Hacker Behind $300M Coinbase Heist Invests $18.9M in ETH

In a striking display of confidence, a hacker involved in the $300 million Coinbase theft has resurfaced in the market, investing $18.9 million of the stolen funds in Ethereum. This move suggests that the hacker is attempting to mimic an everyday investor during Ethereum’s recent price surge. 

Blockchain analysts Lookonchain have reported this trade earlier today, raising concerns about how hackers are blending into regular markets.

Hacker Shifts From Breach to Bullish Bets

In May 2025, hackers stole data from Coinbase by bribing customer support workers. This breach affected nearly 97,000 users, resulting in scams that led to losses of over $300 million in cryptocurrencies. Investigator ZachXBT tracked the hacker, who taunted authorities with mock messages in blockchain transactions. 

Using some of the stolen money, the hacker started trading like an ordinary investor. On-chain data indicates that swaps of stolen Bitcoin into Ethereum are taking place on exchanges like THORChain. One instance involved the hacker buying 4,863 ETH for approximately $12.55 million, at a price of $2,581 each. 

At another instance, the hacker purchased 649 ETH for $2.31 million at $3,561 each. Together, these trades totaled $18.9 million. The hacker converted these funds into stablecoins, such as DAI, before reinvesting. These strategies suggest the hacker is planning for the long term, not just seeking quick profits.

Ethereum’s Surge Woos Hacker’s Gamble

Since July 2025, the hacker has increased trading activity, completing at least five major Ethereum purchases after a two-month break. This suggests that the hacker is gaining confidence in Ethereum’s future. Ethereum rose by 4.29% within 24 hours, currently priced at over $4,700 with a market cap of $569.7 billion. The data, per CoinMarketCap, may have encouraged the hacker to continue investing.

Meanwhile, the crypto market has witnessed an increasing trend of hackers using stolen funds to trade like regular investors. For example, following the October 2024 Radiant Capital exploit, hackers bridged the stolen cryptocurrency from Arbitrum and BNB Chain to Ethereum, moving approximately 20,500 ETH worth around $52 million.

While regulators and Blockchain analysts work frantically to mitigate this trend, hackers have often devised other means to outsmart inexperienced users. This indicates that cryptocurrencies are utilized for both illicit activities and legitimate businesses.