ChainThink report: "On-chain detective" ZachXBT disclosed on X platform that a Canadian hacker known as "Haby (Havard)" has stolen over $2 million in cryptocurrency assets through social engineering scams by impersonating Coinbase customer support over the past year, with the illicit funds reportedly spent on rare Telegram usernames, nightclub expenditures, and gambling.

ZachXBT's investigation revealed that Haby has recently been purchasing high-value Telegram usernames frequently and deleted their most recent account two days ago. Through open-source intelligence analysis of social media story posts, investigators have determined Haby is based in Abbotsford, near Vancouver, Canada. Although Canadian law enforcement may be aware of Haby’s activities, prosecutions for such cyber threat actors remain rare in the region.