Superfortune Multisig Address Tampering: $15.18M Reported Loss

Incident Overview

The team intended to transfer additionally unlocked tokens to the airdrop claim contract address. However, during the multisig transaction execution, the recipient address was altered, resulting in approximately 14.98 million GUA (worth about $15.18 million at the time) being sent to a suspected hacker-controlled address. The attacker subsequently dumped all the tokens on-chain for roughly 2,784 ETH (approximately $5.66 million at the time) and distributed the funds across multiple wallets. The incident caused GUA's price to plummet by 70-76%. Official preliminary investigation points to address tampering in a multisignature transaction. Although initially described as a "suspected address poisoning attack," the possibility is considered low due to no prior interaction between the hacker address and any Superfortune-related addresses. The team is continuing its investigation and will provide further updates.

Sources & References