TLDR

  • A Canadian fraudster, impersonating Coinbase support, defrauded users of more than $2 million using phishing and social engineering tactics.
  • ZachXBT tracked the scammer’s operations through blockchain data and social media proof, identifying the individual as “Haby” or “Harvard.”
  • A boastful post by the scammer revealed a destination address, which led to uncovering numerous thefts and connecting them to a broader scheme.
  • Social media indicators, such as wallet balances and posts about lifestyle, assisted in pinpointing the scammer’s physical location in Abbotsford, Canada.
  • Blockchain analysis indicated that the pilfered funds were converted into Bitcoin and distributed across different addresses, occasionally being spent on gambling platforms.

A Canadian fraudster, pretending to be Coinbase support, is accused of stealing over $2 million from unsuspecting users. The individual, known by the aliases “Haby” or “Harvard,” conducted operations from Abbotsford, close to Vancouver. Utilizing a combination of phishing and social engineering tactics, the scammer took control of victim accounts by mimicking official Coinbase support.

ZachXBT Traces Scam Activities and Identifies the Thief

ZachXBT, a prominent blockchain investigator, discovered the scammer’s identity through meticulous tracking. In a recent report, ZachXBT disclosed that the perpetrator operated under the name “Haby,” targeting Coinbase users via diverse deceptive methods. The scammer’s actions were traced to a post on December 30, 2024, where they bragged about pilfering $44,000 worth of from a victim.

By means of blockchain tracing and examination of public postings, ZachXBT linked the misappropriated funds to numerous occurrences. He connected Haby’s XRP wallet to several instances of Coinbase account breaches. The aggregate value of verified thefts exceeded $2 million as more incidents came to light. As per ZachXBT, “The substantial evidence in this situation presents an exceptionally straightforward case for law enforcement.”

Scammer’s Social Media Footprint and On-Chain Evidence

The fraudster left a digital footprint across their social media profiles, including Telegram and Instagram. Images of Exodus wallet balances, acquisitions of unique usernames, and expenditures on lifestyle aided investigators in connecting the scam to particular Coinbase account compromises. These social media updates were crucial in narrowing down the scammer’s physical whereabouts to Abbotsford, British Columbia.

Blockchain data illustrated how the pilfered XRP was frequently converted into using rapid-exchange services. Subsequently, the funds were divided among numerous addresses and occasionally spent on online gambling platforms. A timing analysis uncovered a crucial Bitcoin address that linked several groups of thefts. This linkage exposed a wider pattern of systematic exploitation, involving the precise targeting of Coinbase users.

Coinbase Faces Increasing Threats from Impersonation Scams

Coinbase users have encountered elevated risks owing to a rise in impersonation frauds. The perpetrator responsible for the $2 million theft represents merely one instance of this expanding trend. In 2025, an internal data breach compromised sensitive client information, thereby facilitating highly potent phishing operations. The breach revealed names, email addresses, phone numbers, and other private details belonging to approximately 70,000 high-value customers.

Notwithstanding a public warning to the assailants, Coinbase responded by establishing a $20 million reward and reimbursing impacted victims. In December 2025, law enforcement initiatives led to the apprehension of Ronald Spektor, who pilfered $16 million from 100 Coinbase users. Spektor leveraged stolen customer data to mimic Coinbase support and arrange for fund transfers to his personal wallet.