Hacker Converts $12.5 Million Stolen From Coinbase Into 4,863 ETH

In a significant development, a hacker has converted stolen funds from a Coinbase breach into millions worth of Ethereum. The individual behind the May 2025 exploit has been actively trading on-chain, purchasing 4,863 ETH using $12.5 million in DAI at a price of $2,569 per token. This activity has been traced to wallets connected to the exploit, confirming that the attacker now holds $45.36 million in DAI across two addresses. The hacker's strategic trades, including selling stacks of ETH and later re-entering the market to buy more, have been observed by blockchain analysts.

The hacker's actions have intensified scrutiny from both analysts and law enforcement. The individual behind the breach has been executing calculated moves to maximize value from the stolen assets. Around six weeks ago, the same wallets sold 17,779 ETH for $45.48 million, shortly before repurchasing 207.17 ETH using $536,000 in DAI. These trades were conducted on THORChain, a decentralized exchange that allows cross-chain swaps, making fund flows difficult to track. Despite ongoing investigations, the hacker's strategic behavior is still tracked through on-chain data, indicating that the attacker does not have a hurry to leave the market.

Coinbase has verified that the hack was enabled by employee collaboration. The exchange confirmed that fake contractors gave access to a small percentage of user data, resulting in about 400 million dollars in losses. Less than 1 percent of customers had their data leaked. Despite the hacker's $20 million demand to keep the breach hidden, Coinbase declined to negotiate and instead revealed the mishap, promising to compensate the affected customers to the fullest extent possible. The company has assured that measures are in place to detect the contractors involved and ensure that such breaches are avoided in the future.

This incident highlights the persistence of dangers in the crypto market associated with online employees and the transfer of hacked assets within decentralized applications (dApps). The hacker's Ethereum accumulation strategy following the $400 million exploit has intensified scrutiny from both analysts and law enforcement. As the investigation continues, Coinbase faces pressure to reinforce internal controls and recover the stolen funds. The event serves as a reminder of the need for increased security measures and vigilance in the cryptocurrency industry to prevent similar exploits in the future.