Crypto sleuth ZachXBT revealed that the hacker accused of stealing Coinbase customer data left him a taunting message on-chain after swapping $42.5 million worth of BTC for ETH on THORChain.
In a broadcast message sent to his Investigations Telegram channel, on-chain investigator ZachXBT claimed to have received a message sent from a hacker accused of swindling more than $300 million worth of crypto assets from users. The message was sent to his on-chain Ethereum (ETH) account.
“The threat actor who stole $300M+ from Coinbase users by paying customer support just began trolling me on-chain with this message,” said ZachXBT in his Telegram message.
The message was sent from an address simply named Fake_Phishing1158790 and contained the words “L bozo” and what appeared to be a link to a YouTube video showing the viral internet short clip of former NBA athlete James Worthy smoking a cigar after a Lakers win.
“Smoking that ZachXBT pack,” one user commented under the YouTube video, indicating they were led to the video after seeing the on-chain message addressed to the crypto sleuth.
The message was linked to the alleged hacker’s recent on-chain transaction, which consisted of swapping $42.5 million worth of BTC (BTC) for ETH via THORChain.
The Coinbase user data exploit was first disclosed by the exchange on May 15. The hacker was believed to have bribed customer support staff to steal sensitive user data.
According to Coinbase, the attacker was able to get ahold of phone names, addresses, phone numbers, government-issued IDs, and other account data. The exchange claimed that the exploit only affected less than 1% of users.
After firing the customer service workers involved, the company estimated the breach could cost up to $400 million to resolve. The attackers had asked for a $20 million ransom from the crypto exchange. Coinbase refused to pay the $20 million ransom and is offering a bounty for anyone who can track down the attacker.