A sophisticated social-engineering scam targeting Coinbase users has been uncovered by prominent blockchain investigator ZachXBT, who alleges the operation has siphoned off more than $2 million in cryptocurrency over the past year.
According to a detailed report published by the investigator on X (formerly Twitter), the scheme involved a threat actor impersonating Coinbase customer support, convincing victims to grant account access under the guise of receiving technical assistance.Â
Once control was obtained, funds were quickly drained and laundered through a network of crypto wallets.
The individual behind the scheme, identified only by the online alias “Haby” or “Havard,” allegedly flaunted stolen funds in private Telegram group chats, posting screenshots of recent transfers and digital wallet balances.
One such image, dated Dec. 30, 2024, showcased a 21,000 XRP (~$44,000) theft. Another screenshot from Jan. 3, 2025, reportedly revealed the same user’s Exodus wallet linked to Telegram and Instagram usernames.
Through historical balance matching and timing analysis of transactions, ZachXBT connected multiple XRP and Bitcoin wallet addresses to the same actor, tying them to at least five separate Coinbase user thefts totaling more than $1 million.
Additional tracing of Bitcoin movements uncovered several more wallet addresses linked to the scam, pushing the estimated total proceeds above $2 million.
The stolen funds were swiftly swapped into Bitcoin via instant-exchange services, a move investigators say was likely intended to obscure their trail.
In February 2025, the alleged scammer was seen boasting in chats about a wallet holding more than $230,000, which matched the value on one of the identified Bitcoin addresses during that period.
ZachXBT’s report highlights the ongoing threat of phishing and customer-service impersonation attacks against crypto users, even on major regulated platforms.
He urged exchanges and wallets to strengthen identity-verification protocols for support interactions and warned users to never share account credentials or remote access with unsolicited representatives.
Coinbase has not publicly commented on this specific case, though the exchange has repeatedly issued warnings about impersonation scams targeting its customer base.
The investigation remains ongoing, with additional victims and wallet links expected to surface as analysis continues.