Canadian Scammer Steals $2M Posing as Coinbase Agent

In Brief

• A Canadian scammer has allegedly stolen about $2 million by impersonating Coinbase support.
• Investigators say the suspect openly shared evidence of the scams online.
• The case is just one of many in crypto-related scams, underscoring the need for more caution.

Shedrach Kongvong 2025-12-30

Crypto thieves have adopted different methods to steal from crypto owners, but some methods are more bold than others. In one of the boldest moves, a Canadian scammer has stolen $2 million from Coinbase users by pretending to be a customer support agent.

In an X post on December 29th, an investigator known as ZachXBT said the scammer has stolen the $2 million over the past year posing in a series of Coinbase support impersonation social engineering scams and has spent the stolen funds on frivolities such as rare social media usernames, bottle service, & gambling.

It all began on December 30th 2024 when the scammer reportedly shared a screenshot showing his 21,000 XRP ($44K) theft from a Coinbase user. As if oblivious of the consequences of his actions, the fraudster called Haby has shared several other screenshots and leaks that further confirm he is behind many social engineering thefts.

1/ Meet Haby (Havard), a Canadian threat actor who has stolen $2M+ via Coinbase support impersonation social engineering scams in the past year blowing the funds on rare social media usernames, bottle service, & gambling. pic.twitter.com/bBqrV7GmPi

— ZachXBT (@zachxbt) December 29, 2025

Social engineering is a manipulative tactic in cybersecurity in which a bad actor manipulates a victim into releasing sensitive information or details by earning their trust. In the process, they get to convince the victim to give personal details or funds in the case of this Canadian scammer.

For Haby, this was not a hidden agenda, because he shared details about his scams and spent the money lavishly on a flamboyant lifestyle. According to ZacXBT, one of Haby’s acquaintances warned him about flaunting his theft proceeds on the internet. Canadian authorities may already be aware of the scammer, but he may not face prosecution.

This is because Ontario, which is a major hub for threat actors from “The Com”, a large, decentralized, international online network of cybercriminals and violent extremist subcultures which Haby belongs to, is mostly reluctant about prosecuting such criminals. This leaves the victims at the mercy of such criminals and may explain the confidence Haby displays in showing off his criminal proceeds online.

The Worsening Crypto Scam situation

There is a growing trend of cybercriminals stealing assets from crypto users through various means. As a result, the U.S. government deployed a special unit to target crypto scams, especially those originating from Chinese actors.

Another old scam method known as address poisoning was recently pulled on a crypto whale leading to the loss of $50 million in USDT. With all these crimes, crypto users must be more careful and watchful especially in bull markets to avoid falling victims.