Superfortune Hack

On May 27, 2026, Superfortune, a BNB Chain consumer app whose GUA token launched on Binance Alpha and PancakeSwap in late 2025, lost 14.98 million GUA (about $15.18 million at the time) while moving newly unlocked tokens to its airdrop claim contract.

During execution of the multisig transaction, the recipient was swapped for an attacker-controlled address. Analyst EmberCN tracked the tokens being dumped on-chain and converted into 2,784 ETH (about $5.66 million) spread across three new wallets, which drove GUA down about 75%. Superfortune first described a suspected address-poisoning attack, then said that was unlikely because the attacker’s address had never interacted with any Superfortune address and its signing process already included several verification steps.

ForkLog reported that the attacker’s address matched the intended one in its first and last four characters. The team brought in law enforcement and security specialists. The reported pattern resembles the WazirX and Bybit hacks, where signers approved transactions that did not do what they appeared to do, although the precise mechanism in this incident remained unconfirmed.