Cash

Tornado Cash

cbBTC

Security

Tornado

<h2 id="tldr">TLDR</h2>
<ul>
 <li>A Kraken and Coinbase user lost about $6.7 million after attackers drained crypto from both exchange accounts.</li>
 <li>The stolen assets included Ethereum, Bitcoin, and cbBTC withdrawn in a short and coordinated series of transactions.</li>
 <li>On-chain analyst Specter traced the stolen funds to new wallet addresses across the Ethereum and Bitcoin networks.</li>
 <li>Attackers moved about $5.3 million of the stolen crypto through Tornado Cash to obscure transaction trails.</li>
 <li>Early reports suggested a physical attack, but later analysis indicated no evidence of coercion.</li>
 <li>The method used to access the victim’s exchange accounts has not been confirmed.</li>
</ul>
<p>A crypto user has lost about $6.7 million after attackers drained accounts linked to Kraken and Coinbase. The stolen assets included Ethereum, Bitcoin, and <a href="https://blockonomi.com/cbbtc-arrives-on-monad-through-chainlink-ccip-opening-new-defi-use-cases/" rel="noopener noreferrer nofollow">cbBTC</a>, according to blockchain tracking data. The incident involving Kraken has raised fresh concerns about exchange account security and targeted attacks.</p>
<h2 id="kraken-account-drained-alongside-coinbase-holdings">Kraken Account Drained Alongside Coinbase Holdings</h2>
<p>Attackers<a href="https://x.com/SpecterAnalyst/status/2057013903310164373?s=20" rel="noopener noreferrer nofollow"> withdrew</a> large amounts of crypto from the victim’s accounts within a short period. The activity affected both Kraken and Coinbase balances simultaneously.</p>
<div class="embed-twitter">
 <blockquote class="twitter-tweet">
  <p>A Kraken and Coinbase user lost $6.7M, likely as a result of a physical attack.</p>
  <p>A total of 1,554 <a href="https://twitter.com/search?q=%24ETH&amp;src=ctag&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">$ETH</a> (~$3.3M) and 10.5 bitcoin:native were withdrawn from the victim’s Kraken account, while 34.1 <a href="https://twitter.com/search?q=%24cbBTC&amp;src=ctag&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">$cbBTC</a> (~$2.6M) was withdrawn from Coinbase.</p>
  <p>The attackers have already laundered… <a href="https://t.co/Y9CvvWY0EQ" rel="noopener noreferrer nofollow">pic.twitter.com/Y9CvvWY0EQ</a></p>
  <p>— Specter (@SpecterAnalyst) <a href="https://twitter.com/SpecterAnalyst/status/2057013903310164373?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">May 20, 2026</a></p>
 </blockquote>
</div>
<p>On-chain analyst Specter reported that 1,554 ETH, worth about $3.3 million, left the Kraken account. The attackers also withdrew 10.5 BTC during the same period.</p>
<p>At the same time, the <a href="https://blockonomi.com/blackrock-moves-5847-bitcoin-worth-450m-to-coinbase-prime-wallets/" rel="noopener noreferrer nofollow">Coinbase</a> account saw withdrawals of 34.1 cbBTC worth roughly $2.6 million. These movements occurred quickly and followed a coordinated pattern.</p>
<p>Specter tracked the stolen funds to newly identified wallet addresses on Ethereum and Bitcoin networks. The analyst shared that the assets moved rapidly after the initial withdrawals.</p>
<p>Early reports suggested a possible physical attack on the account holder. However, Specter later stated the case likely did not involve physical coercion.</p>
<p>The exact method used to access the accounts remains unclear at this stage. No official statement from Kraken or Coinbase has detailed the breach vector.</p>
<h2 id="stolen-crypto-moves-through-tornado-cash">Stolen Crypto Moves Through Tornado Cash</h2>
<p>Blockchain data shows that attackers began laundering funds shortly after the theft. They routed a large portion through <a href="https://blockonomi.com/tornado-cash-linked-wallet-sells-8-2m-in-hype-tokens/" rel="noopener noreferrer nofollow">Tornado Cash</a>, a privacy mixer on Ethereum.</p>
<p>Specter said about $5.3 million had already passed through Tornado Cash. The transfers occurred in multiple transactions to obscure tracking.</p>
<p>The use of mixers complicates efforts to trace stolen crypto across the blockchain. Investigators often face delays when funds move through such services.</p>
<p>The case adds to ongoing reports of phishing and malware targeting exchange users. Attackers often exploit compromised credentials to gain account access.</p>
<p>Kraken and Coinbase both offer two-factor authentication and withdrawal protection features. However, advanced attacks continue to bypass these safeguards in some cases.</p>
<p>Security experts advise users to enable all available protections and monitor account activity closely. They also recommend avoiding suspicious links and unknown software.</p>
<p>As of the latest update, the stolen funds remain in circulation after passing through Tornado Cash. Authorities and analysts continue to track related wallet activity.</p>
<p>The post <a href="https://blockonomi.com/kraken-coinbase-user-hit-by-6-7m-crypto-theft-and-laundering/" rel="noopener noreferrer nofollow">Kraken, Coinbase User Hit by $6.7M Crypto Theft and Laundering</a> appeared first on <a href="https://blockonomi.com" rel="noopener noreferrer nofollow">Blockonomi</a>.</p>

Kraken, Coinbase User Hit by $6.7M Crypto Theft and Laundering

Table of Contents

Blockonomi

Other articles published on May 20, 2026

Join our free newsletter for daily crypto updates!