On-chain investigator ZachXBT has successfully tracked down a fraudster who stole over $2 million in a year using social engineering techniques.
1/ Meet Haby (Havard), a Canadian threat actor who has stolen $2M+ via Coinbase support impersonation social engineering scams in the past year blowing the funds on rare social media usernames, bottle service, & gambling. pic.twitter.com/bBqrV7GmPi
— ZachXBT (@zachxbt) December 29, 2025
The investigation suggests the alleged criminal is a Canadian resident named Haby (Havard). He primarily posed as a technical support specialist for the cryptocurrency exchange Coinbase, frequently changing his social media names.
The expert began tracking the suspect from a group chat message dated December 30, 2024, where the scammer posted a screenshot of 21,000 XRP stolen from a user of an American trading platform.
On January 3, 2025, Haby posted an image of his Exodus wallet, revealing his Telegram and Instagram accounts. ZachXBT matched the wallet’s balance history with the images and found that the XRP address was linked to the theft of approximately $500,000 from two other Coinbase clients.
The on-chain detective managed to uncover the scammer’s Bitcoin address. Later, the criminal himself posted a screenshot with this wallet in one of the chats.
“I traced the source [of funds for the address] and discovered three instances of fund theft through fake Coinbase support accounts, resulting in the theft of over $560,000,” the expert added.
A video was also found online showing Haby contacting one of the victims. In the recording, he displays the email address habyclown@gmail.com and a Telegram account with a phone number.
According to ZachXBT, the scammer frequently purchased expensive usernames in the messenger and deleted his last profile a few days before the investigation was published.
“Haby regularly posts stories and selfies [on Instagram], showcasing his lifestyle without proper attention to security,” the researcher noted.
Based on geolocation data, the detective determined the scammer’s approximate location to be the city of Abbotsford. It is likely that Canadian law enforcement is already familiar with the suspect, as his personal information has been involved in several false police calls.
In August, a user lost 783 BTC (~$91 million at the time) in a social engineering attack.
