Blockchain security firm PeckShield flagged an on-chain incident in which a phisher allegedly drained $2 million in DAI from a wallet described as linked to Bofur Capital. The alert, posted t
Blockchain security firm PeckShield flagged an on-chain incident in which a phisher allegedly drained $2 million in DAI from a wallet described as linked to Bofur Capital. The alert, posted to PeckShield’s X account, adds to a growing tally of phishing-related losses hitting crypto addresses in 2026.
PeckShield identified the affected wallet as a “Bofur Capital-related address,” a qualifier that matters. The security firm flagged the connection but did not confirm that Bofur Capital directly controlled the wallet or that the firm itself suffered the loss. For related coverage, see Crypto Hack Losses Hit $52M in March, PeckShield Says.
The drained asset was DAI, the decentralized stablecoin issued by Sky (formerly MakerDAO). At a stable peg near $1, the reported drain represents a straightforward $2 million loss with no price-volatility ambiguity. For related coverage, see Yield Protocol Faces $3.7M Loss in Stablecoin Swap.
PeckShield flagged the drain in a post on X, attributing the loss to a phishing-related address targeting a Bofur Capital-linked wallet. View the alert on X. For related coverage, see Yield Protocol Faces $3.7M Loss in Unintended Swap.
Source: @PeckShieldAlert on X
The phrase “Bofur Capital-related address” carries deliberate precision. An address being associated with an entity is not the same as that entity confirming a loss, and PeckShield’s alert stopped short of the stronger claim. For related coverage, see AINext Awards & Conference Singapore 2026: Where AI Leaders, Innovators and Decision-Makers Shape the Future of Artificial Intelligence.
No transaction hash, wallet label, or statement from Bofur Capital accompanied the public alert. That makes this, at this stage, a security firm’s on-chain observation rather than a confirmed victim report. PeckShield has previously tracked crypto hack losses totaling $52 million in a single month, and its attribution methodology typically relies on address-tagging from prior incidents and known entity wallets.
Whether Bofur Capital publicly responds, or whether the flagged address was directly under the firm’s control, remains an open question the brief does not answer.
PeckShield’s characterization of the drainer as a “phisher” points to a social-engineering or approval-exploit attack rather than a smart contract vulnerability. Phishing attacks targeting stablecoin wallets are attractive precisely because the value is predictable and immediately liquid.
DAI, as a decentralized asset, does not have a central issuer who can freeze or reverse a transfer once it leaves a wallet. That makes losses from phishing effectively permanent absent any on-chain recovery mechanism. The Yield Protocol $3.7 million stablecoin loss illustrated similar dynamics, where stablecoin-denominated losses leave little room for recovery once funds move.
What happens to the $2 million now? If the flagged phisher follows established patterns, the DAI will move through mixers or be swapped into less traceable assets quickly. PeckShield’s public alert is often the first step toward exchange blacklisting of the destination addresses, but that clock starts only after the alert goes out.
Additional source references: source document 1, source document 2.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
The article PeckShield Flags $2M DAI Phishing Loss Linked to Bofur Capital first featured on theccpress.com.
