Ethereum News Today: Coinbase Hacker Uses Tornado Cash to Outwit Tracers in $24M Laundering Spree

The hacker behind the recent $300 million theft from Coinbase has moved $24 million (5,514 ETH) through the privacy-focused cryptocurrency mixer Tornado Cash, indicating an ongoing effort to launder the stolen assets. The wallet address 0x9b01b0545afe5b9957efc7945253e19b2ba07d9c is being used to gradually withdraw the Ethereum, suggesting a systematic approach to dispersing the funds. This activity is being closely monitored by on-chain analysts such as OnchainLens, who have observed that the withdrawals are occurring in smaller increments rather than a single transaction, a common tactic used to obscure the origin of illicit crypto assets [1].

The hacker has also been actively diversifying the stolen assets across different cryptocurrencies. Recent on-chain activity shows the purchase of 38,126 SOL tokens worth $8 million in a short two-hour window, as well as acquiring nearly 4,863 ETH at an average price of $2,569 per ETH using DAI stablecoins, totaling $12.5 million. The addresses 0xcC434153CD323b8537d245920a8e8e0Aa3C3c638 and 7reyCVVxQpkBjFxauBtdzBWynEh3y6MvGPwuRwwn7Doh were linked to these transactions, further demonstrating the complexity of the hacker’s strategy to move funds across multiple chains [1].

Tornado Cash, used in these transactions, is a decentralized mixer that allows users to obscure the trail of their transactions by pooling funds with others and then withdrawing them with a different identifier. This method makes it significantly more challenging for blockchain analysts to trace the origin of the funds. According to the U.S. Treasury’s Office of Foreign Assets Control (OFAC), Tornado Cash is a sanctioned service, and its use increases compliance and tracing risks for institutions monitoring crypto flows [2]. The use of such tools underscores the sophistication of the hacker’s efforts to avoid detection while continuing to liquidate the stolen assets.

Further on-chain data shows that the hacker has sold 26,347 ETH for 68.18 million DAI in the past 12 hours, with a notable recent sale of 8,775.56 ETH valued at $23.23 million. These transactions occurred through the wallet address 0xB574D779c391eAc47fA09b6e50cB79cCcB57A8c8, highlighting the multi-stage process of laundering and diversification. Experts suggest that the pacing of these sales is a deliberate strategy to avoid drawing attention and triggering market volatility or regulatory intervention [1].

Analysts warn that such movements could introduce selling pressure into the Ethereum market, potentially affecting short-term price volatility and investor sentiment. Historical data from similar events show that large-scale liquidation of stolen crypto assets can lead to temporary price corrections in the associated token. As the hacker continues to move and convert the stolen ETH, traders and institutions are advised to monitor on-chain metrics and wallet activity for any signs of further market impact [2]. The slow and calculated strategy employed by the hacker indicates an understanding of market dynamics, making this incident a case study in how illicit actors leverage blockchain privacy tools to maximize returns while minimizing exposure.

Source:

[1] Livebitcoinnews.com (https://www.livebitcoinnews.com/coinbase-hacker-moves-24m-5514-eth-through-tornado-cash-slowly-draining-funds/)

[2] Blockchain.news (https://blockchain.news/flashnews/alleged-coinbase-hack-wallet-moves-5-514-eth-24-04m-via-tornado-cash-on-chain-alert-for-eth-traders)

[3] Odaily.news (https://www.odaily.news/en/newsflash/445805)