ZachXBT has unmasked a Canadian scammer who allegedly stole more than 2 million dollars by posing as Coinbase support, adding another high‑profile takedown to his growing body of on‑chain investigations.
A Year-Long Coinbase Support Impersonation Scam
According to ZachXBT’s latest investigation, the scammer operated under the alias “Haby” or “Harvard” and based operations in Abbotsford, near Vancouver. He allegedly ran a series of phishing and social‑engineering schemes that targeted Coinbase users, convincing victims they were speaking with official support while he guided them into handing over control of their accounts and wallets.
On December 30, 2024, Haby publicly posted a screenshot bragging about stealing 44,000 dollars’ worth of XRP from a Coinbase user, inadvertently exposing the destination address used in the theft.
ZachXBT traced the XRP wallet and linked it to multiple other incidents, ultimately connecting several Coinbase account compromises, pushing total confirmed thefts above $2 million.
On-Chain Forensics and Pressure on Canadian Law Enforcement
The investigation combined on‑chain tracing with open‑source intelligence pulled from Haby’s own social media, including Telegram and Instagram accounts that he repeatedly reused and reshuffled. Screenshots of Exodus wallet balances, rare username purchases, and nightlife spending created a breadcrumb trail that enabled ZachXBT to link wallet histories to public flexes.
On-chain Sleut ZachXBT showed how stolen XRP often moved into Bitcoin through instant‑exchange services before being split across addresses and sometimes funneled into gambling sites. Timing analysis around these swaps revealed a key Bitcoin address that linked several clusters of thefts, turning isolated incidents into a coherent pattern of systematic abuse.
A leaked video of a live social‑engineering call further exposed Haby’s email and Telegram details, tightening the link between his online persona and the wallets used in the scam. Location clues from selfies and story posts helped narrow his real‑world footprint to specific neighborhoods around Abbotsford.
ZachXBT has urged Canadian authorities to act on the extensive evidence, noting that enforcement against domestic crypto threat actors has historically lagged despite clear digital trails. He argues that this case presents an unusually “easy win” given the volume of on‑chain data, screenshots, and self‑incriminating posts.
READ MORE: TRON (TRX) Holds Support as Analysts Track BTC-Pair Breakout Setup
