ZachXBT вскрывает личность канадского криптоскамеры, укравшего более $2 млн через социальную инженерию Translation: ZachXBT uncovers the identity of a Canadian crypto scammer who stole over $2 million through social engineering

On-chain investigator ZachXBT has managed to track down a scammer who stole over $2 million within a year using social engineering techniques.

The investigation revealed that the alleged perpetrator is a Canadian named Habib (Ghaward). He primarily posed as a technical support representative for the cryptocurrency exchange Coinbase while frequently changing his names on social media.

The expert began tracing the suspect after a message in a group chat from December 30, 2024, in which the scammer shared a screenshot showing the theft of 21,000 XRP from a user of an American trading platform.

On January 3, 2025, Habib shared a snapshot of his Exodus wallet, which exposed his accounts on Telegram and Instagram. ZachXBT cross-referenced the wallet balance history with the images and discovered that the XRP address was linked to the theft of approximately $500,000 from two other Coinbase clients.

The on-chain sleuth succeeded in identifying the scammer’s Bitcoin address, which the criminal revealed in a chat by sharing a screenshot of the wallet.

“I traced the source [of the funds for the address] and found three instances of theft through fake Coinbase support accounts, resulting in an additional $560,000 being stolen,” the expert added.

A video was also uncovered showing Habib contacting one of his victims. In the footage, he displays the email address habyclown@gmail.com and a Telegram account linked to a specific phone number.

According to ZachXBT, the scammer frequently purchased expensive usernames in the messaging app and deleted his last profile just a few days before the investigation’s publication.

“Habib regularly posts stories and selfies [on Instagram], showcasing his lifestyle without proper security precautions,” the researcher noted.

Based on geolocation data, the investigator pinpointed the scammer’s approximate location to the city of Abbotsford. It is likely that Canadian law enforcement is already familiar with the suspect, as his personal information has been involved in false police calls on several occasions.

It is worth remembering that in August, a user lost 783 BTC (approximately $91 million at the time) as a result of a social engineering attack.