Coinbase hacker moves $8M to Solana amid crypto losses

A wallet address flagged by blockchain security firms as the Coinbase hacker wallet has resurfaced with new trades. On Sunday, the wallet converted DAI into USDC, bridged to the Solana network, and spent $8 million acquiring 38,126 SOL tokens at prices close to $209, according to blockchain analytics firm Lookonchain.

At the time of purchase, Solana was trading higher than its current price of $202.15, leaving the hacker with an immediate paper loss. The Coinbase hacker wallet has now become a focal point for on-chain investigators as they monitor how illicit funds are being moved and traded across multiple networks.

“This type of behavior shows that stolen assets are not just sitting idle but are actively being recycled into different markets,” — ZachXBT, independent blockchain investigator.

Links to July Ether purchases

This is not the first time the Coinbase hacker wallet has been spotted executing large trades. In July, Lookonchain reported that the same address sold 26,762 Ether, worth more than $69 million at the time. Later that month, the wallet purchased two additional tranches of Ether: 4,863 ETH valued at $12.55 million on July 7, followed by 649 ETH worth $2.3 million on July 19 at an average price of $3,562 per token.

Blockchain analytics platform Arkham has tagged the address as the Coinbase hacker wallet, linking it to the theft of over $300 million in user assets. Industry researcher ZachXBT previously estimated that around $330 million had been drained from Coinbase users through advanced social engineering scams, underscoring the growing scale of fraud in the crypto sector.

“The sophistication of these scams means even experienced investors are at risk,” — ZachXBT, in May commentary on the exploit.

Radiant Capital hacker grows illicit profits

The Coinbase hacker wallet is not the only one trading stolen funds. Last week, Lookonchain tracked another malicious actor connected to the $58 million Radiant Capital exploit, a cross-chain lending protocol breach that occurred in October 2024.

That wallet bought 4,913 ETH midweek before selling 4,131 ETH days later, pocketing $2.7 million in profit. The attacker’s original $49.5 million haul has since grown to more than $105 million in Ether holdings, nearly doubling through aggressive trading.

Lookonchain noted: “Their stolen $49.5M stash has now grown to over $105 million,” highlighting how illicit actors are turning breaches into long-term windfalls. The episode raises further concerns for investors who fear stolen tokens circulating on exchanges could impact market stability.

Not all hacker trades succeed

While the Coinbase hacker wallet and the Radiant Capital attacker have managed to sustain large holdings, other hackers have struggled with market timing. In July, Lookonchain observed a wallet suspected of being linked to another hack panic-selling 12,282 ETH, only to repurchase later at a higher price, resulting in a $6.9 million loss.

The same address panic-sold 4,958 ETH on August 15, securing a $9.75 million profit, but analysts believe these trades reflect erratic attempts at laundering rather than calculated strategies. “Hackers are not good at trading,” Lookonchain commented in its analysis, suggesting that many illicit actors lack the discipline of institutional investors.

Implications for crypto investors

For crypto investors, the movements of the Coinbase hacker wallet illustrate the complexity of tracking stolen assets across decentralized ecosystems. The wallet remains one of the most scrutinized on-chain addresses, with its trades often analyzed for signs of laundering or broader market manipulation.

With over $300 million still unaccounted for, experts warn that persistent activity from the Coinbase hacker wallet could continue to ripple through the market, especially as it cycles between major assets like Ether and Solana.

“Large illicit wallets moving millions of dollars can distort liquidity in specific tokens,” said an anonymous analyst at a major exchange. “This is why regulators and investors alike are watching these trades closely.”

As regulatory scrutiny increases, the behavior of the Coinbase hacker wallet will likely remain a litmus test for how illicit capital interacts with legitimate crypto markets.