The threat actor behind massive thefts from Coinbase users has taken to openly mocking prominent on-chain sleuth ZachXBT, using a public Ethereum transaction as a taunt.
It was first revealed by ZachXBT through a notice on the Telegram channel Investigations. ZachXBT has identified the threat actor as the same person or group behind the data breach targeting Coinbase users. “L bozo,” the hacker wrote Wednesday evening through an Ethereum transaction using the blockchain’s input data message feature. The message was followed by a link to a YouTube meme video showing NBA legend James Worthy smoking a cigar. The hacker’s message, in slang, was used to mock ZachXBT as a “loser” or someone incompetent taking the “L,” which stands for “loss.”
ZachXBT claims the transaction was conducted after the threat actor moved roughly $42.5 million from Bitcoin to Ethereum using Thorchain, a swapping protocol. Data from Etherscan from the same address, marked as “Fake_Phishing1158790,” shows the threat actor moved a separate amount of 8,698 ETH (approximately $22.6 million) an hour after the messages taunting ZachXBT. The messages come as Coinbase publicly acknowledged last week that over at least 69,400 of its users had been exposed to a data breach stemming from December last year. The breach was discovered on May 11 this year, according to a filing to the Maine Attorney General’s office. Prior to the disclosure last week, attackers demanded a $20 million ransom in Bitcoin to prevent the release of information. Coinbase refused the ransom, instead offering the same amount as a bounty for information leading to the arrest of those responsible. Decrypt reached out to Coinbase for comment on the implications of the threat actor’s taunts to ZachXBT. The company now faces an estimated financial hit of between $180 million and $400 million due to remediation efforts and potential customer compensation.
ZachXBT previously estimated in February that Coinbase users were losing over $300 million per year to social engineering scams.
Who is ZachXBT?
ZachXBT is known in the crypto community for exposing crypto scams, hacks, and fraudulent schemes. In 2023, ZachXBT faced a defamation lawsuit, but was swiftly backed by over $1 million in donations from the crypto community, with support from high-profile crypto figures, including Binance founder Changpeng “CZ” Zhao and Tron founder Justin Sun. Last year, ZachXBT, who uses a pseudonym, was embroiled in another debate on anonymity in crypto circles. Research-driven crypto investment firm Paradigm hired the on-chain sleuth as an incident response advisor in February.
Edited by Sebastian Sinclair
Editor’s note: This story was corrected after publication to remove a mention that the recently disclosed Coinbase data hack was estimated to result in $300 million in damages. The $300 million figure was a yearly estimate of Coinbase customer losses from social engineering scams from ZachXBT.