A hacker linked to the May 2025 Coinbase breach recently moved about $22.95 million in DAI into USDC, which was then transferred to the Solana network.
According to data from blockchain analytics firm Arkham Intelligence, the hacker bought 100,913 SOL tokens at an average price of $227 each on Solana. This marked the hacker’s second major purchase of Solana, following a prior acquisition of 38,126 SOL in August 2025. By 09:24 UTC on October 3, the wallet had been largely emptied, holding just $0.47 worth of SOL.
The wallet has been linked to the theft of more than $300 million from Coinbase users. Over 69,000 users had their data stolen when hackers bribed call center workers in India and tricked users into giving wallet access. Authorities are continuing to investigate the breach to trace the hacker and recover the stolen funds.
Other transactions
Since the breach, the hacker has made several on-chain transactions with Bitcoin, Ethereum, DAI, and Solana.
In May 2025, the hacker converted around $42.5 million in Bitcoin to Ethereum through THORChain. In the same month, they sold 26,347 ETH for 68.18 million DAI, at an average price of $2,588 per Ethereum. Following a two-month period of inactivity, the hacker’s wallet resurfaced on July 7, purchasing 4,863 ETH valued at $12.55 million.
After staying inactive for some time, they resurfaced to move additional DAI into USDC and use it to make large purchases of Solana. The pattern of moving and liquidating assets indicates the intent to cover the source of the assets of malicious intent while still keeping them liquid.
Also Read: Coinbase Re-Enters India with Early Access Amid Regulatory Shifts
