Подозреваемый из Канады, использующий ложные аккаунты для кражи более $2 миллионов, обнаружен исследователем ZachXBT Translation: Headline: Canadian Suspect Using Fake Accounts to Steal Over $2 Million Discovered by Researcher ZachXBT

On-chain investigator ZachXBT successfully traced a scammer who stole over $2 million within a year by employing social engineering techniques.

The inquiry indicates that the suspected culprit is a Canadian named Habi (Ghavard). He primarily posed as a technical support agent for the cryptocurrency exchange Coinbase, frequently changing his names on social media platforms.

The expert began tracking the suspect following a message in a group chat dated December 30, 2024, where the scammer shared a screenshot revealing the theft of 21,000 XRP from a user of an American trading platform.

On January 3, 2025, Habi shared a screenshot of his Exodus wallet, which displayed his accounts on Telegram and Instagram. ZachXBT matched the wallet’s balance history with the images provided and discovered that the XRP address was connected to the theft of approximately $500,000 from two other Coinbase clients.

The on-chain sleuth was able to identify the scammer’s Bitcoin address after the perpetrator inadvertently posted a screenshot of that wallet in one of the chats.

«I traced the source of [the funds to the address] and found three instances of theft through fake Coinbase support accounts, leading to an additional loss of over $560,000,» added the expert.

Furthermore, a video surfaced online showing Habi contacting one of the victims, where he revealed the email address habyclown@gmail.com and a Telegram account along with a phone number.

According to ZachXBT, the scammer frequently purchased expensive usernames in the messenger and deleted his last profile just days before the investigation was made public.

«Habi often shares stories and selfies [on Instagram], showcasing his lifestyle without adequate attention to security,» noted the researcher.

Using geolocation data, the investigator narrowed down the scammer’s approximate location to the city of Abbotsford. It is likely that Canadian law enforcement is already aware of the suspect, as his personal information has been involved in false police calls on multiple occasions.

Recall that in August, a user lost 783 BTC (~$91 million at the time) as a result of a social engineering attack.