Coinbase Hacker Drops $22.9M on 100K Solana After May Breach

On-chain data shows the Coinbase hacker spent $22.95 million in USDC to buy Solana (SOL), their second big SOL purchase.

Written by: Arslan Butt • Friday, October 3, 2025 • 1 min read

• Last updated: Friday, October 3, 2025

Quick overview

The Coinbase hacker spent $22.95 million in USDC to purchase 100,913 Solana (SOL) after converting DAI to USDC.
This marks the second significant SOL purchase by the hacker, following a previous acquisition of 38,126 SOL a month ago.
The hacker has executed at least five major transactions since the May 2025 breach, which caused $400 million in damages.
The breach affected nearly 70,000 users, with the hacker exploiting customer-support contractors to steal sensitive personal data.

On-chain data shows the Coinbase hacker spent $22.95 million in USDC to buy Solana (SOL), their second big SOL purchase. The funds were first swapped from 22.95 million DAI into USDC, then bridged to Solana. They bought 100,913 SOL at an average price of $227 per coin.

As of Oct 3 09:24 UTC the wallet is almost empty, with only $0.47 worth of SOL left. This is the second time they bought SOL with stolen funds, the first time was a month ago when they bought 38,126 SOL.

Solana is up 3% in the last 24 hours, currently trading at $231. It’s up 10.8% in the last month but still 21.2% below all time high of $293.

Past Transactions and Stolen Funds Overview

The hacker has made at least 5 big on-chain transactions since the May 2025 breach which reportedly caused $400 million in damages. Here are the key movements:

May 2025: $42.5M in Bitcoin converted to Ethereum via THORChain.
Same month: Sold 26,347 ETH for 68.18 million DAI at $2,588 per ETH.
July 2025: Bought 5,513 ETH for 14.86 million DAI at $2,696 per ETH.

After a period of inactivity the hacker started converting DAI to USDC to buy large Solana stakes, this is a systematic liquidation.

Details of the May 2025 Coinbase Breach

The breach affected almost 70,000 users, the hacker exploited overseas customer-support contractors to steal user records from Dec 2024 to May 2025.

Compromised data included:

Full names and dates of birth
Addresses and phone numbers
Masked bank account details
Scans of government-issued IDs

This social-engineering attack allowed the hacker to extract personal and financial data and then convert stolen crypto into various assets including Solana in a structured pattern over months.

Check out our free forex signals
Follow the top economic events on FX Leaders economic calendar
Trade better, discover more Forex Trading Strategies
Open a FREE Trading Account

ABOUT THE AUTHOR See More

Arslan Butt

Lead Markets Analyst – Multi-Asset (FX, Commodities, Crypto)

Arslan Butt serves as the Lead Commodities and Indices Analyst, bringing a wealth of expertise to the field. With an MBA in Behavioral Finance and active progress towards a Ph.D., Arslan possesses a deep understanding of market dynamics. His professional journey includes a significant role as a senior analyst at a leading brokerage firm, complementing his extensive experience as a market analyst and day trader. Adept in educating others, Arslan has a commendable track record as an instructor and public speaker. His incisive analyses, particularly within the realms of cryptocurrency and forex markets, are showcased across esteemed financial publications such as ForexCrunch, InsideBitcoins, and EconomyWatch, solidifying his reputation in the financial community.