In a move straight out of a cyber-thriller, an elusive hacker who allegedly looted over $300 million from Coinbase users has resurfaced, not to hide, but to trade. On Sunday, the hacker casually dropped $8 million worth of stolen funds into Solana, right on the public blockchain where literally anyone can watch.
It’s a bold move in the crypto underworld. This isn’t the typical “steal and vanish” story. It seems today’s crypto thieves are evolving: they steal big, then turn around and trade the stolen loot, while law enforcement watches helplessly. Welcome to the wild, weird world of blockchain.
The Digital Paper Trail
Blockchain security company Lookonchain spotted the latest trade when they noticed the ‘Coinbase hacker’ – their label for this particular criminal – convert one type of digital currency into another. The hacker first swapped DAI tokens (a digital dollar equivalent) for USDC tokens (another digital dollar) and bought 38,126 Solana tokens at around $209 each.
But this trade backfired. Solana’s price dropped to $202.15, leaving the hacker with paper losses on their latest investment. Even criminals can’t always time the market perfectly.
This isn’t the hacker’s first rodeo. Back in July, they sold 26,762 Ethereum tokens worth $69.25 million. The same month, they bought more Ethereum in two separate purchases – first spending $12.55 million on 4,863 tokens, then another $2.3 million on 649 tokens.
A Growing Problem
The Coinbase case represents part of a much larger trend. Security analyst ZachXBT estimated that Coinbase users lost $330 million total to social engineering scams – sophisticated tricks where criminals manipulate people into giving up their cryptocurrency access codes.
Social engineering attacks work by targeting the human element rather than breaking computer systems directly. Criminals might pose as customer service representatives, create fake emergencies, or use other psychological tactics to convince victims to share their private wallet keys or passwords.
The Coinbase thief isn’t alone in turning stolen funds into trading profits. Another criminal linked to the Radiant Capital hack has been even more successful as an investor. He originally stole $49.5 million when they breached Radiant Capital, a decentralized finance protocol, in October 2024. The attack targeted the platform’s cross-chain lending services on two blockchain networks: BNB Chain and Arbitrum.
But through smart trading moves, this hacker has more than doubled their money. Their stolen stash has grown to over $105 million – a 114% increase. Last week alone, they made $2.7 million profit by buying 4,913 Ethereum tokens on Wednesday and selling 4,131 of them on Saturday.
The hacker now holds around 21,957 Ethereum tokens worth about $103 million, according to Lookonchain’s tracking.
When Crime Doesn’t Pay
Not every crypto criminal succeeds as a trader. Some have learned expensive lessons about market timing.
One unidentified hacker that Lookonchain tracks made a costly mistake in July. They sold 12,282 Ethereum tokens during a market crash, then panicked and bought back in at higher prices, losing $6.9 million in the process.
The same wallet later panic-sold again during another market dip in August, selling 4,958 Ethereum tokens. While they still made $9.75 million profit on that trade, their earlier losses show that stealing money doesn’t automatically make someone a good investor.
“Hackers are not good at trading,” Lookonchain observed after watching these fumbled trades.
Why Hackers Trade Publicly
Security experts initially puzzled over why criminals would trade stolen funds so openly on blockchain networks where every transaction creates a permanent, public record. The answer likely isn’t market strategy but necessity.
These trades probably serve as “evasion techniques” – ways to obscure the stolen funds’ origins by moving them through different cryptocurrencies and networks. Each trade makes the money harder to trace back to the original theft, even though blockchain analysts can still follow the digital breadcrumbs.
Federal investigators are actively working on the Coinbase case. The Department of Justice launched an investigation into the data breach that enabled many of these thefts, according to recent reports.
Meanwhile, blockchain analytics companies like Lookonchain, Arkham, and others continue tracking these criminal wallets, creating detailed profiles of how stolen cryptocurrency moves through the digital economy.
The public nature of blockchain technology creates an unusual situation: while criminals can steal digital assets, their subsequent actions remain visible to anyone with the right analytical tools. This transparency gives investigators powerful new ways to follow money trails that would have been impossible to track in traditional financial systems.
As cryptocurrency adoption grows, so does the sophistication of both the criminals who target crypto users and the security professionals who hunt them down. The cat-and-mouse game plays out in real-time on public blockchain networks, where every transaction tells part of the story.
