Coinbase Hacker Buys 4,863 ETH in an Ethereum Accumulation Spree

The hacker behind the massive May 2025 exploit of Coinbase users is audaciously using the stolen proceeds to build a large position in Ethereum, according to on-chain transaction trackers.

The individual or group bought 4,863 ETH for $12.5 million (DAI) at $2,569 per ETH. After the latest transaction, the hacker holds $45.36 million (DAI) across two different wallets. The tracker suspects that the hacker may buy more ETH in the future.

A hacker who stole funds from a #Coinbase user has bought 4,863 $ETH for $12.5M $DAI at a price of $2,569.

The hacker still holds $45.36M $DAI across 2 different wallets and is likely to buy more $ETH.

Address: 0xb574d779c391eac47fa09b6e50cb79cccb57a8c8$DAI Holding Addresses:… https://t.co/zquj05yczI pic.twitter.com/Mloq2SoYEb

— Onchain Lens (@OnchainLens) July 7, 2025

The May 2025 Coinbase Exploit

The on-chain tracker linked the latest transaction to the Coinbase exploit in May, which the cryptocurrency exchange attributed to the connivance of fraudulent employees with the hackers.

Coinbase reportedly lost up to $400 million in the attack after insiders supplied the hackers with less than 1% users’ information. Coinbase refused to meet the hackers $20 million demand to keep the exploit quiet. Instead, the crypto exchange promised to reimburse all the users affected by the scam.

A Brazen Pattern of On-Chain Trading

In the meantime, all efforts to apprehend the hackers or retrieve the stolen funds have been unsuccessful. Instead, the hackers have embarked on an Ethereum accumulation spree by converting the stolen funds to ETH. The hackers have also sold a notable amount of the stolen digital assets for fiat, as recorded by the on-nchain tracker.

About six weeks ago, the tracker spotted two wallets belonging to the hackers that sold a combined 17,779 ETH for $45.48 million at $2,558 per token. Strangely, the same individual bought 207.17 ETH tokens by spending $536,000 (DAI). The hackers executed the transactions on the THORChain, a decentralized exchange for native assets and Bitcoin.

The Coinbase hack highlighted the security challenges facing the cryptocurrency industry, as its continuous growth remains an incentive for hackers, seeking ways to exploit crypto platforms and steal users’ funds. It is worth noting that Coinbase claimed to have identified the contractors involved in the scam and promised to take appropriate measures to avoid a recurrence of the unfortunate incident.

Source