On-chain investigator ZachXBT has detailed a year-long investigation right into a Canadian risk actor often called Haby, additionally known as Havard, who he claims has stolen greater than $2 million via Coinbase assist impersonation scams.
As per his newest findings, ZachXBT mentioned Haby used social engineering techniques to trick Coinbase customers into handing over entry to their funds, earlier than spending the stolen cash on uncommon social media usernames, bottle service, and playing.
Coinbase-Associated Theft Community
In response to the investigation, Haby overtly bragged about his actions in personal group chats. On December 30, 2024, he allegedly shared a screenshot exhibiting a theft of 21,000 XRP, price round $44,000 on the time, taken from a Coinbase person. A couple of days later, on January 3, 2025, he posted one other screenshot from his Exodus pockets that included hyperlinks to his Telegram and Instagram accounts.
ZachXBT mentioned he matched historic pockets balances to those screenshots and linked the XRP deal with to 2 different Coinbase-related thefts. This introduced the overall traced quantity to roughly $500,000. The investigator added that Haby recurrently swapped stolen XRP into Bitcoin utilizing prompt alternate providers. By analyzing the timing of those swaps, he managed to establish a Bitcoin deal with linked to Haby.
Additional affirmation got here in February 2025, when Haby reportedly confirmed off a pockets steadiness of $237,000 in a bunch chat, which matched the historic steadiness of the recognized Bitcoin deal with. Upon tracing transactions from that deal with, he discovered three extra Coinbase impersonation scams, which added greater than $560,000 to the overall stolen.
The publish additionally features a leaked video that allegedly exhibits Haby actively social engineering a sufferer, throughout which his electronic mail deal with and Telegram contact have been uncovered. ZachXBT noticed that Haby often flaunted his life-style on Instagram and Telegram, usually ignoring primary operational safety whilst he was repeatedly warned by others to cease “flexing” his scams.
Primarily based on open-source intelligence from his social media posts, Haby is believed to be situated in Abbotsford, close to Vancouver. ZachXBT mentioned Canadian regulation enforcement might already concentrate on him attributable to a number of swatting incidents linked to his private particulars, and urged authorities to take motion, whereas citing the massive quantity of publicly accessible proof and Haby’s obvious lack of regret for victims.
Social Engineering Assaults
Social engineering assaults are some of the critical threats dealing with crypto customers. An earlier report by ZachXBT revealed that not less than $65 million was stolen from Coinbase customers between December 2024 and January 2025 after attackers impersonated buyer assist utilizing spoofed emails and cellphone numbers.
Victims have been tricked into transferring funds or approving fraudulent pockets addresses.
Separate stories present the issue extends past a single platform. Within the first half of 2025, over $2 billion was stolen throughout the crypto sector, and greater than 80% of losses have been tied to social engineering and insider-related assaults.
One latest case noticed a single sufferer lose 783 Bitcoin, price about $91 million, after scammers posed as pockets assist. Safety specialists warn that leaked private information and more and more convincing impersonation techniques are making these scams tougher to detect.
The publish ZachXBT Exposes ‘Haby,’ a Canadian Social Engineer Flaunting Stolen Crypto appeared first on CryptoPotato.