On October 16th, on-chain security monitoring agency PeckShieldAlert issued a warning: a crypto capital institution named Bofur Capital had its associated address targeted by a phishing attack, with control being silently transferred to an unknown attacker. In a short period, approximately 2 million dollars worth of DAI from that address was entirely drained, and the attacker made no delay, directly completing an asset conversion on-chain, exchanging the stolen DAI for 825.5 ETH. This coherent and efficient on-chain action clearly outlines a precise strike against institutional participants—funds were stolen, quickly swapped, and the subsequent whereabouts remain undisclosed, leaving almost no window for the defenders to react, while also reminding the market: even professional institutions are constantly exposed to evolving on-chain security threats.
Phishing Attack Target: Funds of Bofur Swept Away
The target of this precise strike was not an inexperienced retail investor, but an established crypto capital institution in the industry. On-chain data disclosed by PeckShieldAlert points to the same entity: the associated address of Bofur Capital encountered a phishing attack on October 16th, with stolen funds amounting to about 2 million dollars worth of DAI. The attack has been defined as a "phishing exploit," meaning the core risk lies in the address owner unknowingly granting authorization or access to the malicious party, rather than a contract containing exploitable underlying vulnerabilities.
From the publicly available on-chain trajectory, it is evident that this was an anomalous transfer initiated from a single institutional associated address: once authorization fell into the hands of the attacker, the substantial DAI was quickly transferred out of that address and controlled by the attacker, followed by completing the swap; however, how all of this was achieved—whether through a disguised link, fake website, or phishing contract—remains unclear from existing materials. Likewise, the identity of the attacker, and whether there was a larger scale premeditated action, is still unknown. The current narrative surrounding the incident is almost entirely built on a single monitoring source, lacking multi-party cross-verification; until more details surface, this phishing case can only be seen as an unresolved on-chain attack incident targeting an institutional address.
From DAI to 825.5 ETH: On-chain Transfer of Stolen Assets
After the funds were drained, the attacker hardly paused. According to publicly available on-chain monitoring data, the approximately 2 million dollars worth of DAI did not remain in the controlled address for long, but was quickly consolidated and exchanged for 825.5 ETH, essentially representing the entire chip gained from this phishing operation, remaking the asset form within a short time. From the transaction path, the outside world can currently only confirm the DAI→ETH conversion action; whether this batch of ETH will subsequently be split, moved across chains, laundered, or continue to be transferred remains unanswered by public information.
The reason for quickly converting the stolen DAI into ETH can only be speculated from the industry's common practices. On one hand, DAI is issued by centralized entities and theoretically can be frozen or restricted on specific addresses; this "intervenability" is often seen as a potential risk in security events. Converting stolen funds into ETH, a mainstream on-chain asset, may be aimed at technically reducing the likelihood of direct freezing, creating operational space for subsequent transfers and hiding. On the other hand, in past security incidents, attackers have preferred to quickly convert stolen stable assets into mainstream assets like ETH, batch processing them and extending the tracking pathway; this phishing incident targeting the Bofur Capital associated address evidently followed the same route selection in the asset turnover step.
Institutions Also Face Risk: How Phishing Penetrates Daily Security Habits
The target locked this time is not an individual user but an associated address of Bofur Capital, viewed as a professional participant. Public information has pointed to "phishing" as the reason but has not disclosed through which carrier, interface, or phrasing the attacker gained control or authorization of the address. In other words, even institutional accounts that have long been immersed in the industry are still within the attack surface of the public internet, and conventional security awareness and "experience" cannot automatically fend off a cleverly designed phishing attack.
From past industry experiences, phishing often penetrates through several means: forging webpages or wallet interfaces that closely resemble official ones, guiding users to log in or authorize on the wrong page; embedding excessive permissions in seemingly normal signature requests; or impersonating project parties or partners on social channels, enticing victims to click links and execute actions. It should be emphasized that there is currently no evidence showing that any specific technique mentioned above was used in this case, and they can only serve as a reference background for understanding risks. For institutions, the issues are often more complex: under multi-wallet and multi-sign structures, involving multiple members collaborating, a specific operational or risk control role may only be responsible for routine signatures but habitually clicks links or accepts authorizations while busy; if permission management lacks sufficient granularity and review processes, once an account with key signing rights "normally completes an operation" on a phishing page, the entire institutional address may end up exposed to attackers; in this structure, as long as there is a lapse in authorization at one link, a single loss may far exceed what an ordinary user can bear.
On-chain Alerts and Media Dissemination: A One-source Incident
On the day the authorizations were abused and funds flowed out from the institutional address, the on-chain security monitoring account PeckShieldAlert was the first to detect the anomaly: on October 16th, it publicly issued a warning, naming Bofur Capital's associated address as encountering phishing, with approximately 2 million dollars worth of DAI assets being transferred out and swiftly exchanged for 825.5 ETH on-chain. This alert not only provided the victim address and the time frame of the significant fund migration but also locked down the critical path of "2 million DAI→825.5 ETH" as the factual basis for all subsequent discussions.
The subsequent media dissemination almost completely revolved around this on-chain alert. Multiple media outlets, including Golden Finance, Deep Tide TechFlow, PANews, etc., successively reported PeckShieldAlert's warning on October 16th, with coverage closely aligned to the original alert regarding loss scale, asset types, and the detail that DAI had been exchanged for ETH, with very few additional independent information supplements. As of now, there have been no separate analyses from other security teams in public articles, nor confirmation statements from Bofur Capital itself or related parties; the attacker's identity, phishing methods, and the subsequent whereabouts of this batch of 825.5 ETH remain in an information vacuum. Under such a single-source framework, readers' understanding of the incident inevitably relies on limited monitoring data, and once more cross-verified on-chain evidence or institutional responses emerge, current perceptions will need to be adjusted accordingly.
What to Look for Next: Fund Destination and Institutional Response
From the confirmed on-chain actions seen so far, the only clearly recorded event is the theft of approximately 2 million dollars worth of DAI, which was exchanged for 825.5 ETH; whether this batch of ETH will be further split, transferred across chains, or flow into mixing services is still speculative, with no public evidence confirming the subsequent path. Similarly, regarding the involvement of law enforcement, exchanges, or issuers, no related reports have emerged, and Bofur Capital has not disclosed key information on how it will bear the losses, whether to initiate legal proceedings, or any internal security rectification arrangements. For institutional participants, this incident is a reminder that even professional capital exposes attack surfaces in permission management and signing environments; the only verifiable actions are each step of fund trajectories on-chain. What will be noteworthy next is the further on-chain tracing concerning the 825.5 ETH, whether security agencies or project parties will disclose more detailed attack retrospectives, and when and in what manner Bofur Capital will provide a formal response; whether the incident will gain clearer reconstruction through subsequent on-chain tracing and institutional public responses will be the key variables that observers need to continuously monitor in the next stage.
Join our community to discuss together and become stronger!
AiCoin exclusive Hyperliquid benefits: https://app.hyperliquid.xyz/join/AICOIN88
AiCoin exclusive Aster benefits: https://www.asterdex.com/zh-CN/referral/9C50e2
On-chain Telegram community: https://t.me/AiCoinWhaleData
On-chain community: https://www.aicoin.com/link/chat?cid=N6OVMor5g
AiCoin on-chain Twitter: https://x.com/aicoinwhaledata
免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到[email protected]，本平台相关工作人员将会进行核查。
