Florence Finance Hack

Reported loss $1.5M
Ethereum
Address Poisoning

What happened

On November 28, 2023, a Safe multisig attributed to Florence Finance, a real-world-asset lending protocol on Ethereum, sent 1,456,162 USDC (about $1.45 million) to an address-poisoning lookalike address. PeckShield flagged the loss on November 30. The scammer had created an address closely resembling a legitimate one the victim had used, and the transfer was made through a normal Safe execTransaction.

According to QuillAudits, the phishing wallet (0xB087...) converted the funds to ETH and bridged them to THORChain. Florence Finance had not publicly acknowledged the theft as of December 4, 2023. No source reviewed supports calling this an exit scam.

How it happened

  1. The victim wallet had previously sent USDC to a legitimate counterparty address.
  2. The scammer created a lookalike address (0xB087269DE7ba93d0Db2e12ff164D60F0b3675870) closely resembling that counterparty and sent fake tokens to the victim to poison its transaction history.
  3. Relying on autofill or a quick glance at the address, the Safe signers used the lookalike address and sent 1,456,162 USDC to the scammer.
  4. The funds were converted to ETH and bridged to THORChain.

Protocol details

Classification Infrastructure / Borrowing and Lending / Social Engineering
Protocol Type RWA Lending
Implementation language Solidity
Protocol links Website @FinanceFlorence

Security review history

Evidence

Understand the attack patterns

Compare incidents →
Phishing Attacks

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes