Address-Poisoning Attack Drains Bofur Capital
The attack highlights the risks of copying spoofed wallet addresses from transaction history for DeFi users.
Updated on Oct. 16, 2026 in Cybersecurity
Live Poll
Do you trust the security of your own digital wallet from address-poisoning attacks?
In August 2026, an entity identified as Bofur Capital lost approximately $2 million in DAI following an address-poisoning attack. The stolen assets were subsequently converted into 825.5 ETH after a withdrawal from the Compound platform.
Why it matters
Address-poisoning attacks leverage habitual user behavior by populating transaction histories with spoofed addresses that resemble legitimate counterparts, highlighting a persistent vulnerability in manual cryptocurrency transfer workflows.
The incident involved the theft of $2 million in DAI, which the attacker converted into 825.5 ETH. This loss was facilitated by spoofed wallet addresses, a tactic that targets the tendency of users to copy addresses directly from their recent transaction history.
The players
Bofur Capital
An investment entity that sustained the loss of $2 million in DAI during an address-poisoning incident.
Compound
A decentralized finance protocol utilized by the victim for fund withdrawals prior to the attack.
The details
An address-poisoning attack exploits the way users interact with blockchain transaction logs to move funds. Attackers generate wallet addresses that share the same leading and trailing characters as a legitimate address to appear in a user's transaction history. When a user unknowingly selects this spoofed address—a look-alike entry designed to mirror previous interactions—the funds are sent to the attacker rather than the intended destination.
Timeline
August 2026: The address-poisoning attack on Bofur Capital occurred.
The Tech Race
This incident follows the documented trend of address-poisoning as a common vector in crypto-asset theft, marking a departure from more complex smart-contract exploits. The attack illustrates how simple social engineering continues to outpace technical security measures in decentralized finance.
Users moving funds between platforms like Compound are at risk if they copy addresses from transaction history without manual verification. Best practice requires users to double-check the full alphanumeric string of a destination address against a known-safe source before confirming any transaction.
The takeaway
The incident serves as a reminder that UI-level trust is a major vulnerability in blockchain transactions. Investors should maintain an allowlist of known addresses rather than relying on historical transaction lists when executing large-value transfers.
Further reading
For broader analysis on emerging digital threats, visit Cybersecurity.
Source note: This article includes information reported by TokenPost.
Live Poll
Do you trust the security of your own digital wallet from address-poisoning attacks?
