Coinbase Users $300M+ Stolen Funds Move Again

The Coinbase users previous theft story once again came to limelight today. As the scam actor linked to more than $300 million in stolen funds is moving money again, with onchain investigator VAL reporting that around some quantity was converted to ETH and sent to Tornado cash yesterday. This transaction comes after another big stash reportedly took the same route three weeks ago.

Coinbase Users Theft Came Through Social ENgineering

This wasn’t a smart-contract exploit. In fact the stolen funds came from an extensive social engineering campaign targeting individual Coinbase users, with scammers allegedly impersonating as customer support to trick victims into revealing credentials, transferring assets or approving malicious transactions.

Onchain investigators, including ZachXBT, previously tracked the cumulative losses at more than $300 million. And despite the scale of the theft, tens of million of dollars reportedly remain sitting in wallets associated with the threat actor. That said, there is a lot of ammunition there is that is still sitting onchain.

The Threat Actor Is Moving Ethereum Again

As per VAL’s latest update, around $500K was converted into ETH before being sent to Tornado Cash yesterday. A separate $2 million transaction of conversion happened to ETH which was carried out three weeks earlier as well and sent through the same route, which is via the Tornado Cash.

The movement are notable because the funds stolen from Coinbase Coinbase   Coinbase is one of the leading cryptocurrency exchanges known for making digital asset trading secure, easy, and accessible for everyone. Founded by Brian Armstrong and Fred Ehrsam in 2012, the company allows users to buy, sell, and trade cryptocurrencies. The publicly traded company provides crypto trading, custody, staking, payments, derivatives, prediction markets, and other digital-asset services for consumers, institutions, businesses, and developers. Coinbase is also expanding beyond a traditional crypto exchange through Base, Coinbase Wallet, Coinbase Advanced, Coinbase One, Coinbase Prime, and stablecoin infrastructure.   Coinbase Details   Attribute Details Key Products Coinbase, Coinbase Wallet, Coinbase One, Advanced Trade, Coinbase Card, Coinbase Prime, Coinbase Commerce, Coinbase Developer Platform, Base Trading Spot trading, Advanced Trade, derivatives, and DEX trading Institutional Services Coinbase Prime, Institutional Solutions, custody, trading, and APIs Developer Services Developer Platform, Wallet SDK, Commerce API, Exchange API, Prime APIs, and Base Node Blockchain Base Stablecoin USD Coin (USDC) Countries 100+ countries Crypto Focus Trading, custody, staking, payments, stablecoins, DeFi, Web3, and onchain infrastructure Notable Blockchain Project Base, Coinbase's Layer-2 blockchain Current Positioning Coinbase is building an “Everything Exchange” covering crypto, equities, derivatives, prediction markets, and more.   Key Features of Coinbase:   Users can buy, sell, exchange, and manage cryptocurrencies such as Bitcoin and Ethereum. Advanced trading tools and features are available for professional and experienced traders. Offers a self-custody crypto wallet, now available through the Base app. Users can earn rewards by staking supported cryptocurrencies on the platform. Coinbase Prime offers institutional services such as trading and crypto custody. APIs and on-chain solutions help developers build and manage crypto applications.   Platform Security and Regulatory Compliance   Platform Security Measures   Cold storage: More than 90 percent of customers’ funds are held offline in secure vaults. Data encryption: User information is encrypted using AES-256. Account protection: MFA and biometrics serve to protect the user’s account. Segregation of assets: Customer crypto funds and fiat balance are segregated and cannot be used without the customer’s consent.   Regulatory Compliance   US Licenses: It is registered with FinCEN and holds licenses for conducting money transfers in many US states, including NYDFS BitLicense. Legal Regulations: Adheres to the USA PATRIOT Act and Bank Secrecy Act through identification and transaction monitoring. Sanctions Screening: Transfers are checked against OFAC lists to help prevent illegal on-chain activity.   Coinbase Products   Product Category Coinbase Crypto Exchange Coinbase Wallet Self-Custody Wallet Coinbase One Subscription Advanced Trade Advanced Trading Coinbase Card Crypto Card Coinbase Prime Institutional Coinbase Commerce Crypto Payments Coinbase Business Business Platform Coinbase Developer Platform (CDP) Developer Platform Base Layer 2 Blockchain Base App Onchain App Coinbase Staking Staking Coinbase Derivatives Derivatives Prediction Markets Prediction Trading Coinbase Ventures Venture Capital   Coinbase Key Supported Regions   North America: United States (all states except Hawaii), Canada Europe: United Kingdom, Germany, France, Spain, Netherlands, Italy, and most EEA member countries Asia-Pacific: Singapore, Australia, India, Turkey, Philippines, Vietnam, Pakistan Africa & South America: South Africa, Brazil, and selected developing markets   support@coinbase.com WalletCentralised Exchange users weren’t simply sitting untouched. In fact the threat actor appears to be actively moving portions of the stolen funds, while sustained balances remain in associated wallets.

The Same Actor Once Mocked ZackXBT Investigator

The case also has an unusually brazen history. The threat actor previously embedded custom messages directly into transactions sent toward ZachXBT’s wallet effectively trolling the analyst while tracking efforts were underway at the time.

The wallet identified in the latest update include ‘0x5Da2….89D8a’ and ‘0x3ECe….f296’. For Coinbase users, the episode is another reminder that social engineering can be just as damaging as technical exploit. The Coinbase users theft now has a fresh development, and with tens od million still reportedly parked in wallets, the story clearly isn’t finished.

• ETH$ 2,699.59(0.81%)