Coinbase hacker trolls ZachXBT onchain after $42.5M THORChain swap

The hacker behind the data breach targeting Coinbase users mocked blockchain investigator ZachXBT with an onchain message following a major crypto swap.
On May 21, the hacker used Ethereum transaction input data to write “L bozo,” followed by a meme video of NBA player James Worthy smoking a cigar.
The message came after the attacker swapped about $42.5 million from Bitcoin (BTC) to Ether (ETH) via THORChain.
ZachXBT flagged the message on his Telegram channel, linking it to the same entity responsible for the Coinbase data breach affecting at least 69,400 users.
On May 22, blockchain security firm PeckShield reported that the hacker had continued to move funds, swapping 8,697 ETH for 22 million Dai (DAI). A separate but closely linked address, which received 9,081 ETH via THORChain, also converted the assets into 23 million DAI.
Related: DOJ is investigating Coinbase data breach— Report
Coinbase hit with lawsuits after breach
The Coinbase breach, first reported in a filing with the Maine Attorney General’s office, occurred in December 2024 and was discovered on May 11. The stolen data includes names, home addresses and other personal information.
Following the disclosure, the attackers demanded a $20 million ransom in Bitcoin to prevent the release of the stolen data. Coinbase refused and instead offered a $20 million bounty for information leading to the identification of the hackers.
The company estimates a potential financial impact between $180 million and $400 million due to remediation costs and customer compensation.
Coinbase has also faced a wave of lawsuits following the revelation. At least six legal complaints were filed on May 15 and 16, with plaintiffs accusing the exchange of failing to implement adequate security measures and mishandling its response to the breach.
Related: Coinbase data leak could put users in physical danger: TechCrunch founder
THORChain under scrutiny for criminal use
The Coinbase hacker’s use of THORChain to swap $42.5 million worth of Bitcoin into Ether comes as the protocol faces growing scrutiny over its role in facilitating illicit transactions.
In March, the platform came under fire after its swap volume surged following the $1.4 billion Bybit hack. The protocol generated over $5 million in revenue after processing $5.4 billion in swap volume, with over $1 billion moved in a single day.
Blockchain security firms identified North Korea’s Lazarus Group as the main suspect, using THORChain to launder a significant portion of the stolen funds.
The controversy intensified when a THORChain developer, known as “Pluto,” resigned after a vote to block transactions linked to Lazarus was overturned.
Magazine: TradFi is building Ethereum L2s to tokenize trillions in RWAs: Inside story
Bitcoin (BTC) $ 118,156.00
Ethereum (ETH) $ 3,788.25
XRP (XRP) $ 3.13
Tether (USDT) $ 0.999908
BNB (BNB) $ 833.70
Solana (SOL) $ 183.59
USDC (USDC) $ 0.999708
Dogecoin (DOGE) $ 0.226625
Lido Staked Ether (STETH) $ 3,782.64
TRON (TRX) $ 0.323532
Cardano (ADA) $ 0.794530
Wrapped stETH (WSTETH) $ 4,576.96
Wrapped Bitcoin (WBTC) $ 117,716.00
Hyperliquid (HYPE) $ 43.98
Sui (SUI) $ 3.95
Stellar (XLM) $ 0.420167
Chainlink (LINK) $ 18.17
Wrapped Beacon ETH (WBETH) $ 4,071.30
Bitcoin Cash (BCH) $ 582.90
Hedera (HBAR) $ 0.269696
Wrapped eETH (WEETH) $ 4,058.56
Avalanche (AVAX) $ 24.98
WETH (WETH) $ 3,788.49
Litecoin (LTC) $ 109.23
LEO Token (LEO) $ 8.97
Toncoin (TON) $ 3.24
Shiba Inu (SHIB) $ 0.000013
Ethena USDe (USDE) $ 1.00
USDS (USDS) $ 0.999516
Binance Bridged USDT (BNB Smart Chain) (BSC-USD) $ 1.00
WhiteBIT Coin (WBT) $ 44.15
Coinbase Wrapped BTC (CBBTC) $ 118,149.00
Uniswap (UNI) $ 10.49
Polkadot (DOT) $ 3.98
Monero (XMR) $ 319.53
Bitget Token (BGB) $ 4.57
Pepe (PEPE) $ 0.000012
Cronos (CRO) $ 0.139359
Aave (AAVE) $ 289.41
Ethena Staked USDe (SUSDE) $ 1.19
Ethena (ENA) $ 0.620015
Bittensor (TAO) $ 403.03
Dai (DAI) $ 1.00
Pi Network (PI) $ 0.440130
NEAR Protocol (NEAR) $ 2.73
Ethereum Classic (ETC) $ 21.94
Ondo (ONDO) $ 0.990497
Internet Computer (ICP) $ 5.55
Jito Staked SOL (JITOSOL) $ 223.78
OKB (OKB) $ 48.58
Aptos (APT) $ 4.66
Mantle (MNT) $ 0.791411
Kaspa (KAS) $ 0.097409
Pudgy Penguins (PENGU) $ 0.040606
Bonk (BONK) $ 0.000032
BlackRock USD Institutional Digital Liquidity Fund (BUIDL) $ 1.00
Binance-Peg WETH (WETH) $ 3,791.93
Algorand (ALGO) $ 0.263541
Arbitrum (ARB) $ 0.432099
USD1 (USD1) $ 1.00
Gate (GT) $ 17.94
Cosmos Hub (ATOM) $ 4.62
VeChain (VET) $ 0.024679
Render (RENDER) $ 4.07
POL (ex-MATIC) (POL) $ 0.227406
Worldcoin (WLD) $ 1.12
Fasttoken (FTN) $ 4.58
SPX6900 (SPX) $ 2.08
Official Trump (TRUMP) $ 9.66
Sky (SKY) $ 0.090568
Artificial Superintelligence Alliance (FET) $ 0.723287
Sei (SEI) $ 0.320774
Binance Staked SOL (BNSOL) $ 195.69
Rocket Pool ETH (RETH) $ 4,313.45
Filecoin (FIL) $ 2.61
Flare (FLR) $ 0.024359
Kelp DAO Restaked ETH (RSETH) $ 3,973.43
Lombard Staked BTC (LBTC) $ 118,028.00
sUSDS (SUSDS) $ 1.06
Jupiter (JUP) $ 0.547063
Story (IP) $ 5.57
Jupiter Perpetuals Liquidity Provider Token (JLP) $ 5.07
KuCoin (KCS) $ 11.50
XDC Network (XDC) $ 0.089480
USDtb (USDTB) $ 0.999623
StakeWise Staked ETH (OSETH) $ 3,982.62
Injective (INJ) $ 14.46
Mantle Staked Ether (METH) $ 4,054.51
Curve DAO (CRV) $ 1.01
Celestia (TIA) $ 1.90
Liquid Staked ETH (LSETH) $ 4,090.87
First Digital USD (FDUSD) $ 0.998591
USDT0 (USDT0) $ 1.00
NEXO (NEXO) $ 1.32
Optimism (OP) $ 0.741236
Renzo Restaked ETH (EZETH) $ 3,993.08
Stacks (STX) $ 0.787770
Polygon Bridged USDT (Polygon) (USDT) $ 0.999759
Falcon USD (USDF) $ 0.999227
FLOKI (FLOKI) $ 0.000121