The hacker behind the $300 million exploit targeting Coinbase users appears to be making costly mistakes in their trading moves involving Ethereum (ETH).
On-chain analysis indicates that on September 13, the hacker purchased 3,976 ETH worth $18.9 million at an average price of $4,756.
However, just two days later, they liquidated the same holdings for $17.98 million at $4,522 per token, according to Arkham Intel data retrieved by Finbold on September 15.
This quick turnaround resulted in an estimated $932,000 loss in only two days. The transaction coincided with the broader market sell-off in the past 24 hours, where Ethereum was among the hardest-hit assets. As of press time, ETH was trading at $4,493, down 2.6% in the last day.
Notably, the hacker has remained active in recent weeks, buying and selling several digital currencies. As reported by Finbold, in late August, they bought 38,126 SOL worth about $7.95 million at an average of $209 per token.
On July 20, the wallet added 649.62 ETH valued at $2.31 million, purchased at an average price of $3,561.
Coinbase hacker adopts a diversification strategy
Since the breach, the attacker has adopted a diversification strategy, moving stolen funds across major blockchain networks while routing activity through decentralized exchanges and aggregators to avoid detection.
The funds trace back to Coinbase’s early 2025 security breach, when hackers bribed overseas staff to gain internal access, exposing sensitive customer data later used for fraud and extortion attempts.
On May 11, the attackers demanded $20 million to keep the stolen data private. Coinbase refused, instead firing compromised staff, pledging reimbursements, tightening security, and offering a matching $20 million bounty. The exchange estimates total losses between $180 million and $400 million.
Featured image via Shutterstock
