Coinbase Hacker Trolls Crypto Sleuth ZachXBT After Moving $42M in Bitcoin

The threat actor behind massive thefts from Coinbase users has taken to openly mocking prominent on-chain sleuth ZachXBT, using a public Ethereum transaction as a taunt.

It was first revealed by ZachXBT through a notice on the Telegram channel Investigations.

ZachXBT has identified the threat actor as the same person or group behind the data breach targeting Coinbase users.

"L bozo," the hacker wrote Wednesday evening through an Ethereum transaction using the blockchain's input data message feature.

The message was followed by a link to a YouTube meme video showing NBA legend James Worthy smoking a cigar.

The hacker's message, in slang, was used to mock ZachXBT as a "loser" or someone incompetent taking the "L," which stands for "loss."

Coinbase Says Data Breach Impacting 69,461 Users Occurred in December

Coinbase disclosed that 69,461 of the crypto exchange’s users were affected by a recently unveiled data breach, which took place last year, according to a notice filed with the Maine Attorney General’s Office. Among residents of the Pine Tree State, the San Francisco-based exchange warned that around 217 natives were impacted by the incident. The company said the exploit involved cyber criminals bribing overseas customer support agents to access names, addresses, phone numbers, emails, and gover...

ZachXBT claims the transaction was conducted after the threat actor moved roughly $42.5 million from Bitcoin to Ethereum using Thorchain, a swapping protocol.

Data from Etherscan from the same address, marked as "Fake_Phishing1158790," shows the threat actor moved a separate amount of 8,698 ETH (approximately $22.6 million) an hour after the messages taunting ZachXBT.

The messages come as Coinbase publicly acknowledged last week that over least 69,400 of its users had been exposed to a data breach stemming from December last year. The breach was discovered on May 11 this year, according to a filing to the Maine Attorney General's office.

Prior to the disclosure last week, attackers demanded a $20 million ransom in Bitcoin to prevent the release of information.

Coinbase refused the ransom, instead offering the same amount as a bounty for information leading to the arrest of those responsible.

Decrypt reached out to Coinbase for comment on the implications of the threat actor's taunts to ZachXBT.

The company now faces an estimated financial hit of between $180 million and $400 million due to remediation efforts and potential customer compensation.

ZachXBT previously estimated in February that Coinbase users were losing over $300 million per year to social engineering scams.

Coinbase Data Breach Will ‘Lead to People Dying,’ TechCrunch Founder Says

The founder of online news publication TechCrunch has claimed that Coinbase’s recent data breach “will lead to people dying,” amid a wave of kidnap attempts targeting high-net-worth crypto holders. TechCrunch founder and venture capitalist Michael Arrington added that this should be a point of reflection for regulators to re-think the importance of know-your-customer (KYC), a process that requires users to confirm their identity to a platform. He also called for prison time for executives that f...

Who is ZachXBT?

ZachXBT is known in the crypto community for exposing crypto scams, hacks, and fraudulent schemes.

In 2023, ZachXBT faced a defamation lawsuit, but was swiftly backed by over $1 million in donations from the crypto community, with support from high-profile crypto figures, including Binance founder Changpeng “CZ” Zhao and Tron founder Justin Sun.

Last year, ZachXBT, who uses a pseudonym, was embroiled in another debate on anonymity in crypto circles. Research-driven crypto investment firm Paradigm hired the onchain sleuth as an incident response advisor in February.

Edited by Sebastian Sinclair

Editor's note: This story was corrected after publication to remove a mention that the recently disclosed Coinbase data hack was estimated to result in $300 million in damages. The $300 million figure was a yearly estimate of Coinbase customer losses from social engineering scams from ZachXBT.