In May 2025, a significant breach of Coinbase occurred, with the hacker converting stolen funds into millions of dollars worth of Ethereum.
Overview of the Coinbase Breach
The individual behind the May 2025 Coinbase breach is actively converting stolen funds into Ethereum. On-chain data shows the hacker recently purchased 4,863 ETH using $12.5 million in DAI at a price of $2,569 per token. Authorities have traced the transactions to wallets connected to the exploit, confirming that the attacker now holds $45.36 million in DAI across two addresses.
Hacker's Strategy for Trading Ethereum
Blockchain analysts observed the hacker executing calculated moves to maximize value from the stolen assets. Around six weeks ago, the same wallets sold 17,779 ETH for $45.48 million, shortly before repurchasing 207.17 ETH using $536,000 in DAI. The trades were conducted on THORChain, a decentralized exchange, complicating the tracking of fund flows.
Coinbase's Response to the Incident
Coinbase has verified that the hack was enabled by employee collaboration. The exchange states that fake contractors gained access to a small percentage of user data, resulting in losses of about $400 million. Despite the hacker's $20 million demand to keep the breach hidden, Coinbase declined to negotiate and instead disclosed the incident.
The hacker's activities following the Coinbase breach highlight the persistent security threats in the cryptocurrency space. As the investigation continues, Coinbase faces pressure to reinforce internal controls and recover the stolen funds.
