The alleged Coinbase hacker from May’s $180-400M breach recently lost nearly $1M trading Ethereum, buying at $4,756 and selling at $4,522 per token within two days.
By Vini Barbosa
Editor Marco T. Lanz
Updated
4 mins read
An account reportedly connected to a black hat individual or group involved in a massive data breach in May 2025—now known as “the Coinbase hacker”—has been actively trading cryptocurrencies, monitored by on-chain analysts. This account’s most recent activity could have resulted in nearly $1 million in losses amid a capitulation event trading Ethereum ETH $4 523 24h volatility: 2.1% Market cap: $545.97 B Vol. 24h: $35.49 B .
The breach from May enabled attackers to trick users into transferring funds, resulting in losses estimated between $180 million and $400 million, according to multiple sources, including CoinDesk.
ZachXBT, a renowned on-chain sleuth, has actively posted about the event on his X account, together with analytics platforms like Arkham Intelligence, which used AI to trace, link, and label different account addresses to the “Coinbase hacker,” including the address 0x15f4c13E0cA461e0ef23F6d35Bbeb5dCE2495879 referenced in this most recent report by Lookonchain.
According to the analyst, the address purchased 3,976 ETH, worth $18.9 million at $4,756 per token on Sept. 13, as reported by Coinspeaker. Two days later, however, on Sept. 15, the alleged “Coinbase hacker” sold this entire stack at a loss for $4,522 per ETH, or $17.98 million total—resulting in a net negative of approximately $932,000.
In the comments, one person asked, “Why is a ‘hacker’ allowed to do trading freely,” questioning the lack of sanctions applied to what is claimed to be a known hacker, fueling skepticism of the label applied by Lookonchain’s analyst.
Byt why a "hacker" is allowed to do trading freely, if he is a "hacker" and you are sure he "is"
— Nabaz (@nabaz120211) September 15, 2025
While there is no direct response in the thread on X, the answer is simple: The address is limiting its activities to decentralized currencies, like ETH and DAI, on decentralized exchanges, like CoW Protocol. These systems are built, among other things, on the premise of being censorship-resistant, which brings many benefits but also has obvious trade-offs, like not being able to apply sanctions to these addresses.
CoW Protocol, also known as CoW Swap, is an intent-based trading protocol similar to NEAR Intents that recently added support to Aptos, as Coinspeaker reported. The protocol allows users to delegate trade execution to “solvers”—competitive algorithms or entities that find and execute the optimal exchange rates across various liquidity sources.
Therefore, the only way to prevent alleged Coinbase hackers from trading is if the money reaches centralized systems or fiat off-ramps. The same logic would apply, for example, to peaceful people suffering political persecution or fleeing from a country in war or under a tyrannical regime.
As far as the decentralized finance environment is concerned, “code is law.” The way to fight such cases is prevention—by writing solid and secure systems that cannot be breached or are built on top of privacy solutions that make sure that, even when a breach occurs, there is nothing of value there to be used by the attackers. It is not by chance that Google searches for “privacy coins” have been growing over time, highlighting a rising interest in the security they offer to users.
As of this writing, ETH is trading at $4,505 per token, 0.37% lower than the “Coinbase hacker” capitulation point. Notably, Ethereum’s native token is testing a 30-day price support at these levels, which could work as a launchpad for an upward movement if the crypto market turns bullish this week following the upcoming Fed’s interest rate decision on Sept. 17—in two days.
ETH daily (1D) price chart against the dollar | Source: TradingView
Losing this support could send the price lower, potentially testing the 50-day exponential moving average, an important technical indicator for cryptocurrencies. ETH has been trading above this indicator for the past four months, since a significant breakout in May 2025, around the same time as the hacker was identified accumulating stolen funds from its victims.
Disclaimer: Coinspeaker is committed to providing unbiased and transparent reporting. This article aims to deliver accurate and timely information but should not be taken as financial or investment advice. Since market conditions can change rapidly, we encourage you to verify information on your own and consult with a professional before making any decisions based on this content.
Vini Barbosa has covered the crypto industry professionally since 2020, summing up to over 10,000 hours of research, writing, and editing related content for media outlets and key industry players. Vini is an active commentator and a heavy user of the technology, truly believing in its revolutionary potential. Topics of interest include blockchain, open-source software, decentralized finance, and real-world utility.
