Bofur Capital hack — August 2026

Bofur Capital sent 2m USDC to an address it believed belonged to a familiar counterparty on 21 August 2026 at 16:31:11 UTC, thirty minutes after withdrawing that exact sum from the Compound III USDC market at 16:01:23 UTC. The address was not the counterparty's.

The attacker had generated a vanity address whose leading and trailing characters matched the real one, seven of forty characters in total, and introduced it into Bofur Capital's transaction history the previous day at 20:20:59 UTC with a 0.0002 USDC dust transfer. When the payment was made, the address was copied from that recent history, where it looked like an ordinary prior counterparty.

PeckShield flagged the transfer on 22 August. The attacker converted the proceeds into roughly 1,999,939 DAI and left them in a single wallet without routing them through a mixer or a cross-chain bridge, so the funds remained traceable. Bofur Capital had made no public statement and announced no recovery bounty at the time of reporting.

This is the second address-poisoning loss in this registry within a fortnight, and both worked the same way: the fake address is planted long before it is used, so that by the time it matters it is indistinguishable from history.