According to Lookonchain monitoring, the attacker linked to the over $26 million TLBL theft spent 3.4 million DAI to buy 1,650 ETH an hour before publishing a post. The post traced the theft back to a private key leak about three months ago, distinguishing it from an earlier phishing loss.