Bofur Capital Loses $2 Million in Sophisticated Address Poisoning Attack

The decentralized finance (DeFi) sector has recorded another significant security breach involving a high-profile entity. According to data monitored by PeckShieldAlert on August 22, 2026, an address associated with Bofur Capital fell victim to an address poisoning attack. The exploit occurred shortly after the entity performed a withdrawal from the Compound lending protocol, resulting in the theft of digital assets valued at approximately 2 million USDC.

Mechanism of the Address Poisoning Exploit

The incident began when a malicious actor initiated a dust transaction of 0.0002 USDC to the victim's wallet. This tactic, known as address poisoning, involves the creation of a vanity address that mimics the first and last characters of a legitimate counterparty's address. By appearing in the user's transaction history, the phisher aims to deceive the victim during future transfers.

• The attacker monitored activities on the Ethereum blockchain to identify high-value targets.
• A deceptive address was generated to closely resemble a known contact of Bofur Capital.
• The victim mistakenly copied the malicious address from their transaction logs instead of a verified source.

Asset Conversion and Current Status

Following the successful diversion of funds, the perpetrator moved quickly to obfuscate the trail and stabilize the value of the stolen assets. Analysis of on-chain data indicates that the stolen USDC has already been converted into approximately 2 million DAI, a decentralized stablecoin.

The victim mistakenly used the wrong address when copy-pasting, leading to the theft of funds.

This conversion is a common technique used by attackers to prevent centralized issuers from freezing the assets, as DAI operates under a different governance and collateralization model compared to USDC.

Security Implications for Institutional Investors

This event highlights a growing trend of social engineering attacks targeting institutional participants in the crypto ecosystem. Unlike protocol-level smart contract exploits, address poisoning relies on human error and the user's reliance on transaction history for convenience. Experts suggest that to mitigate such risks, users should utilize Address Books in their wallet interfaces and perform small test transactions before moving significant volumes of capital. As of the time of reporting, Bofur Capital has not released an official statement regarding the recovery of the funds.