Key Notes
The hacker purchased 3,976 ETH worth $18.9M on Sept 13 but sold at a $932K loss two days later during market decline.
Decentralized exchanges like CoW Protocol enable unrestricted trading as they operate on censorship-resistant blockchain networks.
Ethereum currently tests crucial $4,505 support levels ahead of the Federal Reserve's interest rate decision on September 17.
An account reportedly connected to a black hat individual or group involved in a massive data breach in May 2025—now known as “the Coinbase hacker”—has been actively trading cryptocurrencies, monitored by on-chain analysts. This account’s most recent activity could have resulted in nearly $1 million in losses amid a capitulation event trading .
The breach from May enabled attackers to trick users into transferring funds, resulting in losses estimated between $180 million and $400 million, according to multiple sources, including CoinDesk.
ZachXBT, a renowned on-chain sleuth, has actively posted about the event on his X account, together with analytics platforms like Arkham Intelligence, which used AI to trace, link, and label different account addresses to the “Coinbase hacker,” including the address 0x15f4c13E0cA461e0ef23F6d35Bbeb5dCE2495879 referenced in this most recent report by Lookonchain.
According to the analyst, the address purchased 3,976 ETH, worth $18.9 million at $4,756 per token on Sept. 13, as reported by Coinspeaker. Two days later, however, on Sept. 15, the alleged “Coinbase hacker” sold this entire stack at a loss for $4,522 per ETH, or $17.98 million total—resulting in a net negative of approximately $932,000.
In the comments, one person asked, “Why is a ‘hacker’ allowed to do trading freely,” questioning the lack of sanctions applied to what is claimed to be a known hacker, fueling skepticism of the label applied by Lookonchain’s analyst.
Byt why a "hacker" is allowed to do trading freely, if he is a "hacker" and you are sure he "is"
— Nabaz (@nabaz120211) September 15, 2025
Why Is a “Hacker” Able to Trade Freely?
While there is no direct response in the thread on X, the answer is simple: The address is limiting its activities to decentralized currencies, like ETH and DAI, on decentralized exchanges, like CoW Protocol. These systems are built, among other things, on the premise of being censorship-resistant, which brings many benefits but also has obvious trade-offs, like not being able to apply sanctions to these addresses.
CoW Protocol, also known as CoW Swap, is an intent-based trading protocol similar to NEAR Intents that recently added support to Aptos, as Coinspeaker reported. The protocol allows users to delegate trade execution to “solvers”—competitive algorithms or entities that find and execute the optimal exchange rates across various liquidity sources.
Related article: Ethereum Price Under Pressure Amid Strong Profit Booking, What's Next?
Therefore, the only way to prevent alleged Coinbase hackers from trading is if the money reaches centralized systems or fiat off-ramps. The same logic would apply, for example, to peaceful people suffering political persecution or fleeing from a country in war or under a tyrannical regime.
As far as the decentralized finance environment is concerned, “code is law.” The way to fight such cases is prevention—by writing solid and secure systems that cannot be breached or are built on top of privacy solutions that make sure that, even when a breach occurs, there is nothing of value there to be used by the attackers. It is not by chance that Google searches for “privacy coins” have been growing over time, highlighting a rising interest in the security they offer to users.
Ethereum (ETH) Price Analysis
As of this writing, ETH is trading at $4,505 per token, 0.37% lower than the “Coinbase hacker” capitulation point. Notably, Ethereum’s native token is testing a 30-day price support at these levels, which could work as a launchpad for an upward movement if the crypto market turns bullish this week following the upcoming Fed’s interest rate decision on Sept. 17—in two days.
ETH daily (1D) price chart against the dollar | Source: TradingView
Losing this support could send the price lower, potentially testing the 50-day exponential moving average, an important technical indicator for cryptocurrencies. ETH has been trading above this indicator for the past four months, since a significant breakout in May 2025, around the same time as the hacker was identified accumulating stolen funds from its victims.
