A year-long investigation linked “Haby” to a number of Coinbase help scams.
On-chain investigator ZachXBT has detailed a year-long investigation right into a Canadian risk actor generally known as Haby, additionally known as Havard, who he claims has stolen greater than $2 million by Coinbase help impersonation scams.
As per his newest findings, ZachXBT stated Haby used social engineering ways to trick Coinbase customers into handing over entry to their funds, earlier than spending the stolen cash on uncommon social media usernames, bottle service, and playing.
Coinbase-Associated Theft Community
In response to the investigation, Haby overtly bragged about his actions in non-public group chats. On December 30, 2024, he allegedly shared a screenshot displaying a theft of 21,000 XRP, value round $44,000 on the time, taken from a Coinbase person. A couple of days later, on January 3, 2025, he posted one other screenshot from his Exodus pockets that included hyperlinks to his Telegram and Instagram accounts.
ZachXBT stated he matched historic pockets balances to those screenshots and linked the XRP handle to 2 different Coinbase-related thefts. This introduced the whole traced quantity to roughly $500,000. The investigator added that Haby recurrently swapped stolen XRP into Bitcoin utilizing instantaneous change companies. By analyzing the timing of those swaps, he managed to determine a Bitcoin handle related to Haby.
Additional affirmation got here in February 2025, when Haby reportedly confirmed off a pockets steadiness of $237,000 in a gaggle chat, which matched the historic steadiness of the recognized Bitcoin handle. Upon tracing transactions from that handle, he discovered three extra Coinbase impersonation scams, which added greater than $560,000 to the whole stolen.
The publish additionally features a leaked video that allegedly exhibits Haby actively social engineering a sufferer, throughout which his e-mail handle and Telegram contact have been uncovered. ZachXBT noticed that Haby regularly flaunted his way of life on Instagram and Telegram, typically ignoring primary operational safety at the same time as he was repeatedly warned by others to cease “flexing” his scams.
Based mostly on open-source intelligence from his social media posts, Haby is believed to be situated in Abbotsford, close to Vancouver. ZachXBT stated Canadian regulation enforcement could already concentrate on him as a result of a number of swatting incidents linked to his private particulars, and urged authorities to take motion, whereas citing the massive quantity of publicly accessible proof and Haby’s obvious lack of regret for victims.
You may additionally like:
Social Engineering Assaults
Social engineering assaults are some of the severe threats dealing with crypto customers. An earlier report by ZachXBT revealed that at the very least $65 million was stolen from Coinbase customers between December 2024 and January 2025 after attackers impersonated buyer help utilizing spoofed emails and cellphone numbers.
Victims have been tricked into transferring funds or approving fraudulent pockets addresses.
Separate reviews present the issue extends past a single platform. Within the first half of 2025, over $2 billion was stolen throughout the crypto sector, and greater than 80% of losses have been tied to social engineering and insider-related assaults.
One latest case noticed a single sufferer lose 783 Bitcoin, value about $91 million, after scammers posed as pockets help. Safety consultants warn that leaked private information and more and more convincing impersonation ways are making these scams more durable to detect.
SECRET PARTNERSHIP BONUS for CryptoPotato readers: Use this hyperlink to register and unlock $1,500 in unique BingX Alternate rewards (restricted time provide).
