Scammer Posing as Coinbase Agent Steals $2 Million

Crypto News Exploits

Scammer Posing as Coinbase Agent Allegedly Steals $2 Million

Written by Aaron S.,

Editor-In-Chief

Last Updated: December 30, 2025

Key Takeaways

ZachXBT claims to have identified a fake Coinbase support agent who stole around $2 million from unsuspecting crypto users;
The alleged scammer used social engineering, pretending to be Coinbase staff, to gain trust and trick victims into losing funds;
Despite attempts to hide online, the suspect’s frequent posts and changing Telegram accounts helped reveal their identity.

Stop overpaying - start transferring money with Ogvio. Sign up, invite friends & grab Rewards now! 🎁

Scammer Posing as Coinbase Agent Allegedly Steals $2 Million

BITDEGREE IN YOUR SOCIAL FEED

Blockchain investigator ZachXBT reported that he has identified the person behind a fake Coinbase $1.46B support scheme that took about $2 million from the platform’s users.

According to ZachXBT, he reviewed Telegram chat screenshots, public social media activity, and crypto wallet records to match patterns between them.

He said this comparison led him to the person who had posed as a Coinbase staff member to deceive users.

Candlesticks, Trendlines & Patterns Easily Explained (Animated Examples)

Did you know?

Want to get smarter & wealthier with crypto?

Subscribe - We publish new crypto explainer videos every week!

In his post, ZachXBT alleged that the “Canadian threat actor” had "stolen over $2 million via Coinbase support impersonation social engineering scams in the past year, blowing the funds on rare social media usernames, bottle service, & gambling".

The scam reportedly relied on social engineering, a tactic where someone pretends to represent a trusted company to gain a victim’s confidence. The suspect allegedly contacted Coinbase users while pretending to be part of the exchange’s support team.

ZachXBT also shared a video showing the person on a phone call with a victim by posing as a customer service.

He said the individual tried to cover their tracks by constantly changing Telegram usernames and deleting old profiles. However, ZachXBT noted that the suspect’s frequent posts about their lifestyle made it easy to trace them.

He added that the person regularly shared selfies and stories online by showing off wealth with "little regard for opsec and was also caught simping for eGirls".

Trust Wallet’s browser extension v2.68 suffered a $7 million breach due to a backdoor. What did Trust Wallet's team say? Read the full story.