The hacker behind the massive May 2025 exploit of Coinbase users is audaciously using the stolen proceeds to build a large position in Ethereum, according to on-chain transaction trackers.
The hacker behind the massive May 2025 exploit of Coinbase users is audaciously using the stolen proceeds to build a large position in Ethereum, according to on-chain transaction trackers.
The individual or group bought 4,863 ETH for $12.5 million (DAI) at $2,569 per ETH. After the latest transaction, the hacker holds $45.36 million (DAI) across two different wallets. The tracker suspects that the hacker may buy more ETH in the future.
The on-chain tracker linked the latest transaction to the Coinbase exploit in May, which the cryptocurrency exchange attributed to the connivance of fraudulent employees with the hackers.
Coinbase reportedly lost up to $400 million in the attack after insiders supplied the hackers with less than 1% users’ information. Coinbase refused to meet the hackers $20 million demand to keep the exploit quiet. Instead, the crypto exchange promised to reimburse all the users affected by the scam.
In the meantime, all efforts to apprehend the hackers or retrieve the stolen funds have been unsuccessful. Instead, the hackers have embarked on an Ethereum accumulation spree by converting the stolen funds to ETH. The hackers have also sold a notable amount of the stolen digital assets for fiat, as recorded by the on-nchain tracker.
About six weeks ago, the tracker spotted two wallets belonging to the hackers that sold a combined 17,779 ETH for $45.48 million at $2,558 per token. Strangely, the same individual bought 207.17 ETH tokens by spending $536,000 (DAI). The hackers executed the transactions on the THORChain, a decentralized exchange for native assets and Bitcoin.
The Coinbase hack highlighted the security challenges facing the cryptocurrency industry, as its continuous growth remains an incentive for hackers, seeking ways to exploit crypto platforms and steal users’ funds. It is worth noting that Coinbase claimed to have identified the contractors involved in the scam and promised to take appropriate measures to avoid a recurrence of the unfortunate incident.
