- The hacker from the May Coinbase exploit just bought 4,863 ETH for $12.5 million with stolen funds
- Their known wallets now hold over $45.36 million, and they have been actively trading on-chain
- The original hack, which involved insider collusion, resulted in losses of up to $400 million for users
The hacker behind the massive May 2025 exploit of Coinbase users is audaciously using the stolen proceeds to build a large position in Ethereum, according to on-chain transaction trackers.
The individual or group bought 4,863 ETH for $12.5 million (DAI) at $2,569 per ETH. After the latest transaction, the hacker holds $45.36 million (DAI) across two different wallets. The tracker suspects that the hacker may buy more ETH in the future.
The May 2025 Coinbase Exploit
The on-chain tracker linked the latest transaction to the Coinbase exploit in May, which the cryptocurrency exchange attributed to the connivance of fraudulent employees with the hackers.
Related: Coinbase Hacker Launders $45 Million In Stolen ETH, Openly Mocks Sleuth ZachXBT
Coinbase reportedly lost up to $400 million in the attack after insiders supplied the hackers with less than 1% users’ information. Coinbase refused to meet the hackers $20 million demand to keep the exploit quiet. Instead, the crypto exchange promised to reimburse all the users affected by the scam.
A Brazen Pattern of On-Chain Trading
In the meantime, all efforts to apprehend the hackers or retrieve the stolen funds have been unsuccessful. Instead, the hackers have embarked on an Ethereum accumulation spree by converting the stolen funds to ETH. The hackers have also sold a notable amount of the stolen digital assets for fiat, as recorded by the on-nchain tracker.
About six weeks ago, the tracker spotted two wallets belonging to the hackers that sold a combined 17,779 ETH for $45.48 million at $2,558 per token. Strangely, the same individual bought 207.17 ETH tokens by spending $536,000 (DAI). The hackers executed the transactions on the THORChain, a decentralized exchange for native assets and Bitcoin.
Related: Thorchain: Go-To DEX For Coinbase Hacker’s Cross-Chain Swaps
The Coinbase hack highlighted the security challenges facing the cryptocurrency industry, as its continuous growth remains an incentive for hackers, seeking ways to exploit crypto platforms and steal users’ funds. It is worth noting that Coinbase claimed to have identified the contractors involved in the scam and promised to take appropriate measures to avoid a recurrence of the unfortunate incident.
Disclaimer: The information presented in this article is for informational and educational purposes only. The article does not constitute financial advice or advice of any kind. Coin Edition is not responsible for any losses incurred as a result of the utilization of content, products, or services mentioned. Readers are advised to exercise caution before taking any action related to the company.
