ZachXBT Uncovers “Canadian” Fraudster Who Defrauded $2 Million Through Phony Coinbase Assistance

Blockchain investigator ZachXBT has uncovered a scammer based in Canada who reportedly embezzled over $2 million in cryptocurrency by posing as Coinbase customer support, contributing to an increasing number of social engineering incidents aimed at users of prominent exchanges.

In a series of updates on X, ZachXBT revealed that the suspected scammer, known by the aliases “Haby” or “Havard,” spent over a year masquerading as a Coinbase help desk employee and deceiving users into surrendering their funds.

1/ Meet Haby (Havard), a Canadian threat actor who has stolen $2M+ via Coinbase support impersonation social engineering scams in the past year blowing the funds on rare social media usernames, bottle service, & gambling. pic.twitter.com/bBqrV7GmPi

— ZachXBT (@zachxbt) December 29, 2025

ZachXBT Tracks Coinbase Scammer Through Screenshots and Wallet Data

The investigator noted that the suspect employed traditional social engineering methods instead of technical hacks, manipulating victims into thinking their accounts were at risk and required urgent action.

ZachXBT mentioned that he was able to follow the suspect’s activities by cross-referencing screenshots shared in Telegram group chats, social media updates, and on-chain transaction records.

In one instance, dated December 30, 2024, the alleged scammer shared a screenshot bragging about a theft of 21,000 XRP, valued at approximately $44,000 at that time, taken from a Coinbase user.

Further investigation connected that XRP address to other Coinbase-related thefts amounting to around $500,000.

The investigator stated that the suspect frequently converted stolen XRP into bitcoin using instant exchange platforms, a tactic aimed at concealing transaction trails.

Source: ZachXBT

By examining transaction timing and wallet balances, ZachXBT identified a bitcoin address that later showed a balance of approximately $237,000 in February 2025, which corresponded with screenshots the suspect had shared while flaunting his assets in private conversations.

Tracing back from that address uncovered three additional Coinbase impersonation thefts totaling over $560,000.

ZachXBT also released a leaked screen recording that allegedly depicts the suspect on a call with a victim, impersonating Coinbase support.

In the footage, the caller can be heard directing the target through what seemed to be fraudulent security procedures while inadvertently disclosing an email address and Telegram account associated with the scheme.

7/ In this leaked video here’s Haby as a caller social engineering a target.
In the screen recording he leaks the email habyclown@gmail[.]com and his Telegram account with a number. pic.twitter.com/rd0FOZWoxr

— ZachXBT (@zachxbt) December 29, 2025

The suspect reportedly purchased high-value Telegram usernames and deleted older accounts in an effort to avoid detection, although frequent online boasting facilitated attribution.

Crypto Users Face Rising Losses as Social Engineering Attacks Spread

This case emerged as authorities in India recently apprehended a former Coinbase customer support agent in Hyderabad over a separate data breach impacting nearly 70,000 users.

A former @Coinbase support agent was arrested in India over a data breach affecting nearly 70,000 users.#Coinbase #Indiahttps://t.co/ebWl6bUXq8

— Cryptonews.com (@cryptonews) December 28, 2025

Coinbase CEO Brian Armstrong stated that the breach resulted from a bribery scheme targeting offshore support personnel and incurred approximately $307 million in remediation and reimbursement expenses.

Coinbase declined to pay a $20 million ransom related to the incident and instead initiated a bounty program to support investigations.

Social engineering scams like the one outlined by ZachXBT typically commence with unsolicited calls, texts, or emails that seem to originate from a legitimate company.

Scammers often create a sense of urgency by alleging suspicious activity or an imminent account compromise, then pressure victims into disclosing login credentials or two-factor authentication codes or transferring funds to wallets controlled by the attacker.

The identification of the alleged Canadian scammer follows other recent enforcement actions. In the United States, prosecutors charged a 23-year-old resident of Brooklyn with stealing approximately $16 million from around 100 Coinbase users through a similar impersonation scheme.

That investigation also utilized blockchain analysis and led to the seizure of cash and digital assets, with recovery efforts still in progress.

Source: Chainalysis

Industry data indicates that crypto theft remains prevalent, with over $3.4 billion stolen across the sector from January to early December 2025.

Security experts continue to advise users to refrain from responding to unsolicited communications, never share passwords or recovery phrases, and only reach out to support through official websites or applications.

The post ZachXBT Exposes “Canadian” Scammer Who Stole $2M Via Fake Coinbase Support appeared first on Cryptonews.