Address Poisoning Attacks Drain Millions in DAI
A digital asset wallet linked to Bofur Capital lost approximately $2 million following a sophisticated spoofing scheme.
Updated on Oct. 16, 2026 in Cybersecurity
Live Poll
Do you trust the security of your own digital wallet from address-poisoning attacks?
In August 2026, an address-poisoning attack led to the theft of approximately $2 million in DAI from an account associated with Bofur Capital. The stolen assets were subsequently converted into 825.5 ETH after being withdrawn from the Compound platform.
Why it matters
This incident highlights the ongoing vulnerability of digital asset users to address-poisoning schemes, which exploit simple user interface habits. By tricking individuals into selecting spoofed wallet addresses from their own transaction history, attackers can easily divert high-value transfers.
The attackers converted the stolen funds into 825.5 ETH. These exploits rely on look-alike entries in transaction histories to deceive users into selecting a spoofed address instead of their intended recipient.
The players
Bofur Capital
Bofur Capital is a financial entity that suffered a significant loss of digital assets due to an address-poisoning attack.
Compound
Compound is a decentralized finance platform that served as the origin point for the funds stolen in the August 2026 incident.
The details
The attack occurs when a malicious actor monitors transaction histories to inject look-alike addresses, waiting for the user to inadvertently copy and paste the fake destination. In this specific case, the assets were originally moved from the Compound protocol before being diverted by the poisoned entry.
Timeline
The address-poisoning attack on Bofur Capital took place in August 2026.
The Tech Race
This incident illustrates the ongoing arms race between security-conscious wallet developers and attackers who exploit user interface trust. As address-poisoning techniques become more refined, they increasingly threaten the adoption of decentralized finance by creating significant risks for even experienced users.
Users can protect themselves by always double-checking the full alphanumeric string of a destination wallet address before finalizing a transaction. Relying on recent address history without verification creates a direct opportunity for attackers to intercept and divert funds.
The takeaway
Address poisoning serves as a reminder that transaction speed should never outweigh rigorous verification of wallet addresses. Always verify the first and last few characters of any destination address to ensure the integrity of your transfers.
Further reading
For more information on securing digital assets, visit the Cybersecurity section.
Source note: This article includes information reported by TokenPost.
Live Poll
Do you trust the security of your own digital wallet from address-poisoning attacks?
