Crypto investigator ZachXBT revealed that the hacker suspected of stealing Coinbase customer data left him a mocking message on-chain after converting $42.5 million worth of Bitcoin into Ethereum via THORChain.
In a post on his Investigations Telegram channel, ZachXBT shared that the message came from the alleged culprit behind a crypto theft exceeding $300 million from users. The taunting note was sent directly to ZachXBT’s Ethereum address.
“The threat actor who stole over $300 million from Coinbase users by bribing customer support has started trolling me on-chain with this message,” ZachXBT wrote.
The message originated from an address labeled Fake_Phishing1158790 and included the phrase “L bozo,” alongside a link to a viral YouTube clip featuring former NBA player James Worthy smoking a cigar following a Lakers victory.
One viewer commented under the video, “Smoking that ZachXBT pack,” showing that the on-chain message successfully directed people to the clip and referenced the crypto investigator.
The taunting message was tied to the hacker’s recent on-chain activity, which involved swapping $42.5 million worth of Bitcoin for Ethereum through THORChain.
Coinbase first disclosed the user data breach on May 15, revealing that the hacker allegedly bribed customer support staff to gain access to sensitive user information.
Coinbase reported that the attacker accessed names, addresses, phone numbers, government IDs, and other account details.The company stated that fewer than 1% of its users were impacted by the exploit.
Following the incident, Coinbase terminated the involved customer service employees and estimated the total cost to resolve the breach could reach $400 million. The attackers had demanded a $20 million ransom, which Coinbase refused to pay. Instead, the exchange is now offering a bounty to anyone who can help identify and apprehend the hacker.
