Coinbase hacker liquidated 26,554 ETH for $68.72M in DAI through THORChain and new wallets in 24 hours.
17,778 ETH were sold in 4 hours, followed by a buyback of 207 ETH using 536K DAI at $2,587.
A wallet linked to address 0xb57 sold an additional 8,776 ETH for $23.24M at $2,648 average price.
The individual believed to be behind the Coinbase wallet breach has reemerged with significant on-chain activity. Over the past 24 hours, this actor sold a total of 26,554 ETH across multiple wallets, converting the assets into $68.72 million in DAI. The funds were laundered through THORChain, a decentralized cross-chain protocol for unspecified exchanges.
Transactions were conducted using newly created wallets, bypassing centralized exchanges and their regulatory safeguards. This activity coincided with another message sent to blockchain investigator ZachXBT, continuing a pattern of provocation.
17,778 ETH Sold for $45.48M, Followed by Strategic Buyback
In a concentrated four-hour window, the Coinbase hacker liquidated 17,778 ETH, receiving $45.48 million in DAI at an average price of $2,558. These transactions were split across three new Ethereum wallets. All assets were first routed through THORChain to mask their origin before being exchanged for stablecoins.
Source: Spot On Chain (X)
Notably, one of the involved wallets returned to the market shortly after, spending 536,000 DAI to repurchase 207.17 ETH at a slightly higher price of $2,587. The timing of the buyback and its proximity to the initial sale suggest deliberate asset rotation strategies. This movement occurred after several months of inactivity from the hacker's known addresses.
The deliberate choice of THORChain signals continued efforts to exploit decentralized finance tools to avoid detection. These transactions present new complexities for investigators monitoring blockchain flows. Furthermore, one wallet embedded an on-chain message addressed to ZachXBT, again referencing the investigator's ongoing efforts to trace illicit crypto flows.
Coinbase Additional 8,776 ETH Dumped for $23.24M, Total Sales Reach $68.72M
Roughly 12 hours after the initial ETH liquidation, a wallet associated with address 0xb57 executed another major sale. The wallet offloaded 8,776 ETH for $23.24 million in DAI. The average selling price for this batch was $2,648. This brings the hacker’s total ETH sales to 26,554, conducted across newly generated wallets and decentralized protocols.
At the current value, the coinbase attacker has moved over $68.72 million in the last 24 hours alone. The transactions continue to raise concerns about the role of privacy-focused platforms like THORChain. The lack of KYC and AML compliance allows actors to obscure transaction trails effectively.
These recent moves add complexity to ongoing investigations surrounding the 2022 breach, which originally resulted in over $300 million in stolen crypto. Regulatory attention on cross-chain protocols may intensify as these cases evolve.
