An individual impersonating Coinbase support has been linked to a scam involving over $2 million in stolen funds. Blockchain investigator ZachXBT traced the fraudulent activities across XRP and Bitcoin, connecting multiple thefts to a Canadian known online as “Haby” or “Havard.” The scam, active from 2024 into early 2025, relied on social engineering tactics, with the perpetrator posing as a Coinbase representative on messaging platforms to deceive victims into granting access or approving fraudulent transactions.
Initially, the stolen funds were received in XRP due to its quick transaction times and low costs, before being converted into Bitcoin to obscure the trail. ZachXBT’s analysis identified a Bitcoin address consolidating the proceeds, with balances exceeding $230,000 at times in 2025. The suspect’s behavior, including sharing wallet balances and luxury spending in private chats, made the case unusually traceable.
Open-source intelligence linked the individual to social media accounts, providing further evidence of identity consistency. Despite the extensive evidence, prosecution remains uncertain due to jurisdictional challenges, although Canadian authorities may already be aware of the suspect’s identity.
