Coinbase Hacker Re-enters Market, Buying 4863 ETH After Dumping $69M

The individual responsible for the May 2025 Coinbase breach has begun converting stolen funds into Ethereum, according to data from blockchain transaction monitor Lookonchain. This move follows the multi-million-dollar exploit that compromised select user data and led to significant losses for the crypto exchange.

Analysts tracking the funds have confirmed that the hacker recently acquired 4,863 ETH using $12.5 million in DAI, executing the trade at a rate of $2,569 per ETH. This transaction adds to a growing ETH position tied to the exploit, which investigators linked to insider collusion.

Hacker Converts Stolen Proceeds into Ethereum

Following the recent Ethereum purchase, on-chain analysts report that the hacker now holds approximately $45.36 million in DAI across two separate wallets. These wallets were previously linked to the Coinbase exploit in May, where insiders reportedly collaborated with hackers to siphon customer data. Coinbase stated that less than 1% of user information was compromised but confirmed losses reaching up to $400 million.

Despite the magnitude of the theft, no recovery of funds has been recorded, and attempts to identify or apprehend those responsible have yet to yield results. Instead, the perpetrators continue to move funds through decentralized exchanges, gradually converting assets into Ethereum. Analysts believe the hacker could increase their ETH holdings further, given their consistent accumulation pattern.

Brazen Asset Movements on Decentralized Exchanges

Meanwhile, prior transaction data shows additional activity tied to the same wallets. Approximately six weeks ago, the two addresses sold a combined 17,779 ETH for $45.48 million, with the ETH priced at $2,558 per token at the time. The sale was executed on THORChain, a decentralized exchange that supports native asset trading.

In an unusual twist, the same entity later spent $536,000 in DAI to purchase 207.17 ETH, continuing the trend of ETH movement. The consistent trading pattern suggests strategic shifts between fiat-pegged stablecoins and Ethereum. Analysts monitoring the transactions have confirmed that all movements are still traceable to wallets identified in the original breach.

Coinbase previously confirmed that it had declined a $20 million ransom demand by the hackers, who had offered to keep the exploit private in exchange. The company instead opted to disclose the incident publicly and committed to reimbursing all affected users. The stolen data, while limited in scope, enabled the breach to escalate due to the involvement of insiders.

Whale Activity Shows Contrasting Trends

At the same time, broader Ethereum network data reveals an evolving picture of large holder behavior. According to an on-chain metric known as the Large Holders Netflow, activity among major ETH investors has fluctuated notably in recent months.

In the most recent seven-day period, net inflows rose by 32.01%, signaling a possible short-term return of buying interest. This uptick contrasts sharply with the prevailing downtrend observed over the longer term. Despite this temporary rise, experts warn that inflow data needs consistent follow-up to confirm any shift in sentiment.

The netflows declined by 86.26% in a 30-day window, while the 90-day period leaves a more abrupt trend of 84.62%. This pattern is a sign that heavy investors have considerably decreased their stocks of Ethereum or they might be transferring their holdings out of the system. These numbers indicate decreased rate of institutional activity and can suggest more widespread reluctance or capital-taking attitude within the market.

All this, however, contrasts with the interaction the hacker made and the Ethereum he acquired, drawing attention due to the amount and the dates of the transactions. The relative decrease in institutional inflows and the growing status of the hacker has become one of the key focus areas of (on-chain) analysts.