A year-long investigation linked “Haby” to a number of Coinbase assist scams.
On-chain investigator ZachXBT has detailed a year-long investigation right into a Canadian risk actor referred to as Haby, additionally known as Havard, who he claims has stolen greater than $2 million by means of Coinbase assist impersonation scams.
As per his newest findings, ZachXBT stated Haby used social engineering techniques to trick Coinbase customers into handing over entry to their funds, earlier than spending the stolen cash on uncommon social media usernames, bottle service, and playing.
Coinbase-Associated Theft Community
In accordance with the investigation, Haby overtly bragged about his actions in personal group chats. On December 30, 2024, he allegedly shared a screenshot exhibiting a theft of 21,000 XRP, value round $44,000 on the time, taken from a Coinbase consumer. Just a few days later, on January 3, 2025, he posted one other screenshot from his Exodus pockets that included hyperlinks to his Telegram and Instagram accounts.
ZachXBT stated he matched historic pockets balances to those screenshots and linked the XRP deal with to 2 different Coinbase-related thefts. This introduced the overall traced quantity to roughly $500,000. The investigator added that Haby frequently swapped stolen XRP into Bitcoin utilizing immediate alternate companies. By analyzing the timing of those swaps, he managed to determine a Bitcoin deal with linked to Haby.
Additional affirmation got here in February 2025, when Haby reportedly confirmed off a pockets stability of $237,000 in a gaggle chat, which matched the historic stability of the recognized Bitcoin deal with. Upon tracing transactions from that deal with, he discovered three extra Coinbase impersonation scams, which added greater than $560,000 to the overall stolen.
The publish additionally features a leaked video that allegedly exhibits Haby actively social engineering a sufferer, throughout which his e-mail deal with and Telegram contact had been uncovered. ZachXBT noticed that Haby often flaunted his life-style on Instagram and Telegram, typically ignoring fundamental operational safety at the same time as he was repeatedly warned by others to cease “flexing” his scams.
Based mostly on open-source intelligence from his social media posts, Haby is believed to be positioned in Abbotsford, close to Vancouver. ZachXBT stated Canadian regulation enforcement could already concentrate on him resulting from a number of swatting incidents linked to his private particulars, and urged authorities to take motion, whereas citing the big quantity of publicly out there proof and Haby’s obvious lack of regret for victims.
You might also like:
Social Engineering Assaults
Social engineering assaults are one of the critical threats dealing with crypto customers. An earlier report by ZachXBT revealed that not less than $65 million was stolen from Coinbase customers between December 2024 and January 2025 after attackers impersonated buyer assist utilizing spoofed emails and cellphone numbers.
Victims had been tricked into transferring funds or approving fraudulent pockets addresses.
Separate studies present the issue extends past a single platform. Within the first half of 2025, over $2 billion was stolen throughout the crypto sector, and greater than 80% of losses had been tied to social engineering and insider-related assaults.
One current case saw a single sufferer lose 783 Bitcoin, value about $91 million, after scammers posed as pockets assist. Safety specialists warn that leaked private knowledge and more and more convincing impersonation techniques are making these scams tougher to detect.
SECRET PARTNERSHIP BONUS for CryptoPotato readers: Use this link to register and unlock $1,500 in unique BingX Change rewards (restricted time supply).
