{"id":92787,"date":"2025-12-30T19:00:08","date_gmt":"2025-12-30T16:00:08","guid":{"rendered":"https:\/\/forklog.com\/en\/?p=92787"},"modified":"2025-12-30T19:05:24","modified_gmt":"2025-12-30T16:05:24","slug":"zachxbt-uncovers-2-million-crypto-scammer","status":"publish","type":"post","link":"https:\/\/forklog.com\/en\/zachxbt-uncovers-2-million-crypto-scammer\/","title":{"rendered":"ZachXBT Uncovers $2 Million Crypto Scammer"},"content":{"rendered":"<p>On-chain investigator ZachXBT has successfully tracked down a fraudster who stole over $2 million in a year using social engineering techniques.<\/p>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"en\" dir=\"ltr\">1\/ Meet Haby (Havard), a Canadian threat actor who has stolen $2M+ via Coinbase support impersonation social engineering scams in the past year blowing the funds on rare social media usernames, bottle service, &#038; gambling. <a href=\"https:\/\/t.co\/bBqrV7GmPi\">pic.twitter.com\/bBqrV7GmPi<\/a><\/p>\n<p>\u2014 ZachXBT (@zachxbt) <a href=\"https:\/\/twitter.com\/zachxbt\/status\/2005649181097205845?ref_src=twsrc%5Etfw\">December 29, 2025<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>The investigation suggests the alleged criminal is a Canadian resident named Haby (Havard). He primarily posed as a technical support specialist for the cryptocurrency exchange Coinbase, frequently changing his social media names.<\/p>\n<p>The expert began tracking the suspect from a group chat message dated December 30, 2024, where the scammer posted a screenshot of 21,000 XRP stolen from a user of an American trading platform.<\/p>\n<p>On January 3, 2025, Haby posted an image of his Exodus wallet, revealing his Telegram and Instagram accounts. ZachXBT matched the wallet&#8217;s balance history with the images and found that the XRP address was linked to the theft of approximately $500,000 from two other Coinbase clients.<\/p>\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"650\" src=\"https:\/\/forklog.com\/wp-content\/uploads\/img-6ce3533206e93b3d-2318697236530150-1024x650.png\" alt=\"image\" class=\"wp-image-272830\" srcset=\"https:\/\/forklog.com\/wp-content\/uploads\/img-6ce3533206e93b3d-2318697236530150-1024x650.png 1024w, https:\/\/forklog.com\/wp-content\/uploads\/img-6ce3533206e93b3d-2318697236530150-300x190.png 300w, https:\/\/forklog.com\/wp-content\/uploads\/img-6ce3533206e93b3d-2318697236530150-768x487.png 768w, https:\/\/forklog.com\/wp-content\/uploads\/img-6ce3533206e93b3d-2318697236530150.png 1210w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\">Movement of the scammer&#8217;s funds. Source: X.<\/figcaption><\/figure>\n<p>The on-chain detective managed to uncover the scammer&#8217;s Bitcoin address. Later, the criminal himself posted a screenshot with this wallet in one of the chats.<\/p>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>&#8220;I traced the source [of funds for the address] and discovered three instances of fund theft through fake Coinbase support accounts, resulting in the theft of over $560,000,&#8221; the expert added.<\/p>\n<\/blockquote>\n<p>A video was also found online showing Haby contacting one of the victims. In the recording, he displays the email address habyclown@gmail.com and a Telegram account with a phone number.<\/p>\n<p>According to ZachXBT, the scammer frequently purchased expensive usernames in the messenger and deleted his last profile a few days before the investigation was published.<\/p>\n<figure class=\"wp-block-image size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" width=\"514\" height=\"1024\" src=\"https:\/\/forklog.com\/wp-content\/uploads\/img-145e8462a111457b-2318697472910805-514x1024.png\" alt=\"image\" class=\"wp-image-272831\" style=\"width:319px;height:auto\" srcset=\"https:\/\/forklog.com\/wp-content\/uploads\/img-145e8462a111457b-2318697472910805-514x1024.png 514w, https:\/\/forklog.com\/wp-content\/uploads\/img-145e8462a111457b-2318697472910805-151x300.png 151w, https:\/\/forklog.com\/wp-content\/uploads\/img-145e8462a111457b-2318697472910805-768x1529.png 768w, https:\/\/forklog.com\/wp-content\/uploads\/img-145e8462a111457b-2318697472910805-772x1536.png 772w, https:\/\/forklog.com\/wp-content\/uploads\/img-145e8462a111457b-2318697472910805.png 828w\" sizes=\"auto, (max-width: 514px) 100vw, 514px\" \/><figcaption class=\"wp-element-caption\">Haby&#8217;s social media photo. Source: X.<\/figcaption><\/figure>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>&#8220;Haby regularly posts stories and selfies [on Instagram], showcasing his lifestyle without proper attention to security,&#8221; the researcher noted.<\/p>\n<\/blockquote>\n<p>Based on geolocation data, the detective determined the scammer&#8217;s approximate location to be the city of Abbotsford. It is likely that Canadian law enforcement is already familiar with the suspect, as his personal information has been involved in several false police calls.<\/p>\n<p>In August, a user <a href=\"https:\/\/forklog.com\/en\/news\/bitcoin-investor-defrauded-of-91-million\">lost<\/a> 783 BTC (~$91 million at the time) in a social engineering attack.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>On-chain investigator ZachXBT has successfully tracked down a fraudster who stole over $2 million in a year using social engineering techniques.<\/p>\n","protected":false},"author":1,"featured_media":92788,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"select":"1","news_style_id":"1","cryptorium_level":"","_short_excerpt_text":"ZachXBT tracks down a fraudster who stole over $2 million using social engineering.","creation_source":"","_metatest_mainpost_news_update":false,"footnotes":""},"categories":[3],"tags":[1154,1323,1246],"class_list":["post-92787","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news-and-analysis","tag-crimes","tag-investigations","tag-scammers"],"aioseo_notices":[],"amp_enabled":true,"views":"254","promo_type":"1","layout_type":"1","short_excerpt":"ZachXBT tracks down a fraudster who stole over $2 million using social engineering.","is_update":"","_links":{"self":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/92787","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/comments?post=92787"}],"version-history":[{"count":1,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/92787\/revisions"}],"predecessor-version":[{"id":92789,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/92787\/revisions\/92789"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media\/92788"}],"wp:attachment":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media?parent=92787"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/categories?post=92787"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/tags?post=92787"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}