Crypto sleuth ZachXBT exposes Canadian threat actor Haby who stole over $2M via Coinbase impersonation scams, splurging on luxuries.
A Canadian threat actor has stolen over $2 million through elaborate Coinbase support impersonation scams. Crypto investigator ZachXBT revealed the extensive operation on social media platform X.
The scammer, identified as Haby (Harvard), operates from Abbotsford near Vancouver. He spent his ill-gotten gains on rare social media usernames, bottle service, and gambling.
ZachXBT shared detailed evidence of the crimes.
On December 30, 2024, Haby posted a screenshot showing a $44,000 XRP theft from a Coinbase user. The stolen funds went to the XRP address rN7ddvk4DrGHZUrBfNARJEEAbPkky9Mwcz.
Tracing The Stolen Crypto
Three days later, Haby posted another screenshot from his Exodus wallet.
The post revealed his Telegram and Instagram accounts. ZachXBT matched historical balances to the screenshot and uncovered another XRP address. This address linked to two additional Coinbase thefts totaling approximately $500,000.
The investigator explained how Haby converted his stolen XRP into Bitcoin through instant exchanges. Through timing analysis, ZachXBT located Haby’s Bitcoin address: bc1qn3k5cz3905p6k50r44pjlj2rl9qcy72flsq3zh.
Further investigation revealed three more Coinbase support impersonation thefts. These additional scams netted over $560,000. ZachXBT traced the funds back through multiple theft addresses.
Related Reading: ZachXBT Exposes Bitcoin Bridge Garden Finance Hack
Evidence Mounts Against The Scammer
A leaked video shows Haby social engineering a target over the phone. The screen recording exposed his email address [email protected] and his Telegram account number.
According to ZachXBT, Haby frequently purchases expensive Telegram usernames. He deleted his most recent account two days before the investigation went public. His previous Telegram ID was 8157445457, while his recent ID was 8361120781.
Additional Instagram screenshots reveal more social engineering thefts. One story post leaked metadata showing “From Harvi’s MacBook Air.” Someone from his chat group advised him to stop posting about his crimes so openly.
ZachXBT noted that Haby regularly posts stories and selfies flaunting his lifestyle. The scammer shows little concern for operational security. He was even caught pursuing romantic interests online.
The investigator located Haby in Abbotsford through analysis of his social media posts. Several swatting attempts involving his personal details have already occurred locally.
ZachXBT expressed hope that Canadian law enforcement will prosecute this case. He noted that Canada rarely prosecutes threat actors from “The Com.” However, the large quantity of available evidence makes this an easy case to build.
The scammer shows zero remorse for his victims, according to the investigator.
Source: https://www.livebitcoinnews.com/crypto-sleuth-zachxbt-unmasks-2m-coinbase-scammer-in-canada/
