Unidentified Individual Exploits Coinbase, Transfers Stolen Cryptocurrency, Taunts Digital Sleuth ZachXBT Online
Coinbase Data Breach: Ongoing Crypto Thefts and Recent On-Chain Activity
Thieves behind a significant data breach at Coinbase in May 2025 have reportedly started swapping stolen cryptocurrency. The exact identity of the culprits remains undisclosed.
According to on-chain investigator ZachXBT, the exploiter exchanged over $42.5 million worth of Bitcoin for Ethereum via the decentralized liquidity protocol THORChain on Wednesday, May 21st. The malicious actor even left a mocking message in the transaction data, referencing former NBA player James Worthy.
PeckShield, a blockchain security firm, unveiled that a relevant address received 9,081 Ether from THORChain, which was then swapped for 23 million of the stablecoin Dai. Subsequently, the same address received another 8,569 Ether.
It is crucial to note that the Coinbase breach did not involve direct stolen crypto from the platform. The attackers infiltrated the company's system by bribing overseas support agents to gather sensitive user data[2][4][5]. The breach affected approximately 69,461 people, although the attackers did not obtain passwords, private keys, or direct access to funds[2][4].
Coinbase announced a reimbursement plan of $180 million to $400 million in response to the incident[4]. The company refused the hackers' original ransom demand of $20 million[4][5]. Earlier this month, Coinbase released an alert about the incident and offered a $20 million reward for information leading to the arrest of the attackers[4].
Outside of this data breach, several crypto thefts have plagued Coinbase users in recent months, with significant sums lost[1]. More recently, a threat actor conducted an on-chain swap, converting large sums of Bitcoin to Ethereum and using memes to mock ZachXBT. However, there is no definite link between this activity and the May 2025 insider data breach[1].
[1] - ZachXBT (2025-05-23). "Coinbase Funds Possibly Sent to THORChain Days Ago - Original Source." Twitter.[2] - Coinbase (2025-05-18). "Coinbase Security Update: Unauthorized Access to Some Data." Coinbase.[3] - Decrypt (2025-05-18). "Coinbase Says Data Breach Impacted 69,461 People." Decrypt.[4] - CoinDesk (2025-05-18). "Coinbase Reveals Data Breach, Offers $20 Million Reward for Info." CoinDesk.[5] - The Block Crypto (2025-05-18). "Coinbase Offers $20 Million Reward for Info on Data Breach." The Block Crypto.
Follow us on Twitter, Facebook, and Telegram. Don't miss a beat - subscribe to get email alerts directly to your inbox. Check price action and surf The Daily Hodl Mix.
Covering the future of finance, including macro, Bitcoin, Ethereum, crypto, and Web 3.
Categories
- Bitcoin
- Ethereum
- Trading
- Altcoins
- Financeflux
- Blockchain
- Regulators
- Scams
- HodlX
- The recent on-chain swap, which saw a malicious actor converting millions of dollars worth of Bitcoin to Ethereum via THORChain, highlights the increasing use of blockchain technology in cryptocurrency transactions.
- Despite Coinbase's reimbursement plan of $180 million to $400 million in response to the data breach, the platform has been affected by multiple cryptocurrency thefts, underscoring the need for improved finance and security measures.
![Approximately $2.1 trillion in market value is associated with Bitcoin right now. [Image Included]](/en/img/20250602164449_pexels-image-search-image-description-sunset-beach-landscape.jpeg)
