A significant transaction has drawn attention within the cryptocurrency community as a wallet linked to a notorious hacker associated with Coinbase purchased nearly $18.9 million worth of Ether. The purchase, made on September 13, 2025, involved 3,976 ETH, with each token priced at $4,756. The details of the transaction were revealed through on-chain data shared by Arkham Intelligence.
The hacker executed the transaction using 18.911 million DAI, a stablecoin, and methodically acquired the funds in batches, ranging from $80,000 to $6 million. This meticulous consolidation of assets has sparked the interest of blockchain analysts, given its strategic nature.
This particular wallet has been under scrutiny since early 2025 due to its connections to a significant social engineering fraud that allegedly defrauded Coinbase users of over $300 million. The scam involved manipulative tactics aimed at extracting sensitive information from users, resulting in considerable financial losses for many customers.
Post-breach, the hacker has employed various tactics to move the stolen funds cautiously, and this recent purchase of ETH suggests a potential shift in strategy. Rather than maintaining the funds in stablecoins like DAI, the hacker appears to be leveraging Ethereum’s rising price. By utilizing DAI, the hacker may be attempting to sidestep the volatility often associated with other cryptocurrencies.
This year alone has witnessed several high-profile crypto hacks, including a staggering $550 million theft linked to the BNB Bridge exploit. Blockchain tracking firms, particularly Arkham Intelligence, have been vital in monitoring stolen assets across various networks, providing insights into hacker behaviors for both law enforcement and the public.
The timing of the ETH purchase coincides with Ethereum’s recent price surge, reaching $4,718, potentially influencing the hacker’s decision to invest in ETH at this juncture. Historical patterns show that cybercriminals often opt to convert stolen assets into more liquid or widely accepted currencies during bullish market trends. The consolidation strategy employed in this instance mirrors past hacking incidents, where stolen tokens were pooled and redistributed.
Coinbase has yet to issue a detailed statement regarding the hack. In January 2025, reports surfaced on Reddit from users claiming to have lost funds due to hacking incidents, prompting an investigation into the matter. However, comprehensive details about the breach remain sparse.
Furthermore, enhancements to Ethereum’s network, including EIP-1559, have streamlined transaction tracking, aiding authorities and specialists in tracing illicit funds more effectively. On the day of the transaction, the global cryptocurrency market witnessed a trading volume of $42.9 billion within 24 hours, a volume that could potentially provide cover for hackers moving funds.
Authorities are collaborating with blockchain experts to monitor the hacker’s movements, and historical recoveries, such as the retrieval of $4.3 million in 2023, provide a glimmer of hope for future asset recovery. The crypto community remains vigilant as investigations into this high-profile case continue to unfold.
