Investigator ZachXBT Links Canadian ‘Haby’ to $2M+ Coinbase Support Scams
On-chain investigator ZachXBT published a year-long probe tying a Canadian social engineer known as “Haby” (aka Havard) to more than $2 million in thefts from Coinbase users through customer-support impersonation scams. ZachXBT linked stolen funds by matching screenshots Haby posted in private chats to historical wallet balances and traced multiple XRP thefts (including a 21,000 XRP incident). He tracked swaps of stolen XRP into BTC via instant exchanges and identified Bitcoin addresses with matching historical balances. Traced incidents include roughly $500,000 from XRP-linked thefts and about $560,000 from three Coinbase impersonation scams, with total attributable losses exceeding $2 million. Leaked call recordings and other materials allegedly show Haby actively social engineering victims and exposing contact details. ZachXBT also reports Haby flaunted proceeds on Instagram and Telegram, frequently bought and deleted Telegram accounts to hide activity, and appears to live in Abbotsford, British Columbia. The investigation urges Canadian authorities to act, citing abundant open-source evidence and prior swatting incidents linked to the suspect’s personal data. The report reinforces a broader industry pattern: ZachXBT previously attributed approximately $65 million in Coinbase impersonation losses between Dec 2024–Jan 2025, and industry figures point to billions lost in 2025 with over 80% tied to social engineering and insider-related attacks. For traders: the case highlights persistent custodial risk from support-impersonation scams, the typical laundering paths (instant exchanges, gambling sites, privacy coins), and the importance of strong personal OPSEC. Expect potential regulatory or platform responses aimed at reducing impersonation fraud and increased on-chain scrutiny of funds moving through exchanges and mixers.
Bearish
This news is bearish for the directly mentioned assets and custodial sentiment. The report documents thefts involving XRP and subsequent swaps into BTC; these incidents increase perceived custodial risk for Coinbase users and highlight active laundering through instant exchanges. Short-term impact: heightened sell pressure is possible as users withdraw funds from custodial platforms or convert holdings to self-custody, and affected on-chain addresses moving into exchanges could create temporary selling into BTC markets. Long-term impact: repeated impersonation scams may depress confidence in custodial services, encourage outflows to self-custody and stablecoins, and prompt stricter platform controls that can reduce liquidity or change on-chain flow patterns. Market reaction is likely muted for large-cap assets overall but negative for XRP and could elevate volatility for BTC during active sweep-and-sell operations tied to traced thefts. Overall, the story reinforces downside pressure on assets subject to visible theft and custodial risk.