Superfortune: The attack signature involves private key leakage of the signer rather than address poisoning, not caused by internal personnel
Recently, Superfortune security update stated that the attack was caused by private key leakage, leading to the cracking of the 3/5 multi-signature, not due to internal personnel or team selling.
The attacker held the signing private key, submitted a forged address transaction 43 minutes after a legitimate transaction, with the fake address's start and end identical to the correct address, used to disguise in the Safe interface.
Approximately 2,784 ETH and about 170k USDT were stolen and have been transferred out, with all funds fully traceable, currently stored in three cold wallets on Ethereum.
The attacker also created numerous counterfeit addresses, used Unicode symbols to forge transfer events to confuse tracking, indicating an industrial-scale, large-scale attack.