Yield Protocol

Blockchain security firm PeckShield flagged an on-chain incident in which a phisher allegedly drained $2 million in DAI from a wallet described as linked to Bofur Capital. The alert, posted to PeckShield’s X account, adds to a growing tally of phishing-related losses hitting crypto addresses in 2026.
<h2 id="peckshield-reports-2-million-dai-drain">PeckShield Reports $2 Million DAI Drain</h2>
PeckShield identified the affected wallet as a “Bofur Capital-related address,” a qualifier that matters. The security firm flagged the connection but did not confirm that Bofur Capital directly controlled the wallet or that the firm itself suffered the loss. For related coverage, see <a href="https://www.theccpress.com/crypto-hack-losses-52m-march-peckshield-report/" rel="noopener noreferrer nofollow">Crypto Hack Losses Hit $52M in March, PeckShield Says</a>.
The drained asset was DAI, the decentralized stablecoin issued by Sky (formerly MakerDAO). At a stable peg near $1, the reported drain represents a straightforward $2 million loss with no price-volatility ambiguity. For related coverage, see <a href="https://www.theccpress.com/yield-protocol-3-7m-stablecoin-loss/" rel="noopener noreferrer nofollow">Yield Protocol Faces $3.7M Loss in Stablecoin Swap</a>.
<blockquote class="twitter-tweet" style="margin:20px 0; padding:16px 18px; background:#1a0f0d; color:#f3f4f6; border:1px solid #ff5252; border-radius:12px; margin:20px 0; padding:16px 18px; background:#1a0f0d; color:#f3f4f6; border:1px solid #ff5252; border-radius:12px; margin:20px 0; padding:16px 18px; background:#1a0f0d; color:#f3f4f6; border:1px solid #ff5252; border-radius:12px">
 PeckShield flagged the drain in a post on X, attributing the loss to a phishing-related address targeting a Bofur Capital-linked wallet. View the alert on X. For related coverage, see <a href="https://www.theccpress.com/yield-protocol-3-7m-loss-swap/" rel="noopener noreferrer nofollow">Yield Protocol Faces $3.7M Loss in Unintended Swap</a>.
</blockquote>
Source: @PeckShieldAlert on X
<h2 id="what-the-alert-says-about-the-address-connection">What the Alert Says About the Address Connection</h2>
The phrase “Bofur Capital-related address” carries deliberate precision. An address being associated with an entity is not the same as that entity confirming a loss, and PeckShield’s alert stopped short of the stronger claim. For related coverage, see <a href="https://www.theccpress.com/ainext-awards-conference-singapore-2026-where-ai-leaders-innovators-and-decision-makers-shape-the-future-of-artificial-intelligence/" rel="noopener noreferrer nofollow">AINext Awards &amp;amp; Conference Singapore 2026: Where AI Leaders, Innovators and Decision-Makers Shape the Future of Artificial Intelligence</a>.
No transaction hash, wallet label, or statement from Bofur Capital accompanied the public alert. That makes this, at this stage, a security firm’s on-chain observation rather than a confirmed victim report. PeckShield has previously tracked crypto hack losses totaling $52 million in a single month, and its attribution methodology typically relies on address-tagging from prior incidents and known entity wallets.
Whether Bofur Capital publicly responds, or whether the flagged address was directly under the firm’s control, remains an open question the brief does not answer.
<h2 id="phishing-remains-a-persistent-threat-to-stablecoin-holders">Phishing Remains a Persistent Threat to Stablecoin Holders</h2>
PeckShield’s characterization of the drainer as a “phisher” points to a social-engineering or approval-exploit attack rather than a smart contract vulnerability. Phishing attacks targeting stablecoin wallets are attractive precisely because the value is predictable and immediately liquid.
DAI, as a decentralized asset, does not have a central issuer who can freeze or reverse a transfer once it leaves a wallet. That makes losses from phishing effectively permanent absent any on-chain recovery mechanism. The <a href="https://www.theccpress.com/yield-protocol-stablecoin-swap-loss/" rel="noopener noreferrer nofollow">Yield Protocol $3.7 million stablecoin loss</a> illustrated similar dynamics, where stablecoin-denominated losses leave little room for recovery once funds move.
What happens to the $2 million now? If the flagged phisher follows established patterns, the DAI will move through mixers or be swapped into less traceable assets quickly. PeckShield’s public alert is often the first step toward exchange blacklisting of the destination addresses, but that clock starts only after the alert goes out.
Additional source references: <a href="https://publish.twitter.com/oembed?url=https%3A%2F%2Fx.com%2FPeckShieldAlert%2Fstatus%2F2110899366429102307&amp;omit_script=true" rel="noopener noreferrer nofollow">source document 1</a>, <a href="https://pbs.twimg.com/media/HUtrtP4bUAAhuKI?format=webp&amp;name=small" rel="noopener noreferrer nofollow">source document 2</a>.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
The article <a href="https://www.theccpress.com/?p=49058" rel="noopener noreferrer nofollow">PeckShield Flags $2M DAI Phishing Loss Linked to Bofur Capital</a> first featured on <a href="https://theccpress.com/" rel="noopener noreferrer nofollow">theccpress.com</a>.

PeckShield Flags $2M DAI Phishing Loss Linked to Bofur Capital

Table of Contents

Cryptocurrency Press

Other articles published on Oct 16, 2026

Join our free newsletter for daily crypto updates!