Coinbase Hacker Swaps $42.5M Bitcoin to Ethereum Via THORChain

The thief behind the massive Coinbase exploit earlier this month has been actively swapping the stolen cryptocurrency. The pseudonymous on-chain investigator ZachXBT noted on Telegram that the exploiter had swapped $42.5+ million worth of Bitcoin (BTC) into Ethereum (ETH) via the decentralized liquidity protocol THORChain (RUNE).

In a taunting move, the thief sent an on-chain message to ZachXBT that read “L bozo” and included a link to a YouTube video of former NBA star James Worthy smoking a cigar. This message was seen as a direct response to ZachXBT's efforts to track the thief's activities.

The exploiter continued to swap 8,697 ETH for 22 million of the stablecoin Dai (DAI), as reported by the blockchain security firm PeckShield. PeckShield also identified another address closely linked to the threat actor, which received 9,081 ETH from THORChain and subsequently swapped it for 23 million DAI. This address later received an additional 8,569 ETH (valued at approximately $22.4 million) from THORChain.

The breach at Coinbase involved criminals bribing a small group of overseas customer support agents to copy the data of less than 1% of the firm’s monthly transacting users. A recent filing with the Maine Attorney General’s Office revealed that the breach affected 69,461 individuals. The compromised information includes names, addresses, phone numbers, email addresses, masked social security numbers (the last 4 digits only), masked bank-account numbers, some bank account identifiers, government-ID images, account data, and limited corporate data.

Coinbase discovered the hack after receiving an email demanding a $20 million BTC payoff in exchange for not releasing the stolen information. The company refused to comply with the hackers’ demand and estimates that it will incur remediation costs and voluntary customer reimbursements ranging from $180 million to $400 million.

This incident highlights the ongoing challenges faced by cryptocurrency exchanges in securing user data and preventing exploits. The actions of the thief, including the taunting message and the swapping of stolen crypto, underscore the need for enhanced security measures and vigilance within the industry. The involvement of decentralized liquidity protocols like THORChain in the swapping process adds another layer of complexity to the investigation and recovery efforts.