A wallet tied to a 2025 scam targeting Coinbase users has moved 3 million sUSDS tokens, converting and laundering the funds through Tornado Cash in 36 transactions.
TREE NEWS reports: The wallet, previously identified in reports as being connected to a phishing operation that drained funds from Coinbase users, transferred the 3 million sUSDS to a new address. The funds were then swapped and deposited into Tornado Cash, a sanctioned privacy mixer, in 36 separate transactions. This movement suggests an attempt to obfuscate the origin of the assets and evade detection.
Background on the Scam and sUSDS
sUSDS is a yield-bearing stablecoin wrapper for USDS, the stablecoin issued by Sky (formerly MakerDAO). It is widely used in DeFi for earning yield on stablecoin holdings. The involvement of sUSDS in this scam highlights how scammers are increasingly using yield-bearing assets to store stolen funds, potentially earning returns while the funds remain undetected.
The original scam, reported in 2025, involved social engineering tactics to compromise Coinbase user accounts. The funds were likely stolen from victims and converted into various cryptocurrencies before being consolidated into sUSDS.
Implications for Crypto Security and Regulation
The use of Tornado Cash, which was sanctioned by the U.S. Treasury in 2022 but later delisted in 2025 following a court ruling, remains a contentious issue. While the delisting allows U.S. persons to interact with the protocol, it still poses significant money laundering risks. This incident underscores the challenges regulators face in balancing privacy and security.
Moreover, the movement of stolen funds through DeFi protocols like Sky’s sUSDS raises questions about the effectiveness of anti-money laundering (AML) measures in decentralized finance. Unlike centralized exchanges, DeFi protocols often lack robust KYC/AML controls, making them attractive for illicit actors.
Forward-Looking Perspective
As blockchain analytics firms like Salus continue to monitor such activities, law enforcement agencies may be able to trace the funds and potentially recover them. However, the use of mixers like Tornado Cash complicates these efforts. The crypto industry must continue to develop better tools for tracking and preventing illicit finance, while regulators should consider nuanced approaches that encourage innovation without compromising security.
This case also serves as a reminder for users to remain vigilant against phishing and social engineering attacks, especially those targeting exchange users. Enhanced security measures, such as multi-factor authentication and hardware wallets, are essential.
