Wallet tied to Coinbase phishing campaigns launders funds, taunts ZachXBT after $42.5M Thorchain swap

A wallet labeled “Fake_Phishing1158790” on Etherscan swapped $42.5 million worth of bitcoin for ether using the decentralized liquidity protocol Thorchain, in what may be an attempt to launder stolen funds.

In a taunting twist, the wallet also sent an onchain message to blockchain investigator ZachXBT, reading simply: “L bozo.” The text included a YouTube link to a clip of NBA Hall of Famer James Worthy, likely to mock the onchain sleuth.

ZachXBT has linked the wallet’s owner to large-scale phishing campaigns targeting Coinbase users. In a March Telegram post, he claimed the group stole over $65 million between December 2024 and January 2025 by posing as customer support agents — part of an estimated $300 million annual theft from Coinbase customers.

This week, Coinbase disclosed that nearly 70,000 users were affected by a data breach from last December. A U.S. Securities and Exchange Commission filing said some former employees abused internal privileges and exposed customer information to scammers for cash bribes. Passwords and wallet keys were not leaked in the incident, but the threat actors received sensitive KYC details, Coinbase wrote.

People who claimed to control the stolen data threatened to publish the files online and demanded a $20 million ransom. Coinbase denied the request and put out a $20 million bounty to track the culprits.

The crypto exchange has not confirmed whether the breach is connected to the phishing scheme outlined by ZachXBT. However, Coinbase expects it could spend between $180 million and $400 million on remediation and reimbursements related to the breach.