ZachXBT Uncovers “Canadian” Scammer Who Fraudulently Collected $2M via Phony Coinbase Support

Summary:
Blockchain investigator ZachXBT has revealed the identity of a scammer from Canada who allegedly stole over $2 million in cryptocurrency by impersonating Coinbase customer support. This incident highlights the growing trend of social engineering attacks targeting users of major exchanges.

Key Takeaways

ZachXBT identified a Canadian scammer, known by the alias “Haby” or “Havard,” who fraudulently obtained more than $2 million from victims.
The scammer used classic social engineering tactics, tricking users into believing their accounts were at risk.
The investigation involved analyzing screenshots, social media, and transaction data to trace stolen funds.
The rise of social engineering scams risks greater losses for cryptocurrency users, as seen in a recent related data breach at Coinbase.

ZachXBT Uncovers “Canadian” Scammer Who Fraudulently Collected $2M via Phony Coinbase Support

Investigation Unveils Scam Operations

ZachXBT has brought to light the activities of a Canada-based scammer who reportedly swindled over $2 million in cryptocurrency by impersonating support staff from Coinbase. This incident is part of an increasing number of social engineering scams that target users of major cryptocurrency exchanges.

In a detailed series of posts on X, ZachXBT revealed that the individual, using the aliases “Haby” or “Havard,” spent over a year posing as a representative of Coinbase’s help desk, deceitfully convincing users to transfer their funds.

Tracing the Scammer

ZachXBT detailed how he tracked the scammer by cross-referencing screenshots shared in Telegram group chats, on social media, and through on-chain transaction data.

Notably, on December 30, 2024, the scammer shared a screenshot that displayed a theft of 21,000 XRP (approximately $44,000 at the time) from a Coinbase user. Further investigation connected that XRP wallet to other Coinbase-related thefts, amounting to around $500,000.

The scammer reportedly transformed stolen XRP into bitcoin via quick exchange services to obscure the trail of transactions.

Transaction Analysis

By examining transaction timings and wallet balances, ZachXBT identified a bitcoin address that had a balance of about $237,000 in February 2025, corresponding to screenshots the scammer shared while flaunting his wealth in private discussions.

A backward trace from this address uncovered three additional Coinbase impersonation thefts totaling over $560,000.

Impersonation Exposed

ZachXBT also shared a leaked screen recording that reportedly shows the suspect on a call with a victim while pretending to be from Coinbase support. During the call, the scammer guided the victim through fake security steps, unintentionally revealing an email address and Telegram account linked to the scam.

To evade capture, the suspect purchased high-value usernames on Telegram and deleted older accounts. However, constant online boasting made it easier to connect the dots.

Increasing Threats from Social Engineering Scams

This situation comes to light as authorities in India recently apprehended a former Coinbase support agent in Hyderabad over a separate data breach that affected nearly 70,000 users. Coinbase’s CEO, Brian Armstrong, stated that this breach was a result of bribery targeting offshore support staff, leading to about $307 million in recovery and reimbursement expenses.

Coinbase declined to pay a $20 million ransom related to this incident, opting instead to implement a bounty program to assist in investigations.

Social engineering scams, like the one highlighted by ZachXBT, often start with unsolicited messages that appear to be from reputable companies. Scammers may create a sense of urgency by claiming there has been suspicious activity or an accounts compromise, pressuring victims into divulging login details, two-factor authentication codes, or transferring funds to wallets under the scammer’s control.

The exposure of this alleged Canadian scammer aligns with other recent law enforcement efforts. In the US, a 23-year-old Brooklyn resident has been charged with stealing approximately $16 million from around 100 Coinbase users using a similar impersonation scheme. This case also involved blockchain analysis, leading to the seizure of both cash and cryptocurrency assets, with ongoing recovery efforts.

Crypto Theft Statistics

Data from the industry indicates that cryptocurrency theft remains widespread, with over $3.4 billion stolen in the sector between January and early December 2025. Security experts continue to advise users to refrain from responding to unsolicited messages, avoid sharing passwords or recovery phrases, and only contact support through verified websites or applications.