Coinbase Hacker Swaps $42 Million, Mocks ZachXBT

Cryptos: 21,330
Exchanges: 1,863
Market Cap: $3.5T 2.39%
24h Vol: $528,503,985,701 38.97%
Dominance: BTC: 63.1% ETH: 9.2%
Gas: 4 GWEI

Connect

Crypto News Exploits

Hacker Behind Coinbase Data Breach Swaps $42 Million, Mocks ZachXBT

Written by Aaron S.,

Editor-In-Chief

Last Updated: May 22, 2025

Key Takeaways

The Coinbase hacker resurfaced on May 21 with a $42.5 million swap and an on-chain message mocking ZachXBT;
PeckShield tracked more swaps totaling $45 million in DAI across wallets linked to the same breach;
Coinbase refused a $20 million ransom demand and offered a $20 million bounty to identify the hackers instead.

Ace quick missions & earn crypto rewards while gaining real-world Web3 skills. Participate Now ! 🔥

Hacker Behind Coinbase Data Breach Swaps $42 Million, Mocks ZachXBT

BITDEGREE IN YOUR SOCIAL FEED

A hacker linked to the Coinbase user data breach has reappeared with new blockchain activity and a public message aimed at crypto investigator ZachXBT.

In an Ethereum transaction dated May 21, the hacker added a short note, "L bozo" along with a video of basketball player James Worthy smoking a cigar.

This was done after the hacker swapped around $42.5 million in Bitcoin BTC $111,200.38 for Ethereum ETH $2,662.07 using the THORChain RUNE $2.12 platform.

What is Polkadot in Crypto? (DOT Animated Explainer)

Did you know?

Want to get smarter & wealthier with crypto?

Subscribe - We publish new crypto explainer videos every week!

ZachXBT pointed out the message on his Telegram channel and said it came from the same wallet involved in the breach that affected nearly 70,000 Coinbase $3.55B users.

On May 22, blockchain security firm PeckShield reported more transactions from the hacker. One wallet exchanged 8,697 ETH for about $22 million in the DAI DAI $0.9968 stablecoin. Another wallet, which had received 9,081 ETH through THORChain, swapped its funds for roughly $23 million in DAI.

The original breach happened in December 2024 but was not found until May 11, 2025. According to a filing with Maine’s Attorney General, the hackers accessed names, addresses, and other private details.

The hacker asked for a $20 million ransom in Bitcoin to keep the data from being leaked. However, Coinbase refused and instead offered the same amount as a reward for information that could help identify those behind the attack.

On May 13, the Layer-2 scaling solution ZKsync and its development team, Matter Labs, experienced a security incident. How? Read the full story.