Superfortune: The attacker obtained the signer's private key rather than conducting address poisoning, and it was not caused by an internal staff member

According to ChainCatcher, Superfortune, incubated by Manta, posted an update on X regarding the recent security incident, stating that the attack was not carried out by insiders and that no team members were involved. The claim that the team secretly sold tokens is incorrect. The team also has not had any contact with Web3Port. The investigation confirmed that the attack was not due to address poisoning but rather a leak of the signer's private key. The attacker independently possessed the private key and, 43 minutes after a legitimate transaction, submitted a transaction from a forged address. The forged address shared the same first and last four characters as the correct one (beginning with 0x70AE and ending with 5C15), aiming to disguise itself in the Safe interface preview. All stolen funds are fully traceable and are currently held in three cold wallets on Ethereum, totaling approximately 2,784 ETH. Additionally, about 170,000 USDT was bridged out. The attacker also created numerous fake addresses and sent false transfer events with Unicode-forged token symbols to these addresses in an attempt to obfuscate tracking. This technique for constructing counterfeit addresses was the same as that used during the attack on this project. The attacker had set up large-scale infrastructure in advance, indicating this was an industrialized operation, not an opportunistic attack.