- ZachXBT is a pseudonymous blockchain investigator renowned for his independent efforts in uncovering cryptocurrency scams, frauds, and thefts.
- The hacker embedded a mocking message on the THORChain network.
- THORChain is a Layer 1 blockchain built specifically to function as a decentralized cross-chain liquidity protocol.
The hacker behind the recent Coinbase data breach has resurfaced, mocking blockchain investigator ZachXBT after moving millions in crypto using the THORChain protocol.
The hacker reportedly swapped approximately $42.5 million in Bitcoin for Ethereum via THORChain on May 21,2025 before embedding an onchain message to ZachXBT.
The message, reading “L bozo,” included a meme video of NBA legend James Worthy smoking a cigar, an apparent gesture of mockery aimed at the prominent crypto investigator.
ZachXBT, who has been tracking the hacker’s movements, flagged the onchain taunt on his Telegram channel, linking the activity to the same entity responsible for breaching Coinbase data systems in December 2024.
The breach, disclosed on May 11, exposed personal data of at least 69,400 Coinbase users, including names and home addresses.
Further blockchain analysis by PeckShield on May 22 revealed the hacker had continued moving the funds, swapping 8,697 ETH for roughly $22 million in DAI.
Legal fall of Coinbase
Coinbase has experienced swift and severe fallout from the
December breach.
Maine Attorney General’s Office reports the hackers demanded a $20 million Bitcoin ransom, which Coinbase refused, opting instead to offer a $20 million bounty for information leading to the attackers’ identification.
Coinbase now estimates the breach could cost between $180 million and $400 million, factoring in remediation efforts and customer compensation.
The breach has also triggered a wave of litigation, accusing the crypto exchange of negligence in its cybersecurity measures and mishandling its post-breach response.