Superfortune said its May 27 GUA security incident was caused by a leaked signer private key, rejecting insider involvement and address poisoning as the cause. According to the project, 14.98 million unlocked GUA were sold, contributing to a roughly 75% to 78% price drop, and were swapped for about 2,784 ETH worth $5.66 million. Superfortune said the attacker submitted a forged-address transaction 43 minutes after the legitimate one, and the stolen assets were distributed across three Ethereum wallets that the company says remain traceable. The company also said roughly 170,000 USDT was bridged out during the incident.