A threat actor linked to more than $300 million in reported Coinbase user losses has moved another $500,000 into Ether and transferred the funds to Tornado Cash. Investigators say the broader campaign relied on social engineering rather than a blockchain or smart-contract exploit.