How Coinbase’s “Help Desk” Stole More Than $2 Million From Exchange Customers

• ZachXBT accuses Canadian fraudster of stealing $2 million from Coinbase customers.
• The investigation revealed that the attacker used social engineering methods in his work.
• Fraud against humans has become one of the biggest security threats in the Web3 ecosystem.

Crypto detective ZachXBT is on the trail of a Canadian fraudster who used social engineering to steal more than $2 million in cryptocurrencies by posing as Coinbase Support.

We tell you exactly how an enterprising attacker managed to pull off the scam.

How the scammer did it

In his insightful post, ZachXBT cited Telegram screenshots, social media messages and crypto transactions that indicate the involvement of a certain Khabi (Howard) in the theft of $2 million from Coinbase customers.

"Meet Xabi (Havard), a Canadian fraudster who stole over $2 million through social engineering scams last year. He posed as a Coinbase support specialist. The fraudster spent the funds received on rare usernames on social networks and gambling," the investigator writes.

During the investigation, ZachXBT tracked the alleged scammer's activities since the end of 2024.

An investigator shared a screenshot allegedly posted by Xabi in December 2024 showing the theft of 21,000 XRP, worth about $44,000, from a Coinbase user.

Further analysis of the wallet linked the Bitcoin address attributed to the suspected fraudster to additional thefts of more than $560,000.In group chats reviewed by ZachXBT, the man bragged about his loot. Including that, we are talking about $237,000 remaining in his wallets as of February 2025.

Leaked video indicates that the scammer uses social engineering in his work. The video contained an email address and a Telegram account linked to the same online ID.

“Additional screenshots from his social media show further social engineering thefts,” says ZachXBT.

Despite the significant scale of the theft, Xabi's work was not known for its operational security. The investigator recorded that the fraudster posted selfies and posts demonstrating his lifestyle. Finally, ZachXBT called on the Canadian authorities to intervene in the situation.

“Canadian law enforcement may already be familiar with Xabi, as there have been several attempts to “destroy” his personal information at the local level. Unfortunately, Canada is a jurisdiction where outside fraudsters are rarely prosecuted.I hope that the Canadian police make an exception because Xabi has no remorse towards the victims and this is a fairly simple case due to the large amount of evidence available,” wrote the author of the investigation.

Crypto fraud is widespread

Khabi has become a symbol of the security crisis in the cryptocurrency industry.Fraudsters are increasingly relying on social engineering instead of purely technical exploits.Many impersonate a brand to gain trust and lure victims.In a recent phishing campaign, attackers impersonated Booking.com while promoting a fake cryptocurrency summit in Dubai.

Earlier this month, BeInCrypto wrote that North Korean scammers impersonated crypto industry figures in Zoom and Microsoft Teams meetings to steal more than $300 million.

In addition, in December 2025, Indian authorities conducted a raid to liquidate the cryptocurrency Ponzi scheme, whose creators had defrauded gullible investors for about ten years.

The incidents make it clear that, in addition to technical vulnerabilities, human psychology has also become the main target of attacks. Instead of using code, attackers are increasingly manipulating trust and authority.