Coinbase hacker spent stolen funds on 100k Solana

On-chain analysis shows that the Coinbase hacker spent $22.95 million worth of USD Coin and spent it on Solana. This marks the second major SOL purchase made by the hacker.

According to on-chain analyst Ember CN, the hacker swapped around 22.95 million DAI into USDC only a few hours before bridging the funds. Not long after, the hacker bridged the 22.95 million USDC to the Solana network to purchase 100,913 SOL at an average price of $227.

As of Oct. 3 on 09:24 UTC, the hacker had emptied out most of their holdings on the wallet address, leaving only $0.47 worth of Solana (SOL).

This marks the largest SOL purchase made by the hacker allegedly responsible for draining up to $400 million from a cyberattack that occurred in May 2025. Just a month prior, the hacker also swapped DAI (DAI) for USDC before using the stolen funds to purchase 38,126 Solana.

At press time, Solana is trading at $231 after rising by 3% in the past 24 hours. In the past month, SOL has been on an upward trend, having risen by 10.8%. However, it is still standing below its all-time high at $293 by 21.2%.

Coinbase hacker moves stolen funds from May cyberattack

So far, the Coinbase hacker has made at least five transactions on-chain since robbing the major crypto exchange of at least $400 million in damages. In May 2025, the hacker swapped about $42.5 million from Bitcoin (BTC) into ETH (ETH) via THORChain. Within the same month, the hacker sold 26,347 Ethereum for 68.18 million DAI. The sale was done at a price of $2,588.

Later in July, the hacker repurchased 5,513 ETH by spending 14.86 million DAI at $2,696. After a period of dormancy, the hacker appeared to use more DAI converted into USDC to buy chunks of large Solana purchases, much like the most recent one.

The May 2025 breach on Coinbase reportedly impacted nearly 70,000 users as the hacker deployed coordinated social-engineering on the attack.

To carry out the cyberattack, hackers had bribed overseas customer-support contractors to extract user records between December 2024 and May 2025. The attack compromised personal data, including full names, dates of birth, addresses, phone numbers, masked bank account numbers, and government-issued ID scans.