Hacker Linked to $300 Million Coinbase Theft Swaps $45 Million via Thorchain

An unidentified individual involved in the theft of $300 million from Coinbase users exchanged $42.5 million in Bitcoin for Ethereum through Thorchain, according to on-chain sleuth ZachXBT.

The expert shared a screenshot from a blockchain explorer, where the perpetrator left him an on-chain message: L bozo. In crypto slang, this is a taunt, where L stands for “loss” and bozo is a derogatory term for a fool or loser.

Additionally, the hacker attached a link to a meme video on YouTube, featuring NBA legend James Worthy contentedly smoking a cigar—a classic visual “finishing touch” in the spirit of “I won.”

ZachXBT perceived these words as a mockery directed at him—the hacker seemingly aimed to belittle the expert and show disdain for those who stand in his way.

This was the perpetrator’s response to ZachXBT’s actions, who had disseminated information about systematic issues faced by Coinbase users.

On May 7, the researcher recorded another incident involving the assets of clients of the American Bitcoin exchange. The hacker stole $45 million using social engineering techniques. According to ZachXBT’s estimates, since the beginning of the year, victims of fraud on this platform have lost over $300 million.

On May 15, Coinbase reported a theft of user data due to the bribery of overseas support staff. The hacker demanded $20 million, threatening to publish the stolen information on the dark web. The platform’s team refused and took countermeasures.

After the ransom was refused, the perpetrator converted $42.5 million from Bitcoin to Ethereum through Thorchain. An hour later, from the same address marked as Fake_Phishing1158790, there was a sale of 8698 ETH for $22.12 million in DAI.

Recently, Coinbase admitted that as a result of a data leak in December 2024, attackers obtained information on 69,461 users. Later, the exchange estimated the costs of resolving the incident and compensating clients at between $180 million and $400 million.

In March, users of the platform reported phishing emails. Perpetrators, posing as Coinbase, offered to transfer assets to new wallets using pre-generated seed phrases.

In May, Bloomberg discovered that Binance and Kraken managed to fend off attacks using social engineering methods that had affected Coinbase.