On August 24, the attacker bought 38,126 SOL, worth about $7.95 million, at an average price of $209, according to on-chain data retrieved by Finbold from Arkham Intel.
This follows earlier activity on July 20, when the same wallet added 649.62 ETH valued at $2.31 million at $3,561 each. The transactions suggest a strategy of diversifying into major blockchain ecosystems while moving funds through decentralized exchanges and aggregators.
The purchases trace back to one of Coinbase’s notable security incidents in early 2025, when cybercriminals bribed overseas support agents to access internal systems.
Insights into the breach indicate that the incident exposed sensitive customer data, though not passwords or private keys, and was later exploited for fraud and extortion attempts.
On May 11, the hackers demanded $20 million to keep the stolen data private. Notably, Coinbase refused, instead tightening security, terminating compromised staff, and offering a $20 million bounty for leads. The exchange also pledged to reimburse victims, with total costs expected between $180 million and $400 million.
Despite the ongoing investigation, the hacker has continued to move and accumulate assets. Earlier this year, they swapped $42.5 million worth of Bitcoin (BTC) into Ethereum (ETH) via Thorchain, even taunting investigators with on-chain messages.
The latest Solana purchase suggests that the attacker is still actively managing the stolen funds, signaling long-term bets on leading networks while evading detection.
