The Bofur Capital fund withdrew funds from the Compound protocol and sent them further. He copied the destination address from his own transaction history, because that’s what anyone who doesn’t want to type forty-two characters by finger does. The address looked familiar, but it wasn’t.
Key takeaways:
- Bofur Capital lost approximately $2 million after copying a substituted address; the funds were converted to 2 million DAI. The attack was detected by PeckShieldAlert.
- The bait was a transfer of $0.0002 sent from an address that was confusingly similar to the real one. It cost the attacker less than a penny.
- A study of the Ethereum and BNB Chain networks detected over 270 million such attack attempts targeting 17 million wallets.
- Defense is free and takes several seconds per transaction.
This story doesn’t have a single line of broken code in it. No encryption was broken and no key was leaked. The eye that read the first four and last four characters of the address failed, judged them to be correct, and stopped reading.
How does address poisoning work?
The attacker looks at your transactions because the blockchain is public and he doesn’t even have to break in to see them. It chooses an address you “correspond” with regularly, for example your exchange or your second wallet. Then it generates its own address with an identical beginning and an identical end. The inside is different, but no one reads the inside.
Then he sends you a transfer for an amount that makes no economic sense. In the case of Bofur Capital, it was $0.0002 in USDC. This ending is not meant to be a payoff. It’s meant to be a history entry that will sit right next to the real address and look like it.
Why a fund and not a newcomer
Because a novice transfers money once a month and checks the address out of fear. An entity trading millions does it every day, it has a procedure and that is why it is predictable.
How much of it goes back to the owner
The transfer on the blockchain does not have a reversal button, and the funds from Bofur Capital were converted into 2 million DAI, i.e. a stablecoin that does not lose value during laundering. The trace is visible to anyone who can read the chain. Visible does not mean recoverable.
What does this mean for you
Four moves, none of them cost a penny.
First, stop copying addresses from your transaction history. Copy only from the source: from the exchange payout panel, from the wallet address book, from a saved contact. The logic that if it is in the transaction history, it means it worked and is the same, is only correct if you check the entire address carefully.
Second, check the middle of the address, not just the beginning and end. The attack thrives solely on the fact that wallet and explorer interfaces show the shortened address.
Thirdly, when making a large transfer, send a symbolic amount first and confirm its receipt in another way. Note: you do it exactly as the robbed fund did, so take the address for the second transfer again from the source, never from the confirmation of the first one.
Fourth, enable the exchange’s list of trusted withdrawal addresses if your platform offers it. Then pasting the substituted string of characters simply won’t work.
The attacker spent $0.0002 on this operation and some computing power to generate a nice-looking address. He left with two million.
