What to know:
- An actor tied to over $300M in Coinbase user thefts moved $500K in ETH to Tornado Cash.
- Scammers posed as Coinbase support to steal credentials and prompt malicious transfers.
- A $2M transfer reached Tornado Cash three weeks earlier, while more than $10M reportedly remained.
A threat actor linked to more than $300 million in reported thefts from Coinbase users has moved funds again. On-chain investigator VAL said roughly $500,000 was converted into Ether and transferred to Tornado Cash in the latest transaction.
Investigators have attributed the broader losses to social engineering against individual account holders. They have not described the campaign as a smart-contract exploit.
How Scammers Targeted Coinbase Users
The scammers impersonated Coinbase customer support personnel. They would contact the users and try to take control of their assets through deception.
Also Read: Coinbase Halts cbETH Transfers on Three Networks After Aug 17
Victims revealed account credentials to the impersonators in some cases. Other victims transferred cryptocurrency or malicious transactions based on false instructions.
In both cases, these techniques were used to target account holders and not any vulnerabilities in the blockchain itself.
Previously, on-chain investigator ZachXBT had reported cumulative losses in excess of $300 million. These losses were related to thefts from several Coinbase accounts involved in the operation.
Tens of millions of dollars are still reportedly held in the wallets belonging to the threat actor. The VAL report did not contain the total balance of all the linked wallets.
Latest Transfers Follow the Same Route
VAL reported that the current operation started with the conversion of nearly $500,000 into ETH, which was sent further to Tornado Cash.
Three weeks ago, around $2 million were routed through this route. The operator had converted this sum into ETH before moving it to Tornado Cash. It shows that the operator used different transactions for moving funds instead of one transfer.
Deposits and withdrawals in Tornado Cash are separated via smart contracts. Thus, tracking the movement of money becomes difficult on the Ethereum blockchain.
The protocol does not delete the previous blockchain transactions. It is possible to trace money until they are transferred to the deposit contracts of Tornado Cash.
In the current report, VAL noted two wallets involved in the transaction. The shortened addresses of these wallets were “0x5Da2…89D8a” and “0x3ECe…f296.”
Actor Mocks ZachXBT as Coinbase Warns Users
This threat actor was known to be sending transactions to the wallet of ZachXBT. It is said that these transactions carried custom messages that were mocking the investigator at the time of his tracking.
These messages mocked the efforts made by ZachXBT and VAL in their investigation. There was no mention of the identity of the attacker or the location of the remainder of the funds.
ZachXBT used to monitor the total loss, whereas VAL used to report the last two transactions. Both investigators connected this to the same reported campaign.
It is said that the representatives of Coinbase never ask customers about their passwords, two-factor authentication codes, or even the transfer of assets.
Also Read: Crypto Whale Wallet Loses $25.6M in Another Major Phishing Attack
Be the first to comment