Yeliz Akmaca 
Crypto detective ZachXBT claims that a Canadian scammer stole over $2 million in crypto through Coinbase support impersonation scams. This coincides with a surge of social engineering incidents in 2025 and highlights the increasing prevalence of human-focused attacks in the Web3 ecosystem.
Human-Targeted Fraud
ZachXBT alleges on social media and Telegram that the scammer, known by the alias Haby (Havard), carried out operations starting in late 2024. Haby reportedly stole 21,000 XRP (approximately $44,000) and an additional $560,000 through Bitcoin wallets.
Leaked group chats reveal that by February 2025, Haby was boasting a wallet balance of $237,000. Videos show the scammer actively conducting social engineering calls and sharing contact information, with his flashy lifestyle compromising operational security.
ZachXBT has called on Canadian authorities to intervene. Haby’s lack of remorse toward victims and the abundance of evidence make the case relatively straightforward, though Canadian law enforcement rarely prosecutes such cyber crimes.
1/ Meet Haby (Havard), a Canadian threat actor who has stolen $2M+ via Coinbase support impersonation social engineering scams in the past year blowing the funds on rare social media usernames, bottle service, & gambling. pic.twitter.com/bBqrV7GmPi
— ZachXBT (@zachxbt) December 29, 2025
Tracking Stolen Crypto
On December 30, 2024, Haby shared a screenshot showing 44,000 USD worth of XRP stolen from a Coinbase user. The funds were sent to the XRP address rN7ddvk4DrGHZUrBfNARJEEAbPkky9Mwcz. A few days later, Haby posted another screenshot from his Exodus wallet, exposing his Telegram and Instagram accounts. ZachXBT matched past balances to identify a second XRP address.
This new address was linked to approximately $500,000 in two additional Coinbase support frauds. Investigations revealed Haby converted the stolen XRP to Bitcoin via instant transactions. Time analysis helped ZachXBT identify Haby’s Bitcoin address. The traced chain revealed multiple addresses were used, and further investigation uncovered three more Coinbase support scams, generating over $560,000 for the scammer.
Human Psychology in Web3
The case illustrates a growing security crisis in the crypto ecosystem. Scammers now target human psychology as much as technical vulnerabilities. North Korean actors attempting over $300 million in fake meetings and Ponzi schemes in India confirm this trend.
Crypto users must remain vigilant beyond technical security measures, as trust and haste remain the scammers’ most potent tools.
Social engineering losses in 2025 mark new breaking points for Web3 security, emphasizing that user caution is unavoidable.
You can also freely share your thoughts and comments about the topic in the comment section. Additionally, don’t forget to follow us on our Telegram, YouTube, and Twitter channels for the latest news and updates.