The hacker linked to the $300 million Coinbase heist is back in action, continuing to deploy stolen funds, this time on the Ethereum (ETH) network.
On-chain analysis reveals that the wallet linked to the exploit purchased 3,976 ETH, worth $18.9 million, at $4,756 per coin, according to data retrieved by Finbold from Arkham on September 13.
This isn’t the attacker’s first move. Over the past week, blockchain analysts have tracked multiple high-value swaps from the wallet, including significant purchases of ETH and stablecoins like DAI.
As reported by Finbold in late August, the hacker also bought 38,126 SOL worth about $7.95 million at an average price of $209. On July 20, the wallet added 649.62 ETH valued at $2.31 million, purchased at an average of $3,561 per coin.
These transactions suggest a diversification strategy, with the attacker spreading funds across major blockchain ecosystems while routing activity through decentralized exchanges and aggregators to avoid detection.
Coinbase security breach
The wallet links back to Coinbase’s early 2025 security breach, when hackers bribed overseas support staff to access internal systems. The incident exposed sensitive customer data, though not passwords or private keys, and was later used for fraud and extortion attempts.
On May 11, the attackers demanded $20 million to keep the stolen data private. Coinbase refused, instead tightening security, firing compromised staff, pledging reimbursements, and offering a matching $20 million bounty. The exchange estimates the total costs to be between $180 million and $400 million.
Despite ongoing investigations, the hacker has continued to shuffle funds, including a $42.5 million Bitcoin-to-Ethereum swap via Thorchain, complete with on-chain taunts.
Featured image via Shutterstock
