A Canadian threat actor known as Haby has stolen over $2 million from Coinbase users through elaborate social engineering scams, spending stolen funds on rare social media usernames, bottle service, and gambling according to blockchain investigator ZachXBT.
A Canadian threat actor known as Haby has stolen over $2 million from Coinbase users through elaborate social engineering scams, spending the stolen funds on rare social media usernames, bottle service, and gambling. The brazen scammer was exposed by blockchain investigator ZachXBT, who pieced together digital evidence from the perpetrator's own social media posts.
According to @zachxbt on X, Haby (Havard) is "a Canadian threat actor who has stolen $2M+ via Coinbase support impersonation social engineering scams in the past year blowing the funds on rare social media usernames, bottle service, & gambling."
The investigation began when Haby posted a screenshot in a group chat on December 30, 2024, showing a theft of 21,000 XRP worth approximately $44,000 from a Coinbase user. The stolen funds were traced to the XRP address rN7ddvk4DrGHZUrBfNARJEEAbPkky9Mwcz.
Three days later, Haby made another critical mistake by posting a screenshot from his Exodus wallet that revealed his Telegram and Instagram accounts.
ZachXBT tweeted that he "matched up the historical balances to the screenshot and found the XRP address linked to two other Coinbase user thefts for ~$500K total."
Trail of Digital Evidence Leads to Bitcoin Address
The investigator tracked how Haby converted his stolen XRP into Bitcoin through instant exchanges. Using timing analysis, ZachXBT located the scammer's Bitcoin address: bc1qn3k5cz3905p6k50r44pjlj2rl9qcy72flsq3zh.
According to the investigator's post, "in February 2025 Haby began showing off a wallet with $237K in a group chat. The historical BTC balance for bc1qn3k from Feb 1, 2025 matched a screenshot shared."
Further analysis revealed three additional Coinbase support impersonation thefts totaling over $560,000. The theft addresses included bc1qfqyrsrry6ujd9drgv6tpqru9qhu72demakackx, bc1qw2nqyjlasjx58v6w6shxhnzf8amggu2pv5mkey, and bc1qu0sx0qmwmn5wd4nk35axkq056ewnccrjzy2let.
A leaked video shows Haby as a caller during a social engineering attack on a target. The screen recording exposed critical information including the email habyclown@gmail.com and his Telegram account number.
@zachxbt revealed that "Haby frequently buys expensive Telegram usernames and deleted his most recent account two days ago."
His previous Telegram ID was 8157445457, while his recent ID was 8361120781. Additional Instagram screenshots revealed more social engineering thefts. One story post contained metadata showing "From Harvi's MacBook Air." Someone from his chat group even advised him to stop flexing about his crimes so openly.
Location Identified Through Social Media Posts
Haby regularly posted stories and selfies flaunting his lifestyle with little regard for operational security. The threat actor was also caught posting about egirls online.
ZachXBT stated that "Haby appears to be located in Abbotsford (near Vancouver) due to OSINT performed on his story posts."
Canadian law enforcement may already be familiar with Haby since several swatting attempts involving his personal details have occurred locally.
The investigator concluded that "unfortunately Canada is a jurisdiction that rarely ever prosecutes threat actors from The Com. I hope Canadian LE makes an exception as Haby shows zero remorse for victims and it is a rather easy case due to the large quantity of evidence available."
The case highlights the growing problem of social engineering scams targeting cryptocurrency exchange users, with Coinbase users losing an estimated $300 million annually to such schemes.
#CoinbaseScam #CryptoSecurity #SocialEngineering #ZachXBT #CryptoFraud
** Key Takeaways:**
- Canadian scammer Haby stole $2M+ from Coinbase users via support impersonation schemes in just one year
- ZachXBT traced stolen funds through XRP and Bitcoin addresses after Haby posted evidence on social media
- Threat actor located in Abbotsford, Canada shows zero remorse despite mounting digital evidence trail
Stay updated on the latest cryptocurrency news on our homepage.
Explore more in Latest News Category.
Related reading:
Key Topics
Crypto New Live
admin@cryptonewslive.org
Canadian Scammer Steals $2M+ From Coinbase Users
Blockchain investigator ZachXBT exposes Canadian threat actor Haby who stole over $2 million from Coinbase users through social engineering scams.