Last updated on January 2nd, 2026 at 07:36 pm
Quick Breakdown
- A Canadian known as Haby stole $2 million by posing as a Coinbase help desk representative over the past year.
- Blockchain investigator ZachXBT exposed the fraud through wallet traces and social media posts.
- Funds went to gambling, parties, and social media boasts, highlighting the risks of social engineering.
Canadian poses as Coinbase support in $2M theft
A Canadian individual, known online as Haby or Haverd, allegedly stole over $2 million in cryptocurrency by impersonating Coinbase customer support representatives. Blockchain detective ZachXBT uncovered the scheme on December 29, 2025, linking the suspect to multiple victims through on-chain analysis of Bitcoin addresses, Telegram accounts, and leaked videos. The scammer contacted users claiming account issues, convinced them to grant remote computer access, and drained wallets holding BTC, ETH, XRP, and other assets. One confirmed theft involved 21,000 XRP worth $44,000, with total losses exceeding $1 million from at least five Coinbase users.
1/ Meet Haby (Havard), a Canadian threat actor who has stolen $2M+ via Coinbase support impersonation social engineering scams in the past year blowing the funds on rare social media usernames, bottle service, & gambling. pic.twitter.com/bBqrV7GmPi
— ZachXBT (@zachxbt) December 29, 2025
Victims downloaded remote tools and shared credentials after receiving spoofed calls and emails mimicking official Coinbase branding. ZachXBT noted the suspect’s poor operational security, including frequent Telegram name changes and public boasts about scams on social media. Coinbase has long warned users never to share private keys or allow remote access, confirming no legitimate staff requests such data. The exposure came amid rising social engineering attacks in crypto, which topped the list of theft methods in 2025, per industry reports.
Social engineering threats escalate in 2025
The $2 million cryptocurrency theft by a Canadian scammer impersonating Coinbase Support highlights the increasing threat of impersonation fraud targeting centralized exchanges. This surge in attacks reflects the rapid growth of platforms like Coinbase, which now serve over 100 million users. Authorities in the U.S. and globally report a 20-30% year-on-year increase in these cases, where attackers exploit trust in support channels.
This incident underscores the ongoing challenge of accountability for crypto crime, as well as another in May 2025, in which a 2020 Coinbase hacker moved $42 million in BTC and taunted forensic sleuth ZachXBT. Despite this, accountability tools are proving effective, with firms like ZachXBT aiding investigations by tracing stolen funds to luxury spending and gambling sites.
In response, exchanges are implementing enhanced security measures, including mandatory two-factor authentication, AI-driven phishing detection, and more frequent user alerts. Experts also advise users to adopt hardware wallets for significant holdings and to use official apps for direct verification, mitigating the risk of future exploits.
If you would like to read more articles like this, visit DeFi Planet and follow us on Twitter, LinkedIn, Facebook, Instagram, and CoinMarketCap Community.
Take control of your crypto portfolio with MARKETS PRO, DeFi Planet’s suite of analytics tools.”
