ZachXBT: Coinbase Commerce contract had a suspicious outflow of $15.9 million in April

ChainCatcher news, according to crypto detective ZachXBT, in April 2024, a Coinbase Commerce contract experienced a suspicious outflow of $15.9 million, indicating that a merchant may have been exploited. Subsequently, an attacker using the alias "Excite" boasted about the stolen funds in a chat. The attacker’s IG account started as a private account and eventually became public, posting multiple videos showcasing expensive watches and monkeys. OSINT indicates they may be in Denmark.

While most of the funds remain dormant, a portion has been transferred to new addresses such as eXch via DEX swaps to obfuscate the source of the funds. Although the identity of the victim in this case remains unknown, there are evidently strong leads to hold the threat actor legally accountable. As the funds were divided in three ways, it is expected that others may also be involved. ZachXBT questioned why Coinbase's AML monitoring did not flag this suspicious activity within 16 hours.