The $100 Million Coinbase Wallet Breach Hacker Has Moved Tens of Millions of Bitcoins

Using THORChain, a distributed cross-chain liquidity system that permits anonymous asset transfers across blockchains, the hacker swapped around 1,101 BTC (value $42.5 million)

The hacker responsible for the $100 million Coinbase wallet breach in 2022 has reportedly been transferring tens of millions of dollars in Bitcoins.

Among these transfers, a portion of the stolen cryptocurrency was used to perform a swap on THORChain, according to eminent blockchain investigator ZachXBT.

This activity was spotted and reported by ZachXBT on May 20, on X (formerly Twitter). He observed the hacker transferring BTC to ThorSwap, a frontend for the THORChain network, facilitating liquidity and cross-chain integration.

However, the hacker's actions were met with an unexpected response. After noting that the Bitcoins were being swapped on THORChain, and that the hacker appeared to be aiming to "disappear" with the funds, ZachXBT stated, "Yep, seems like the Coinbase hacker is trying to use up the remaining BTC. No criminal, I’m a coder arrived at one of ZachXBT's known wallet addresses.

This remark appears to be a direct reaction to ZachXBT's ongoing public tracking and labelling of hacker activity starting from the 2022 Coinbase hack. It also implies that the hacker sees himself not as a criminal but as someone using system vulnerabilities—a sometimes-cited narrative in grey-hat or black-hat hacking circles.

Coinbase had confirmed in late 2022 that an unidentified attacker had stolen crypto assets valued at about $100 million from an exchange wallet. The hack triggered scrutiny of internal wallet security and flaws in crypto infrastructure, although it had no direct impact on user accounts or operations.

Despite initial investigations and community-led tracing efforts, which began with people like ZachXBT, the hacker managed to evade capture and remained silent.

However, the hacker's actions are now being targeted as they continue to move and swap the stolen cryptocurrency.

Because THORChain facilitates cross-chain and privacy-centric transactions, which can hinder law enforcement tracking and financial flow analysis, it has come under investigation.

While decentralized systems like THORChain provide valuable interoperability for DeFi ecosystems, they also present avenues for malefactors.

The claimed Coinbase hacker, unable to withdraw the funds directly due to Know Your Customer (KYC) and Anti-Money Laundering (AML) regulations on centralized exchanges, appeared to be attempting to use up the remaining Bitcoin by performing a 1,101 BTC (value $42.5 million) swap on THORChain.