PeckShield reports that the phisher behind the Bofur Capital-related $2M DAI loss converted the funds into 825.5 ETH on October 16, 2026 (PeckShieldAlert). Its earlier alert says the DAI was held at the shortened address 0xe2eB…1816a (PeckShieldAlert). The sources do not name the phisher’s full wallet address or where the 825.5 ETH went.

$ETHOct 16, 2026, 01:12 UTC

PeckShield reports that the phisher behind the Bofur Capital-related $2M DAI loss converted the funds into 825.5 ETH on October 16, 2026 (PeckShieldAlert). Its earlier alert says the DAI was held at the shortened address 0xe2eB…1816a (PeckShieldAlert). The sources do not name the phisher’s full wallet address or where the 825.5 ETH went.

Ask your own

Case file

$ETHEthereum, ethereum

Answered Oct 16, 2026, 01:12 UTC

Sources 2

PeckShieldAlertx.com
PeckShieldAlertx.com

Research trace 7

The linked original X post
Latest posts of @PeckShieldAlert
Find independent incident reporting that names the source wallet and attacker, so the drain can be traced on-chain. The supplied PeckShield post reports a $2M DAI drain and a swap into 825.5 ETH but gives no addresses.
The supplied October alert reports conversion to 825.5 ETH but names neither the source address nor the attacker. Earlier coverage says the original Bofur loss was address poisoning and names a temporary DAI holding address; these reads may identify whether that same trail leads to the current ETH proceeds and final wallet.
The prior alert identifies only a truncated DAI holding address, while the October report says the DAI was swapped into 825.5 ETH without giving transaction or wallet addresses. These independent reads may recover a full address or named transaction trail before tracing transfers.
The supplied alert and earlier coverage identify the loss and a truncated DAI holding address, but not a full attacker wallet or destination. These searches may surface a complete address, transaction, or later tracing update.
The available incident reports still give only a shortened proceeds address and do not identify the attacker wallet or destination. Two tracing routes have not produced a full address or transaction, so those identities are not established by the sources available here.