Coinbase Users Stolen Funds Move Again as Threat Actor Continues to Troll and Loot

The latest development in the ongoing saga of stolen funds from Coinbase users has come to light, with onchain investigator VAL reporting that a significant amount of money is being moved again. This comes after another large stash was reportedly sent through Tornado Cash three weeks ago. The total loss for Coinbase users now exceeds $300 million, according to previous tracking by onchain investigators, including ZachXBT.

The stolen funds were the result of an extensive social engineering campaign targeting individual Coinbase users, with scammers impersonating customer support to trick victims into revealing credentials or approving malicious transactions. This is not a smart contract exploit, but rather a sophisticated attack that has left millions of dollars in associated wallets untouched.

VAL's latest update indicates that around $500K was converted into ETH before being sent to Tornado Cash yesterday, while another separate transaction of conversion worth $2 million happened three weeks earlier and followed the same route. The movement is notable because it shows the threat actor is actively moving portions of the stolen funds.