The hacker behind the data breach targeting Coinbase users mocked blockchain investigator ZachXBT

On May 21, the hacker used Ethereum transaction input data to write “L bozo,” followed by a meme video of NBA player James Worthy smoking a cigar.

A hacker who breached Coinbase and stole personal data from 69,400 users mocked a blockchain investigator with an onchain message after a major crypto swap.

On May 21, the hacker used Ethereum transaction input data to write "L bozo," followed by a meme video of NBA player James Worthy smoking a cigar. The message came after the attacker swapped about $42.5 million from Bitcoin (BTC) to Ether (ETH) via THORChain.

Hunter, who is known for his work in tracking down and identifying cybercriminals, linked the message to the same entity responsible for the Coinbase breach.

The hacker has continued to move funds, swapping 8,697 ETH for 23 million Dai (DAI), according to blockchain security firm PeckShield. A separate but closely linked address, which received 9,081 ETH via THORChain, also converted the assets into 23 million DAI.

Earlier this month, Coinbase disclosed a data breach that occurred in December 2024 and affected at least 69,400 users. The stolen data includes names, home addresses and other personal information.

The attackers, who have been operating with relative impunity for months, threatened to release the stolen data unless Coinbase paid a $20 million ransom in Bitcoin.

Coinbase refused to pay the ransom but offered a $20 million bounty for information leading to the identification of the hackers. The company also estimates a potential financial impact of $180 million to $400 million due to remediation costs and customer compensation.

The breach has also led to several lawsuits against Coinbase, with plaintiffs accusing the exchange of failing to implement adequate security measures and mishandling its response to the breach.

At least six legal complaints were filed on May 15 and 16, targeting Coinbase and its executives over the breach.

The suits, which were filed in federal court in San Francisco, aim to create a class action lawsuit that could cover potentially thousands of affected customers.

The lawsuit comes as the U.S. Department of Justice (DOJ) is investigating the data breach, according to a report by the New York Times.

The report claims that the DOJ is examining whether any laws were broken in the breach, which saw hackers steal personal data from 69,400 Coinbase users and threaten to release it unless the exchange paid a $20 million ransom.

The investigation also follows bipartisan legislation in the Senate that would create a new federal privacy commission to oversee the collection and use of personal data by companies.

The bipartisan Data Privacy and Protection Act, introduced by Sens. John Kennedy, R-La., and Ben Cardin, D-Md., passed the Senate Banking, Housing, and Urban Affairs Committee in April. It is now pending a vote by the full Senate.

The Coinbase hacker's use of THORChain to swap $42.5 million worth of Bitcoin into Ether comes as the protocol faces growing scrutiny over its role in facilitating illicit transactions.

Earlier this year, THORChain's swap volume surged after a $1.4 billion hack of Bybit saw the platform generate over $5 billion in revenue.

The protocol, which specializes in cross-chain token swaps, facilitated the laundering of a large portion of the stolen funds, which were ultimately identified as belonging to North Korea's Lazarus Group.

Over $1 billion in cryptocurrency was moved in a single day as the hacker used THORChain to exchange stolen Bitcoin for Ether.

The large-scale operation taxed the protocol's capacity, causing transaction throughput to slow and incurring significant gas fees for the hacker.

Despite the massive volume of transactions, THORChain only generated about $5 million in revenue over the three-month period, highlighting the low fees charged by the protocol.

The controversy surrounding THORChain deepened when a developer, known as "Pluto," resigned following a vote to block transactions linked to Lazarus. The vote was ultimately overturned, and the developer expressed his disappointment with the community's response to the urgent matter.

In his post on the THORChain forum, Pluto, who had been involved in developing the protocol for two and a half years, announced his decision to step down.

He said he was particularly frustrated by the community's failure to take immediate action to block transactions linked to Lazarus, which was actively stealing and extorting billions of dollars from people.

Pluto's resignation comes amid a broader debate within the cryptocurrency community about the role of blockchain protocols in facilitating criminal activity.

While many in the community are eager to see swift action taken to combat cybercrime, others have raised concerns about the implications of blocking transactions on a decentralized protocol.

The developer's departure is a significant loss for THORChain, and it remains to be seen how the protocol will respond to the ongoing challenges it faces.output: A hacker who breached Coinbase (NASDAQ:COIN) and stole personal data from 69,400 users is poking fun at