Coinbase Users $300M+ Stolen Funds Move Again

The Coinbase users previous theft story once again came to limelight today. As the scam actor linked to more than $300 million in stolen funds is moving money again, with onchain investigator VAL reporting that around some quantity was converted to ETH and sent to Tornado cash yesterday. This transaction comes after another big stash reportedly took the same route three weeks ago.

Coinbase Users Theft Came Through Social ENgineering

This wasn’t a smart-contract exploit. In fact the stolen funds came from an extensive social engineering campaign targeting individual Coinbase users, with scammers allegedly impersonating as customer support to trick victims into revealing credentials, transferring assets or approving malicious transactions.

Onchain investigators, including ZachXBT, previously tracked the cumulative losses at more than $300 million. And despite the scale of the theft, tens of million of dollars reportedly remain sitting in wallets associated with the threat actor. That said, there is a lot of ammunition there is that is still sitting onchain.

The Threat Actor Is Moving Ethereum Again

As per VAL’s latest update, around $500K was converted into ETH before being sent to Tornado Cash yesterday. A separate $2 million transaction of conversion happened to ETH which was carried out three weeks earlier as well and sent through the same route, which is via the Tornado Cash.

The movement are notable because the funds stolen from Coinbase Coinbase Coinbase is one of the leading cryptocurrency exchanges known for making digital asset trading secure, easy, and accessible for everyone. Founded by Brian Armstrong and Fred Ehrsam in 2012, the company allows users to buy, sell, and trade cryptocurrencies. Coinbase supports a wide range of cryptocurrencies and provides advanced features like secure trading, crypto holding management, and native blockchain transactions. Key Features Users can purchase, exchange, and manage cryptocurrencies, including Bitcoin and Ethereum. Advanced trading tools for professional traders. A self-custody crypto wallet known as the Coinbase wallet, now available as the Base app. Users can earn rewards on staked cryptocurrencies. Prime brokerage, including costs, trading, and custody for institutions. APIs and on-chain solutions for developers. support@coinbase.com WalletCentralised Exchange users weren’t simply sitting untouched. In fact the threat actor appears to be actively moving portions of the stolen funds, while sustained balances remain in associated wallets.

The Same Actor Once Mocked ZackXBT Investigator

The case also has an unusually brazen history. The threat actor previously embedded custom messages directly into transactions sent toward ZachXBT’s wallet effectively trolling the analyst while tracking efforts were underway at the time.

The wallet identified in the latest update include ‘0x5Da2….89D8a’ and ‘0x3ECe….f296’. For Coinbase users, the episode is another reminder that social engineering can be just as damaging as technical exploit. The Coinbase users theft now has a fresh development, and with tens od million still reportedly parked in wallets, the story clearly isn’t finished.

• ETH$ 2,245.43(-0.50%)