A Canadian threat actor known as Haby (also referenced as Havard) is accused of stealing over $2 million in cryptocurrency over the past year by impersonating Coinbase support in social engineering schemes, with evidence including wallets, chats, and a leaked video.

The operation relied on social engineering rather than hacking Coinbase systems, with the attacker posing as official support to extract sensitive information or authorize transfers to wallets under his control.

Victims were targeted through impersonation of Coinbase helpers, predominantly via false support channels on Telegram and fake chats, culminating in more than $2 million in losses.

Defensive guidance warns against clicking unsolicited links, resisting cold calls, never sharing seed phrases or private wallet details, and avoiding redirections to conversations on apps like Telegram.

Contextual highlights include related 2025 security concerns and enforcement actions, such as a December 2025 Indian multi-location crypto scam bust and a Kerberus report identifying human error as a leading risk factor in Web3 security.

The piece points readers to related material on social engineering risks in crypto and references Cointelegraph for further reading on crypto-safety and on-chain crime-fighting efforts.

Haby’s digital footprint includes Telegram usernames, Instagram activity, and metadata from a post referencing a MacBook, indicating conspicuous public exposure of his activities.

This case fits a broader trend where social engineering and brand impersonation are rising as primary attack vectors, rather than purely technical exploits, with parallels to phishing campaigns and other actor-based impersonations.

The investigator urged Canadian law enforcement action, noting prosecutions of such threat actors from “The Com” are uncommon in Canada, but the available evidence could support a strong case.

ZachXBT suggests authorities may already be aware of Haby due to swatting attempts, urging intervention and highlighting this case as a significant human-targeted risk in Web3.

The article emphasizes a shift toward exploiting human psychology—trust, authority, and urgency—as core attack strategies across the crypto ecosystem.

Public records indicate the scammer’s home address was inferred from open data but not published due to platform terms, reflecting ongoing investigative nuance.