COINBASE HACKER TROLLS ZACHXBT ONCHAIN AFTER $42.5M THORCHAIN SWAP
A shocking incident has unfolded on the blockchain, as a hacker behind the recent Coinbase data breach has mocked prominent cryptocurrency investigator ZachXBT onchain after swapping approximately $42.5 million worth of Bitcoin to Ethereum via THORChain.
The attack occurred on May 21, when the hacker used Ethereum transaction input data to write "L bozo," followed by a meme video of NBA player James Worthy smoking a cigar. The message was sent to ZachXBT's onchain wallet, and the investigator promptly flagged it on his Telegram channel, linking it to the same entity responsible for the Coinbase data breach that affected at least 69,400 users.
The Coinbase breach, first reported in a filing with the Maine Attorney General's office, occurred in December 2024 and was discovered on May 11. The stolen data includes names, home addresses, and other personal information. Following the disclosure, the attackers demanded a $20 million ransom in Bitcoin to prevent the release of the stolen data. Coinbase refused, instead offering a $20 million bounty for information leading to the identification of the hackers.
The company estimates a potential financial impact between $180 million and $400 million due to remediation costs and customer compensation. The breach has also led to a wave of lawsuits against Coinbase, with at least six legal complaints filed on May 15 and 16, accusing the exchange of failing to implement adequate security measures and mishandling its response to the breach.
Meanwhile, THORChain is facing growing scrutiny over its role in facilitating illicit transactions. In March, the platform came under fire after its swap volume surged following a $1.4 billion Bybit hack. The protocol generated over $5 million in revenue after processing $5.4 billion in swap volume, with over $1 billion moved in a single day.
Blockchain security firms identified North Korea's Lazarus Group as the main suspect, using THORChain to launder a significant portion of the stolen funds. The controversy intensified when a THORChain developer, known as "Pluto," resigned after a vote to block transactions linked to Lazarus was overturned.
The Hacker's Latest Move
On May 22, blockchain security firm PeckShield reported that the hacker had continued to move funds, swapping 8,697 ETH for 22 million Dai (DAI). A separate but closely linked address, which received 9,081 ETH via THORChain, also converted the assets into 23 million DAI.
The Coinbase hacker's use of THORChain to swap $42.5 million worth of Bitcoin into Ether comes as the protocol faces increased scrutiny over its role in facilitating illicit transactions. The incident serves as a stark reminder of the need for robust security measures and transparency in the cryptocurrency industry.