Coinbase Hacker’s $330M Scam Wallet Scoops $18.9M in Ether as ETH Breaks $4,700

Notorious Coinbase Hacker Wallet Snaps Up $18.9M in Ethereum Amid ETH Bull Run

A cryptocurrency wallet linked to the infamous $300 million Coinbase hack has made headlines again, purchasing 3,976 Ether (ETH) for $18.9 million at $4,756 per token on Saturday, September 13, 2025, according to onchain data from Arkham Intelligence. The purchase, funded with 18.911 million DAI—a stablecoin pegged to the U.S. dollar, trading at $0.9995—underscores the wallet’s continued aggressive accumulation of cryptocurrencies. ETH itself is on the rise, breaking above $4,700 and reaching a two-week high of $4,763.

This activity comes amid heightened scrutiny of the wallet, which was tied to a massive social engineering scam targeting Coinbase users. It also follows a pattern of high-stakes trades that have kept blockchain analysts on edge.

Details of the Latest Purchase

The wallet executed the $18.9 million ETH purchase by consolidating multiple DAI holdings, with individual amounts ranging from $80,000 to $6 million, according to Arkham Intelligence. This strategic aggregation of funds highlights the wallet’s sophisticated approach to managing its illicit gains. The purchase coincided with ETH’s bullish momentum, as the cryptocurrency climbed 4.5% in the past 24 hours to trade at $4,718 as of Sunday, September 14, 2025, at 03:24 AM SAST.

The Coinbase Hack: A $330M+ Social Engineering Scheme

The wallet’s activities have been under close watch since early 2025, when blockchain analysts—including prominent onchain sleuth ZachXBT—linked it to a sprawling social engineering campaign that defrauded Coinbase users of over $330 million. ZachXBT noted in May 2025 that this figure is likely conservative, based solely on reported thefts in his direct messages and onchain discoveries. “The actual amount stolen could be significantly higher,” he said, citing the campaign’s scale and sophistication.

The scam exploited vulnerabilities in user trust, likely through phishing attacks, fake customer support channels, or compromised credentials, siphoning funds from Coinbase accounts. The wallet’s ability to move large sums across multiple cryptocurrencies while evading capture has made it a focal point for both investigators and the crypto community.

A Trail of High-Stakes Trade

The latest $18.9 million ETH purchase is part of a broader pattern of bold trades by the wallet, diversifying across major cryptocurrencies:

• August 2025: Acquired $8 million worth of Solana (SOL) at an average entry price above its current value of $242.85, resulting in an unrealized loss as SOL’s price dipped.

• July 2025: Purchased 4,863 ETH for $12.55 million and an additional 649 ETH for $2.3 million, at an average price of $3,562 per token. These earlier ETH buys are now significantly profitable, given ETH’s current price of $4,718.

These transactions suggest the hacker is actively managing their portfolio, possibly to launder funds, capitalize on market trends, or diversify risk. The wallet’s ability to execute such large trades without immediate regulatory intervention highlights the challenges of tracking illicit crypto flows.

ETH’s Market Context

The hacker’s recent ETH accumulation coincides with a bullish phase for Ethereum. On Saturday, ETH surged past $4,700, peaking at $4,763, driven by broader market optimism and Ethereum network developments. The price has since stabilized at $4,718, reflecting a 4.5% gain over the past day, according to CoinMarketCap data as of September 14, 2025.

Ethereum’s price action may be fueling the wallet’s confidence in ETH as a store of value or a speculative bet. However, these trades carry risk: onchain activity is highly visible, and any attempt to liquidate these holdings could trigger scrutiny or asset freezes by exchanges.

Broader Implications

The Coinbase hacker’s continued activity highlights persistent challenges in the cryptocurrency ecosystem:

• Social Engineering Risks: The $330 million scam underscores user vulnerability to phishing and impersonation attacks, even on reputable platforms.

• Onchain Transparency vs. Anonymity: While blockchain transparency helps analysts track illicit funds, the hacker’s ability to move millions without immediate consequence shows current enforcement limitations.

• Regulatory Scrutiny: High-profile cases like this strengthen calls for stricter crypto regulations, particularly around anti-money laundering (AML) and know-your-customer (KYC) compliance.

Authorities and the crypto community will likely keep a close eye on this wallet’s next moves. Its recent ETH and SOL purchases suggest a strategy of diversifying across major blockchains, possibly to obscure the trail of stolen funds or capitalize on market upside. However, the wallet’s visible onchain activity makes large-scale liquidation or fiat conversion challenging without triggering exchange safeguards.

For users seeking protection, this case serves as a stark reminder to enable two-factor authentication, avoid sharing sensitive information, and verify the legitimacy of any communication claiming to be from a crypto platform.