Blockchain investigator ZachXBT has uncovered a Canada-based scammer who allegedly stole greater than $2 million in cryptocurrency by impersonating Coinbase buyer help, including to a rising listing of social engineering circumstances focusing on customers of main exchanges.

In a collection of posts on X, ZachXBT stated the alleged scammer, recognized by the alias “Haby” or “Havard,” spent greater than a 12 months posing as a Coinbase assist desk employee and tricking customers into handing over funds.

ZachXBT Tracks Coinbase Scammer Via Screenshots and Pockets Knowledge

In response to the investigator, the suspect relied on basic social engineering techniques slightly than technical exploits, manipulating victims into believing their accounts had been underneath menace and wanted fast intervention.

ZachXBT stated he was in a position to hint the exercise by cross-referencing screenshots shared in Telegram group chats, social media posts, and on-chain transaction knowledge.

In an occasion, dated Dec. 30, 2024, the alleged scammer posted a screenshot boasting of a 21,000 XRP theft, value about $44,000 on the time, taken from a Coinbase person.

Additional evaluation linked that XRP handle to extra Coinbase-related thefts totaling roughly $500,000.

The investigator stated the suspect routinely transformed stolen XRP into bitcoin utilizing prompt change companies, a transfer supposed to obscure transaction trails.

By analyzing transaction timing and pockets balances, ZachXBT stated he recognized a bitcoin handle that later displayed a steadiness of about $237,000 in February 2025, matching screenshots the suspect had shared whereas displaying off his funds in personal chats.

Tracing backward from that handle revealed three extra Coinbase impersonation thefts value greater than $560,000.

ZachXBT additionally shared a leaked display recording that allegedly reveals the suspect on a name with a sufferer, impersonating Coinbase help.

Within the video, the caller is heard guiding the goal via what seemed to be pretend safety steps whereas inadvertently revealing an electronic mail handle and Telegram account tied to the operation.

The suspect reportedly purchased costly Telegram usernames and deleted older accounts in an try and evade detection, although repeated on-line bragging made attribution simpler.

Crypto Customers Face Rising Losses as Social Engineering Assaults Unfold

The case surfaced as authorities in India not too long ago arrested a former Coinbase buyer help agent in Hyderabad over a separate knowledge breach affecting almost 70,000 customers.

Coinbase CEO Brian Armstrong stated the breach stemmed from a bribery scheme focusing on offshore help employees and resulted in about $307 million in remediation and reimbursement prices.

Coinbase refused to pay a $20 million ransom linked to the incident and as an alternative launched a bounty program to assist investigations.

Social engineering scams just like the one described by ZachXBT usually start with unsolicited calls, texts, or emails that seem to return from a reliable firm.

Scammers typically create urgency by claiming there was suspicious exercise or an imminent account compromise, then stress victims into revealing login credentials or two-factor authentication codes or transferring funds to wallets managed by the attacker.

The publicity of the alleged Canadian scammer follows different latest enforcement actions. In the US, prosecutors charged a 23-year-old Brooklyn resident with stealing about $16 million from roughly 100 Coinbase customers via the same impersonation scheme.

That investigation additionally relied on blockchain evaluation and resulted within the seizure of money and digital property, with restoration efforts ongoing.

Business knowledge present crypto theft stays widespread, with greater than $3.4 billion stolen throughout the sector between January and early December 2025.

Safety specialists proceed to induce customers to keep away from responding to unsolicited messages, by no means share passwords or restoration phrases, and solely contact help via official web sites or apps.

The submit ZachXBT Exposes “Canadian” Scammer Who Stole $2M Through Pretend Coinbase Help appeared first on Cryptonews.