Superfortune ($GUA) — Multisig Execution Tampering / Signer-Key Leak

Timeline: On 27 May 2026, during a multisig transaction intended to release unlocked GUA tokens into Superfortune's airdrop-claim contract (0x70ae7D3D...5c15), the destination address was altered to an attacker-controlled wallet (0x70AE678b...5C15), which matches the first and last four characters of the intended address. About 14,981,000 GUA (~$15.18M nominal at the time) were diverted and immediately dumped on-chain for 2,784 ETH (~$5.66M realised), crashing GUA roughly 70-76% within 24 hours (from an ATH of $1.68 on 25 May to a low near $0.24). The proceeds were stored across three attacker wallets. Superfortune (@SUPERFORTUNE888) published an investigation note the same day stating that initial findings point to an address manipulation through the multisig transaction, that the hacker address had no prior interaction with Superfortune (so address poisoning is unlikely as the vector), and that internal procedures account for poisoning attempts; the team's working hypothesis is a signer private-key leak, not an inside job. EmberCN published the on-chain reconstruction and the three holding wallets. The project contacted authorities and incident-response teams. SlowMist Hacked tags the method as 'Multisig Address Tampering' and lists the nominal $15.18M; the realised loss of $5.66M (2,784 ETH) is used as the headline figure, with the $15.18M nominal noted. Superfortune is a Manta-incubated project (TGE 27 Nov 2025; pre-attack market cap ~$90.4M, circulating 125M of 1B GUA). Recovery: 0%; investigation active.