Haby, a Canadian threat actor, used social-engineering scams to steal over $2M in Coinbase accounts to spend it on bottle service and rare usernames.
One Canadian cybercriminal has stolen more than 2 million dollars from Coinbase users. The fraudster, Haby, employed social-engineering gimmicks and spent the stolen money on extravagances and gambling. 🍸💸
The scheme was uncovered by ZachXBT. This offender committed some crucial errors by posting evidence on the internet. ZachXBT wrote about Haby on X, calling him a Canadian threat actor who stole between 2 and 3 million dollars through Coinbase support impersonation. 🕵️♂️
Digital Trail Exposes Cryptocurrency Thief
The probe started on December 30, 2024. Haby shared a screenshot of a theft of 21,000⁻XRP, estimated to be over $44 000 by a single user of Coinbase. 📸
ZachXBT traced the money to a particular XRP address. Three days later, Haby posted another screenshot of his wallet with Exodus, which showed his Telegram and Instagram accounts. 📱
The researcher compared historical wallet balances with the screenshots. On X, ZachXBT claimed that he discovered the XRP account associated with two other Coinbase user thefts, totaling approximately 500,000. The scammer exchanged the stolen XRP for Bitcoin and instant exchanges. 💸
You might also like: Waters Calls SEC Crypto Approach Into Question
Lavish Spending and Zero Operational Security
Haby used to boast about his lifestyle online, sharing stories and selfies with minimal restraint. ZachXBT claims that in February 2025, Haby started displaying a wallet containing $237 K in a group chat. 📱
The investigator identified the Bitcoin address of Haby using timing. Additional research indicated that three more thefts amounted to in excess of 560K. A video was leaked showing Haby performing a social-engineering attack. 🎥
On X, ZachXBT disclosed that Haby often purchases costly Telegram names and has erased the last account two days earlier. His Telegram IDs were 8157445457 and 8361120781. More evidence of theft was captured in Instagram screenshots. 📷
Metadata was disclosed in one of the story posts. It showed “MacBook Air by Harvi. A member of his chat room told him not to keep sharing about his crimes. 🚨
ZachXBT spotted Haby using social media. The investigator wrote: Haby seems to be in Abbotsford (around Vancouver). Local swatting cases may already have placed him on the radar of Canadian law enforcement. 🕵️♂️
The researcher observed that Canada does not often prosecute these threat actors. ZachXBT said that he hopes that Canadian LE will make an exception because Haby does not show any regret towards the victims. The case exhibits the security weaknesses of cryptocurrency exchanges. Every year, users of Coinbase fall prey to social-engineering attacks, costing them an estimated three hundred million dollars. 💸
Read More
- Adolescence’s Co-Creator Is Making A Lord Of The Flies Show. Everything We Know About The Book-To-Screen Adaptation
- The Batman 2 Villain Update Backs Up DC Movie Rumor
- Travis And Jason Kelce Revealed Where The Life Of A Showgirl Ended Up In Their Spotify Wrapped (And They Kept It 100)
- Crypto prices today (18 Nov): BTC breaks $90K floor, ETH, SOL, XRP bleed as liquidations top $1B
- World of Warcraft Decor Treasure Hunt riddle answers & locations
- My Favorite Coen Brothers Movie Is Probably Their Most Overlooked, And It’s The Only One That Has Won The Palme d’Or!
- Decoding Cause and Effect: AI Predicts Traffic with Human-Like Reasoning
- Will there be a Wicked 3? Wicked for Good stars have conflicting opinions
- Games of December 2025. We end the year with two Japanese gems and an old-school platformer
- New survival game in the Forest series will take us to a sci-fi setting. The first trailer promises a great challenge
2025-12-31 21:37