ZachXBT Exposes “Canadian” Scammer Who Stole $2M Via Fake Coinbase Support
Blockchain investigator ZachXBT has uncovered a Canada-based scammer who allegedly stole greater than $2 million in cryptocurrency by impersonating Coinbase buyer help, including to a rising checklist of social engineering circumstances focusing on customers of main exchanges.
In a collection of posts on X, ZachXBT said the alleged scammer, recognized by the alias “Haby” or “Havard,” spent greater than a yr posing as a Coinbase assist desk employee and tricking customers into handing over funds.
ZachXBT Tracks Coinbase Scammer Through Screenshots and Wallet Data
According to the investigator, the suspect relied on classic social engineering tactics moderately than technical exploits, manipulating victims into believing their accounts had been underneath risk and wanted fast intervention.
ZachXBT stated he was capable of hint the exercise by cross-referencing screenshots shared in Telegram group chats, social media posts, and on-chain transaction information.
In an occasion, dated Dec. 30, 2024, the alleged scammer posted a screenshot boasting of a 21,000 XRP theft, price about $44,000 on the time, taken from a Coinbase consumer.
Further evaluation linked that XRP handle to extra Coinbase-related thefts totaling roughly $500,000.
The investigator stated the suspect routinely transformed stolen XRP into bitcoin utilizing prompt trade companies, a transfer meant to obscure transaction trails.
By analyzing transaction timing and pockets balances, ZachXBT stated he recognized a bitcoin handle that later displayed a stability of about $237,000 in February 2025, matching screenshots the suspect had shared whereas displaying off his funds in non-public chats.
Tracing backward from that handle revealed three extra Coinbase impersonation thefts price greater than $560,000.
ZachXBT additionally shared a leaked display screen recording that allegedly reveals the suspect on a name with a sufferer, impersonating Coinbase help.
In the video, the caller is heard guiding the goal by what seemed to be pretend safety steps whereas inadvertently revealing an electronic mail handle and Telegram account tied to the operation.
The suspect reportedly purchased costly Telegram usernames and deleted older accounts in an try to evade detection, although repeated on-line bragging made attribution simpler.
The case surfaced as authorities in India recently arrested a former Coinbase customer support agent in Hyderabad over a separate information breach affecting practically 70,000 customers.
A former @Coinbase help agent was arrested in India over a knowledge breach affecting practically 70,000 customers.#Coinbase #Indiahttps://t.co/ebWl6bUXq8
— Cryptonews.com (@cryptonews) December 28, 2025
Coinbase CEO Brian Armstrong stated the breach stemmed from a bribery scheme focusing on offshore help employees and resulted in about $307 million in remediation and reimbursement prices.
Coinbase refused to pay a $20 million ransom linked to the incident and as an alternative launched a bounty program to help investigations.
Social engineering scams just like the one described by ZachXBT sometimes start with unsolicited calls, texts, or emails that seem to come back from a authentic firm.
Scammers typically create urgency by claiming there was suspicious exercise or an imminent account compromise, then stress victims into revealing login credentials or two-factor authentication codes or transferring funds to wallets managed by the attacker.
The publicity of the alleged Canadian scammer follows different latest enforcement actions. In the United States, prosecutors charged a 23-year-old Brooklyn resident with stealing about $16 million from roughly 100 Coinbase customers by an identical impersonation scheme.
That investigation additionally relied on blockchain evaluation and resulted within the seizure of money and digital belongings, with restoration efforts ongoing.
Industry information present crypto theft stays widespread, with greater than $3.4 billion stolen throughout the sector between January and early December 2025.
Security consultants proceed to induce customers to keep away from responding to unsolicited messages, by no means share passwords or restoration phrases, and solely contact help by official web sites or apps.
The submit ZachXBT Exposes “Canadian” Scammer Who Stole $2M Via Fake Coinbase Support appeared first on Cryptonews.
