This technique is too industrialized; a combination of private key leakage + Unicode forgery + address poisoning is not something an ordinary hacker can pull off.

Superfortune updated on X stating that the attack was carried out by non-internal personnel, with no involvement from the team, and that rumors about token sales are false.
Upon investigation: the attack was not due to address poisoning, but because the signer's private key was leaked, and the attacker held the private key alone, sending forged address transactions 43 minutes later.
The forged address shares the first and last four characters with the real address, used to disguise on the Safe interface.
Stolen funds are still traceable, currently held in three Ethereum cold wallets with approximately 2,784 ETH, and about 170k USDT cross-chain transferred out.
The attacker heavily mimicked addresses, using Unicode fake symbols to confuse tracking, indicating industrial-scale operations rather than opportunistic attacks.