On-chain analyst tracks $29.3M USDC withdrawal from Coinbase likely involving hacked/phished funds being laundered through stablecoin swaps into privacy coin.
Security & Exploits ·
An on-chain analyst tracked a withdrawal of $29.3M USDC from Coinbase that appeared consistent with compromised funds being moved through multiple stablecoin conversions. The activity began three days ago when the funds were swapped into DAI, followed by a series of trades back into USDC and then into XMR, a privacy-focused cryptocurrency, via Wagyu across multiple wallet addresses.
Between 17 and 4 hours before the observation, the actor purchased approximately $23M in XMR, which the analyst noted corresponded with a price increase of nearly 15% for that asset. The remaining holdings showed roughly $4M in DAI still held on-chain, while XMR acquisitions had paused at the time of reporting.
The sequence suggests an attempt to obscure the origin and movement of the funds through multiple conversions and privacy infrastructure, though confirmation of whether the initial funds were genuinely obtained through a breach or phishing attack remains unverified. The analyst's assessment that the activity pattern indicates likely compromised funds is based on the conversion sequence itself rather than independent verification of the source.