A Coinbase user was reportedly scammed out of 400.099 bitcoin—valued at $34.9 million—on Thursday, March 27, according to crypto investigator ZachXBT. The stolen funds were transferred to the wallet address bc1qvlustvxhqzee9tqqers4ftungrg6c0fs4u76jjf.
The incident appears to be part of a broader social engineering campaign that has targeted multiple Coinbase users. ZachXBT, who has 74,312 subscribers on his Telegram channel Investigations by ZachXBT, said the total stolen in March alone now exceeds $46 million.
ZachXBT linked the thefts to a recurring pattern involving blockchain bridge protocols.
“Funds from each theft were bridged from Bitcoin to Ethereum via Thorchain / Chainflip and swapped for DAI,”
He wrote. In recent weeks, he identified three additional thefts tied to Coinbase users: 60.164 BTC on March 26, 46.147 BTC on March 25, and 20.082 BTC on March 16.
The addresses associated with those thefts were also provided:
- bc1qhc72zfqwh3e6lns5ay084k29tmqlw75jsxec (60.164 BTC)
- bc1qdf6v3220v49j0xgmyckszse59z90gru46dlxg8ff (46.147 BTC)
- bc1qd59e296yyr8x4gyr53xt4yjmqmguweme7alcuf (20.082 BTC)
The method of attack has not been disclosed, but ZachXBT attributed the loss to a social engineering operation. He said Coinbase users have been repeatedly targeted by sophisticated scammers, who sometimes pose as support staff.
“After uncovering this theft, I noticed multiple other suspected thefts from Coinbase users in the past two weeks,”
– ZachXBT wrote.
He also pointed to Coinbase’s apparent inaction in response to the attacks. “Coinbase has not flagged any of the theft addresses from these victims in compliance tools,” he said in a Telegram post on Friday.
This is not the first time ZachXBT has investigated large-scale crypto thefts affecting Coinbase customers. He previously highlighted a case where $234 million in bitcoin was stolen from a Gemini creditor after scammers impersonated Coinbase personnel. Miami police later arrested three individuals using leads provided by the investigator.
ZachXBT’s March update follows an earlier report from February, in which he claimed that Coinbase users lost $65 million between December 2024 and January 2025.
The use of cross-chain bridges like Thorchain and Chainflip, followed by immediate swaps to stablecoins such as DAI, has become a recurring tactic in recent thefts, according to ZachXBT.
