Hacker Converts Stolen Funds into Solana
The hacker behind the $400 million Coinbase breach has made another significant move on-chain, swapping $22.95 million worth of DAI into USD Coin before bridging it to the Solana network. According to blockchain analyst Ember CN, the hacker used the converted funds to purchase 100,913 SOL at an average price of $227.
As of October 3, the hacker’s wallet showed a balance of just $0.47 in Solana, indicating that nearly all funds were spent. This is the second major Solana acquisition linked to the attacker, who previously used stolen funds to buy 38,126 SOL a month earlier.
Solana is currently trading at $231, up 3% in the last 24 hours and 10.8% over the past month, though still 21.2% below its all-time high of $293.
Continued Activity from Coinbase Exploiter
The recent transaction marks one of at least five major on-chain movements tied to the attacker since the May 2025 breach. In earlier operations, the hacker swapped $42.5 million in Bitcoin into Ethereum through THORChain and sold 26,347 ETH for 68.18 million DAI at $2,588 each.
In July, the wallet repurchased 5,513 ETH using 14.86 million DAI at $2,696, indicating an ongoing strategy of reallocating stolen funds across multiple assets. The consistent pattern of DAI-to-USDC conversions followed by large Solana purchases suggests the attacker is shifting focus to alternative blockchain ecosystems.
Details of the Coinbase Breach
The May 2025 attack targeted nearly 70,000 Coinbase users through a coordinated social engineering campaign. Hackers reportedly bribed overseas customer support contractors to access sensitive data, including names, birth dates, addresses, masked bank details, and government ID scans.
The breach remains one of the largest in cryptocurrency history, highlighting vulnerabilities in centralized platforms and the growing sophistication of cybercriminals targeting digital asset exchanges.
