Hacker drains $6.7M from CEX accounts

TLDR

A single user reportedly lost about 6.7 million dollars after their Coinbase and Kraken accounts were compromised, raising questions about centralized exchange account security rather than an exchange hack.

1. On chain investigators say 10.5 BTC, 1,554 ETH and 34.1 cbBTC were drained from linked Kraken and Coinbase accounts, with about 5.3 million dollars quickly laundered via Tornado Cash.
2. Evidence so far points to targeted account compromise, not a breach of Coinbase or Kraken systems, highlighting human and device level attack surfaces.
3. The key things to watch are any formal exchange statements, law enforcement involvement, and tightening your own login, device and withdrawal security controls.

Deep Dive

1. How The 6.7M Was Drained

An on chain analyst known as Specter reported that a user with accounts on Coinbase and Kraken lost around 6.7 million dollars in total, spread across both venues, after their accounts were taken over. The attacker allegedly withdrew about 10.5 BTC and 1,554 ETH, worth roughly 3.3 million dollars, from Kraken and 34.1 cbBTC, worth roughly 2.6 million dollars, from Coinbase, before rapidly laundering about 5.3 million dollars through Tornado Cash mixers in multiple transactions as described in the incident report from a user with accounts on Coinbase and Kraken.

Initial speculation suggested a possible physical or in person attack, but Specter later indicated there was likely no physical component, and the precise compromise method remains unknown. There is no public evidence at this point that either exchanges core infrastructure or hot wallets were hacked.

2. CEX Accounts And Real Risk

From what is known, Coinbase and Kraken processed withdrawals using valid session control, which suggests the attacker had enough access to satisfy normal checks. Common paths include stolen credentials, compromised email or SIM, malicious browser extensions, remote access malware, or phished 2FA codes or session cookies.

This kind of event blurs the line between CEX got hacked and user account got taken over using off platform tricks, but for most users the practical risk is similar: if an attacker can act as you, the exchange will usually treat actions as legitimate.

3. Practical Safeguards And What To Watch

Going forward, three angles matter:

1. Whether Coinbase or Kraken publish forensic details or extra protections for high value accounts.
2. Whether law enforcement or analytics firms attribute the attacker to a known group, given the Tornado Cash laundering pattern.
3. Your own setup: strong unique passwords, phishing resistant 2FA (for example, hardware security keys), tight email and SIM security, and conservative withdrawal and login alerts all reduce takeover risk.

Confidence: high, because multiple details in independent reporting align on the amounts, venues and laundering path, even though the exact initial compromise vector is still unclear.

Conclusion

This incident looks like a sophisticated, targeted takeover of one users centralized exchange accounts, not a systemic failure of Coinbase or Kraken. For crypto users, the main takeaway is that the critical weak point is often the combination of devices, email, phone, and 2FA, so tightening that stack and treating CEX accounts like bank accounts is key to limiting similar loss scenarios.