{"id":129766,"date":"2025-05-22T07:18:19","date_gmt":"2025-05-22T07:18:19","guid":{"rendered":"http:\/\/cryptospotters.net\/?p=129766"},"modified":"2025-05-22T07:18:19","modified_gmt":"2025-05-22T07:18:19","slug":"coinbase-hacker-trolls-zachxbt-onchain-after-42-5m-thorchain-swap","status":"publish","type":"post","link":"http:\/\/cryptospotters.net\/?p=129766","title":{"rendered":"Coinbase hacker trolls ZachXBT onchain after $42.5M THORChain swap"},"content":{"rendered":"<p>Source: Cointelegraph.com NewsThe hacker behind the data breach targeting Coinbase users has mocked blockchain investigator ZachXBT with an onchain message following a major crypto swap.<br \/>\nOn May 21, the hacker who previously stole data from at least 69,400 Coinbase users used Ethereum transaction input data to write \u201cL bozo,\u201d followed by a meme video of NBA player James Worthy smoking a cigar.<br \/>\nThe message came after the attacker swapped approximately $42.5 million from Bitcoin (BTC) to Ether (ETH) via THORChain.<br \/>\nZachXBT flagged the message on his Telegram channel, linking it to the same entity responsible for the Coinbase data breach affecting at least 69,400 users.<br \/>\nCoinbase hacker trolling ZachXBT. Source: ZachXBT.On May 22, blockchain security firm PeckShield reported that the hacker had continued to move funds, swapping 8,697 ETH for 22 million Dai (DAI). A separate but closely linked address, which received 9,081 ETH via THORChain, also converted the assets into 23 million DAI.<br \/>\nRelated: DOJ is investigating Coinbase data breach\u2014 Report<br \/>\nCoinbase hit with lawsuits after breach<br \/>\nThe Coinbase breach, first reported in a filing with the Maine Attorney General\u2019s office, occurred in December 2024 and was discovered on May 11. The stolen data includes names, home addresses and other personal information.<br \/>\nFollowing the disclosure, the attackers demanded a $20 million ransom in Bitcoin to prevent the release of the stolen data. Coinbase refused and instead offered a $20 million bounty for information leading to the identification of the hackers.<br \/>\nThe company estimates a potential financial impact between $180 million and $400 million due to remediation costs and customer compensation.<br \/>\nCoinbase has also faced a wave of lawsuits following the revelation. At least six legal complaints were filed between May 15 and 16, with plaintiffs accusing the exchange of failing to implement adequate security measures and mishandling its response to the breach.<br \/>\nRelated: Coinbase data leak could put users in physical danger: TechCrunch founder<br \/>\nTHORChain under scrutiny for criminal use<br \/>\nThe Coinbase hacker\u2019s use of THORChain to swap $42.5 million worth of Bitcoin into Ether comes as the protocol faces growing scrutiny over its role in facilitating illicit transactions.<br \/>\nIn March, the platform came under fire after its swap volume surged following the $1.4 billion Bybit hack. The protocol generated over $5 million in revenue after processing $5.4 billion in swap volume, with over $1 billion moved in a single day.<br \/>\nBlockchain security firms identified North Korea\u2019s Lazarus Group as the main suspect, using THORChain to launder a significant portion of the stolen funds.<br \/>\nSource:\u00a0LookonchainThe controversy intensified when a THORChain developer, known as \u201cPluto,\u201d resigned after a vote to block transactions linked to Lazarus was overturned.<br \/>\nMagazine: TradFi is building Ethereum L2s to tokenize trillions in RWAs: Inside story<a href=\"https:\/\/cointelegraph.com\/news\/coinbase-hacker-trolls-zachxbt-moves-millions-through-thorchain?utm_source=rss_feed&amp;utm_medium=rss&amp;utm_campaign=rss_partner_inbound\" target=\"_blank\" class=\"feedzy-rss-link-icon\" rel=\"noopener\">Read More<\/a><\/p>","protected":false},"excerpt":{"rendered":"<p>Source: Cointelegraph.com NewsThe hacker behind the data breach targeting Coinbase users has mocked blockchain investigator ZachXBT with an onchain message following a major crypto swap. On May 21, the hacker&hellip; <\/p>\n","protected":false},"author":0,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[5],"tags":[],"_links":{"self":[{"href":"http:\/\/cryptospotters.net\/index.php?rest_route=\/wp\/v2\/posts\/129766"}],"collection":[{"href":"http:\/\/cryptospotters.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/cryptospotters.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"http:\/\/cryptospotters.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=129766"}],"version-history":[{"count":0,"href":"http:\/\/cryptospotters.net\/index.php?rest_route=\/wp\/v2\/posts\/129766\/revisions"}],"wp:attachment":[{"href":"http:\/\/cryptospotters.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=129766"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/cryptospotters.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=129766"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/cryptospotters.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=129766"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}