Stop overpaying - start transferring money with Ogvio. Sign up, invite friends & grab Rewards now! 🎁
Hacker Behind Coinbase Data Breach Swaps $42 Million, Mocks ZachXBT
Key Takeaways
- The Coinbase hacker resurfaced on May 21 with a $42.5 million swap and an on-chain message mocking ZachXBT;
- PeckShield tracked more swaps totaling $45 million in DAI across wallets linked to the same breach;
- Coinbase refused a $20 million ransom demand and offered a $20 million bounty to identify the hackers instead.
A hacker linked to the Coinbase user data breach has reappeared with new blockchain activity and a public message aimed at crypto investigator ZachXBT.
In an Ethereum transaction dated May 21, the hacker added a short note, "L bozo" along with a video of basketball player James Worthy smoking a cigar.
This was done after the hacker swapped around $42.5 million in Bitcoin
Did you know?
Subscribe - We publish new crypto explainer videos every week!
How Do KYC & AML Work in Crypto? (Explained)
ZachXBT pointed out the message on his Telegram channel and said it came from the same wallet involved in the breach that affected nearly 70,000 Coinbase
On May 22, blockchain security firm PeckShield reported more transactions from the hacker. One wallet exchanged 8,697 ETH for about $22 million in the DAI
The original breach happened in December 2024 but was not found until May 11, 2025. According to a filing with Maine’s Attorney General, the hackers accessed names, addresses, and other private details.
The hacker asked for a $20 million ransom in Bitcoin to keep the data from being leaked. However, Coinbase refused and instead offered the same amount as a reward for information that could help identify those behind the attack.
On May 13, the Layer-2 scaling solution ZKsync and its development team, Matter Labs, experienced a security incident. How? Read the full story.