SUPERFORTUNE AI loses about US$15 million of GUA tokens to lookalike-address swap in airdrop transfer
SUPERFORTUNE AI lost about 14.98M GUA (~US$15M) on 27 May 2026 when an airdrop transfer was redirected to a lookalike address. Cause unconfirmed, no recovery reported. Holders: nothing to patch; be wary of GUA claims and always check full addresses.
Nothing to update. If you hold GUA, rely only on announcements from the project's official channels, and treat any message offering to recover or compensate your tokens as a likely scam. Always check a full wallet address, not just its first and last characters.
What’s happening
On 27 May 2026, about 14.98 million GUA tokens, worth roughly US$15 million at the time, left the wallets of SUPERFORTUNE AI, a crypto project that sells fortune readings and market insights. The tokens were meant to go to a claim contract for an airdrop, but a multisig transaction instead sent them to an address that matched the intended one only in its first and last four characters. The attacker sold the tokens quickly, converting them into 2,784 ETH (about US$5.66 million) held across three new wallets, and the GUA price fell by more than 75%. The project first suspected address poisoning, then said that was unlikely because the attacker's address had never interacted with its wallets. Halborn says the cause could be compromised tooling, operator error or a flaw in the signing workflow, and none is confirmed. The team says it has involved law enforcement and security experts. As of the sources read, there is no published postmortem, no recovery of funds and no compensation plan. There is nothing for ordinary users to install.
- What
- Breach
- Affects
- SUPERFORTUNE AI (GUA token, Ethereum)
- Fixed in
- Nothing to patch
- Since
- 27 May 2026
- Closed
- 1 June 2026
Timeline
- UpdateNothing to patch
Halborn's analysis described an off-chain attack that swapped the destination in a transfer protected by a multisig and address checks. It said the cause (compromised tooling, operator error or a flaw in the signing workflow) was not confirmed.
- UpdateNothing to patch
The attacker sold the tokens on-chain. Analyst EmberCN tracked the proceeds into 2,784 ETH (about US$5.66 million) split across three new wallets, and GUA fell by more than 75%. The team said address poisoning was unlikely because the attacker's address had never interacted with its wallets, and that it had involved law enforcement and security experts.
- Made publicNothing to patch
About 14.98 million GUA tokens, worth roughly US$15 million, were diverted during a multisig transfer meant to fund airdrop payouts. The destination was a lookalike address that matched the intended one only in its first and last four characters. SUPERFORTUNE AI first called it a suspected address poisoning attack.
Sources
- Hacker Seizes $15 Million GUA AirdropForklog · 28 May 2026
- Explained: The SUPERFORTUNE AI Hack (May 2026)Halborn · 1 June 2026