0002 USDC to the victim's wallet. This transaction was designed to create a fake address in the victim's transaction history, which closely resembled a legitimate address the victim had previously used.

When the victim later attempted to transfer funds, they copied the fraudulent address from their history and sent the funds to it, resulting in the loss of $2 million. The stolen assets were subsequently swapped into 2 million DAI and are currently held at the address 0xe2eB...1816a.