- Coinbase hacker launders $45M in stolen ETH using THORChain, reports Spot On Chain.
- Hacker from Coinbase breach brazenly taunts on-chain sleuth ZachXBT via ETH message.
- Coinbase data breach affected 69K users; exchange offers $20M bounty on hacker.
The hacker responsible for one of the largest breaches in crypto exchange Coinbase’s history has begun laundering stolen funds and is openly mocking investigators while doing so.
According to blockchain analytics platform Spot On Chain, the threat actor sold 17,778 ETH, worth approximately $45.48 million and converted to DAI stablecoins at an average price of $2,558 per ETH. The transactions reportedly zipped through three newly created wallets over just four hours.
THORChain Tapped for Laundering, Hacker Makes Puzzling ETH Rebuy
Critically, the hacker leaned on THORChain, a decentralized liquidity protocol, to handle the laundering. THORChain is known for enabling cross-chain swaps, a go-to tool for those looking to muddy the waters and obscure the trail of illicit funds.
Not stopping there, the hacker performed a partial rebuy shortly after . One of the wallets spent 536,000 DAI to repurchase 207.17 ETH at a higher average price of $2,587, a move that suggests either calculated positioning or an intent to stir further confusion in tracking efforts.
Related: Binance, Kraken Foil Social Engineering Hacks on Support Staff: Reports
But what stands out most in this unfolding cyber-heist drama is the hacker’s taunt of one of the crypto community’s most respected on-chain sleuths, ZachXBT.
Related: Bybit Swiftly Resolves Apple ID Glitch, Protects Users’ $100K Account Funds
Taunt to ZachXBT
On Wednesday evening, the threat actor sent an Ethereum transaction embedded with a mock message directed at ZachXBT.
The message stated a dismissive slang phrase, “L bozo”, implying that the investigator had taken a loss. The message also included a link to a YouTube video showing NBA legend James Worthy smoking a cigar–a visual metaphor for celebration and ridicule.
The taunt was publicized by ZachXBT via the Investigations Telegram channel, where he confirmed that the threat actor is the same individual or group behind the massive data breach targeting Coinbase users.
According to data from Etherscan, the same wallet (tagged as “Fake_Phishing1158790”) moved 8,698 ETH, worth over $22.6 million, shortly after sending the provocative message.
A Timeline of Escalation
The saga began with a data breach affecting at least 69,400 Coinbase customers. Discovered on May 11, the breach reportedly stems from a vulnerability exploited in December of the previous year.
In response to Coinbase’s refusal to pay a $20 million ransom in Bitcoin, the hacker has escalated both technical maneuvers and psychological warfare. On the other hand, Coinbase countered with its own $20 million bounty, aiming to incentivize whistleblowers or informants to aid in the arrest of the perpetrator(s).
Disclaimer: The information presented in this article is for informational and educational purposes only. The article does not constitute financial advice or advice of any kind. Coin Edition is not responsible for any losses incurred as a result of the utilization of content, products, or services mentioned. Readers are advised to exercise caution before taking any action related to the company.
