TLDR
- Investigator ZachXBT identified a Canada-based scammer, alias “Haby,” following a fraud exceeding $2 million.
- The criminal utilized social engineering tactics and Telegram screenshots to brag about his thefts.
- This case adds to a security crisis that has cost Coinbase millions in remediation and reimbursements.
On-chain investigator ZachXBT has exposed a Canada-based scammer, allegedly responsible for stealing more than $2 million. The suspect, identified by the aliases “Haby” or “Havard,” operated for over a year executing sophisticated Coinbase impersonation scams to deceive unsuspecting users.
Unlike complex technical attacks, the individual known as Haby relied on social engineering for his operations. ZachXBT reported that the scammer contacted victims by posing as the exchange’s technical support, convincing them that their accounts were at risk so they would transfer funds or hand over credentials.
The investigation began thanks to on-chain data tracking and the analysis of screenshots that Haby himself shared in private Telegram groups to boast about his profits.
On-chain Tracking and Attacker Errors
Significant movements were discovered through transaction monitoring. For instance, in December 2024, one victim lost 21,000 XRP, equivalent to approximately $44,000. Subsequently, ZachXBT linked that address to other thefts totaling half a million dollars.
In February 2025, a Bitcoin address controlled by the suspect reached a balance of $237,000, coinciding with leaked recordings where the scammer is heard guiding a victim through fake security steps.
It is worth noting that the ecosystem is currently facing an alarming surge in these tactics. Recently, the arrest of a former support agent in India was reported in connection with a data breach affecting 70,000 users, forcing Coinbase to allocate $307 million for remediation. These incidents demonstrate that Coinbase impersonation scams have become a lucrative industry for cybercriminals.
In summary, security experts assert that the industry lost more than $3.4 billion to thefts in 2025. Users are urged not to share recovery phrases or authentication codes, remembering that official support will never request fund transfers to “secure” an account.
