ZachXBT linked a fake Coinbase support scam to more than $2 million in crypto losses, according to a report based on his X post.
The report said the suspect posed as a Coinbase help desk worker and targeted exchange users.
ZachXBT said he traced the case by comparing Telegram screenshots, public posts, and wallet transactions. He described the suspect as a “Canadian threat actor.”
The report said ZachXBT shared a leaked video that showed the alleged scammer speaking with a victim. In that call, the suspect presented the interaction as customer support.
ZachXBT tracks Coinbase support impersonation across Telegram and wallets
ZachXBT said he cross referenced Telegram group chat screenshots, social media posts, and on chain activity. He said those pieces matched patterns tied to the same actor.
In his thread, ZachXBT wrote the suspect “stolen $2M+ via Coinbase support impersonation social engineering scams in the past year,” and said the suspect spent the funds on “rare social media usernames, bottle service, & gambling.”
The report said the investigation relied on links between identities and transactions. It also said ZachXBT used what he described as leaked material to connect accounts and activity.
Fake Coinbase support scam used social engineering scam phone calls
The report said the alleged scammer ran a social engineering scam by posing as Coinbase support. It said the goal was to gain trust and push victims toward actions that led to losses.
ZachXBT shared a clip described as a leaked phone call with a victim. The report said the call presented itself as customer support and aimed to appear official.
ZachXBT pointed to details inside the recording.
“In the screen recording he leaks the email…. and his Telegram account with a number,”
he wrote.
Telegram usernames and “opsec” slips helped ZachXBT follow the trail
ZachXBT said the alleged scammer tried to limit traces by repeatedly buying “expensive Telegram usernames” and deleting older accounts.
The report said ZachXBT still connected the changes through linked activity.
ZachXBT said the suspect posted content that exposed identity and movement.
He described “constant gloating on social media” and shared screenshots he said showed “stories and selfies.”
The report said ZachXBT claimed he derived a home address using public information. It said he did not publish the address because of X terms of service.
The report also said ZachXBT cited poor operational security and posted examples, including a line that the suspect showed “little regard for opsec” and that he “was also caught simping for eGirls.”
Disclosure:This article does not contain investment advice or recommendations. Every investment and trading move involves risk, and readers should conduct their own research when making a decision.
Kriptoworld.com accepts no liability for any errors in the articles or for any financial loss resulting from incorrect information.
Tatevik Avetisyan is an editor at Kriptoworld who covers emerging crypto trends, blockchain innovation, and altcoin developments. She is passionate about breaking down complex stories for a global audience and making digital finance more accessible.
📅 Published: December 30, 2025 • 🕓 Last updated: December 30, 2025
