A scammer known as “Excite” flaunted stolen wealth and an actual monkey after a Coinbase Commerce contract facilitated $15.9 million in suspicious withdrawals.

According to blockchain investigator ZachXBT, threat actors siphoned nearly $16 million from a Coinbase Commerce contract through 1,700 transactions on the Polygon layer-2 scaling network in April 2024.

The perpetrators bridged stolen (USDC) from Polygon to Ethereum before dispersing the assets across multiple wallet addresses, a common tactic used by crypto thieves to confuse on-chain trackers.

ZachXBT revealed on X that most of the funds remained dormant, but some were deposited into eXch and Stake, a crypto betting platform.

In May, a Telegram user named “tezedasads12” disclosed their ownership of a wallet containing $6 million from the hack. The individual also claimed control of the “Excite” Instagram page, where they showcased a monkey and luxury watches, allegedly purchased in Denmark with the stolen funds.

While the identity of the victim in this case remains unknown it’s clear a strong lead exists to potentially hold this threat actor legally accountable. Due to how the funds were split three ways I would expect others may have been involved. One question I would have is why did Coinbase’s AML monitoring not flag this suspicious activity within 16 hours.

ZachXBT on X

ZachXBT has unearthed several Coinbase-related thefts in recent months. In November, the on-chain investigator exposed $6.5 million stolen from a Coinbase user. Suspected crypto scammer Ronald Spektor deactivated his social media pages shortly after the news broke, fueling speculation about his involvement.

ZachXBT helped a senior citizen recover $275,000 of their Bitcoin (BTC) life savings. The victim, a Coinbase customer, was deceived by Indian impersonators.

Investigations published by ZachXBT led to arrests in a $238 million crypto heist. Per the August report, a single Genesis creditor was scammed by fake Coinbase support agents, and scammers stole the 4,064 BTC fortune.