Kraken, Coinbase User Hit by $6.7M Crypto Theft and Laundering

Table of Contents A crypto user has lost about $6.7 million after attackers drained accounts linked to Kraken and Coinbase. The stolen assets included Ethereum, Bitcoin, and cbBTC, according to blockchain tracking data. The incident involving Kraken has raised fresh concerns about exchange account security and targeted attacks. Attackers withdrew large amounts of crypto from the victim’s accounts within a short period. The activity affected both Kraken and Coinbase balances simultaneously. A Kraken and Coinbase user lost $6.7M, likely as a result of a physical attack. A total of 1,554 $ETH (~$3.3M) and 10.5 bitcoin:native were withdrawn from the victim’s Kraken account, while 34.1 $cbBTC (~$2.6M) was withdrawn from Coinbase. The attackers have already laundered… pic.twitter.com/Y9CvvWY0EQ — Specter (@SpecterAnalyst) May 20, 2026 On-chain analyst Specter reported that 1,554 ETH, worth about $3.3 million, left the Kraken account. The attackers also withdrew 10.5 BTC during the same period. At the same time, the Coinbase account saw withdrawals of 34.1 cbBTC worth roughly $2.6 million. These movements occurred quickly and followed a coordinated pattern. Specter tracked the stolen funds to newly identified wallet addresses on Ethereum and Bitcoin networks. The analyst shared that the assets moved rapidly after the initial withdrawals. Early reports suggested a possible physical attack on the account holder. However, Specter later stated the case likely did not involve physical coercion. The exact method used to access the accounts remains unclear at this stage. No official statement from Kraken or Coinbase has detailed the breach vector. Blockchain data shows that attackers began laundering funds shortly after the theft. They routed a large portion through Tornado Cash, a privacy mixer on Ethereum. Specter said about $5.3 million had already passed through Tornado Cash. The transfers occurred in multiple transactions to obscure tracking. The use of mixers complicates efforts to trace stolen crypto across the blockchain. Investigators often face delays when funds move through such services. The case adds to ongoing reports of phishing and malware targeting exchange users. Attackers often exploit compromised credentials to gain account access. Kraken and Coinbase both offer two-factor authentication and withdrawal protection features. However, advanced attacks continue to bypass these safeguards in some cases. Security experts advise users to enable all available protections and monitor account activity closely. They also recommend avoiding suspicious links and unknown software. As of the latest update, the stolen funds remain in circulation after passing through Tornado Cash. Authorities and analysts continue to track related wallet activity.