Coinbase Scam Actor Linked to $300M in Reported Losses Sends ETH to Tornado Cash
Key Takeaways
- •On-chain investigator VAL reported that the threat actor converted roughly $500,000 into Ether and sent it to Tornado Cash, following a similar $2 million transfer routed through the mixer three weeks earlier.
- •ZachXBT previously reported cumulative losses exceeding $300 million tied to thefts from several Coinbase accounts linked to the same campaign.
- •The thefts were carried out through social engineering, with scammers impersonating Coinbase customer support to obtain credentials or induce victims to transfer assets, rather than exploiting any smart-contract or blockchain vulnerability.
- •VAL identified two wallets involved in the latest transactions with shortened addresses 0x5Da2…89D8a and 0x3ECe…f296, and tens of millions of dollars reportedly remain in wallets belonging to the attacker.
- •The threat actor previously sent transactions carrying mocking messages to ZachXBT's wallet, while Coinbase warned that its representatives never ask customers for passwords, two-factor authentication codes, or asset transfers.
A threat actor linked to more than $300 million in reported thefts from Coinbase users has moved funds again. On-chain investigator VAL said roughly $500,000 was converted into Ether and transferred to Tornado Cash in the latest transaction.
Investigators have attributed the broader losses to social engineering against individual account holders. They have not described the campaign as a smart-contract exploit.
‼️Threat actor who stole $300M+ from Coinbase users is moving funds again Around $500k was converted to ETH yesterday and sent to Tornado Cash Another $2M was converted to $ETH 3 weeks ago and sent the same way All of it was stolen through social engineering scams from… pic.twitter.com/jC8dz97iL4 — VAL (@osint_based) August 17, 2026
‼️Threat actor who stole $300M+ from Coinbase users is moving funds again Around $500k was converted to ETH yesterday and sent to Tornado Cash Another $2M was converted to $ETH 3 weeks ago and sent the same way All of it was stolen through social engineering scams from… pic.twitter.com/jC8dz97iL4
How Scammers Targeted Coinbase Users
The scammers impersonated Coinbase customer support personnel. They contacted users and tried to take control of their assets through deception.
Victims revealed account credentials to the impersonators in some cases. In other cases, victims transferred cryptocurrency or approved malicious transactions based on false instructions.
In both cases, these methods targeted account holders rather than any vulnerabilities in the blockchain itself. Impersonation scams of this kind are a long-standing industry problem, and U.S. agencies including the FBI and the Federal Trade Commission have repeatedly warned that fraudsters posing as customer support or service representatives are among the most commonly reported crypto-fraud tactics.
Previously, on-chain investigator ZachXBT had reported cumulative losses in excess of $300 million. Those losses were tied to thefts from several Coinbase accounts involved in the operation.
Tens of millions of dollars are still reportedly held in the wallets belonging to the threat actor. The VAL report did not include the total balance of all linked wallets.
Latest Transfers Follow the Same Route
VAL reported that the current operation began with the conversion of nearly $500,000 into ETH, which was then sent to Tornado Cash.
Three weeks earlier, about $2 million was routed through the same path. That sum was also converted into ETH before being moved to Tornado Cash. The transactions indicate that the operator used multiple transfers rather than a single move.
Deposits and withdrawals in Tornado Cash are separated through smart contracts, which makes tracking funds more difficult on the Ethereum blockchain. The protocol does not delete previous blockchain transactions, and money can still be traced until it reaches Tornado Cash deposit contracts.
The mixer has itself been at the center of legal disputes over that function. The U.S. Treasury's Office of Foreign Assets Control sanctioned Tornado Cash in August 2022, citing its use by North Korea's Lazarus Group to launder stolen crypto, and lifted the sanctions in March 2025 after a U.S. appeals court ruled that the protocol's immutable smart contracts are not "property" that can be sanctioned.
In the current report, VAL noted two wallets involved in the transaction. The shortened addresses of those wallets were “0x5Da2…89D8a” and “0x3ECe…f296.”
Actor Mocks ZachXBT as Coinbase Warns Users
The threat actor was previously known to send transactions to ZachXBT’s wallet. Those transactions reportedly carried custom messages mocking the investigator during his tracking.
The messages mocked the efforts made by ZachXBT and VAL in their investigation. No identity for the attacker or location of the remaining funds was given.
ZachXBT tracked the total losses, while VAL reported the latest two transactions. Both investigators linked the activity to the same reported campaign. In past cases of comparable size, a decisive point has often come when mixed funds re-emerge at exchanges or other regulated services, where identity checks have allowed stolen assets to be frozen after investigators shared wallet data with compliance teams.
Coinbase representatives do not ask customers for their passwords, two-factor authentication codes, or requests to transfer assets.
