Blockchain investigator ZachXBT posted OSINT linking a Canada-based actor to a year-long campaign that impersonated Coinbase support and social-engineered users to steal more than $2 million in crypto. The tracing shows conversions of stolen tokens through instant exchanges and renews calls for stronger support-channel safeguards.

Independent investigator ZachXBT published open-source intelligence suggesting a Canada-based individual or network operated a long-running impersonation scam that posed as Coinbase customer support to socially engineer users into surrendering access and authorizing transfers. The reconstruction alleges more than $2 million in crypto was stolen over roughly a year, with perpetrators rapidly converting tokens via instant swap services and exit routes that thwart recovery efforts. The report includes transaction trails, alleged account links, and patterns consistent with targeted support impersonation, renewing law-enforcement and industry focus on human-factor vulnerabilities in exchange support channels. Advocates say the case underlines the persistence of social-engineering tactics despite platform warnings, and they are urging exchanges to harden verification, implement callback mechanisms, and expand fraud detection around support interactions. Canadian and international investigators have been asked to review the OSINT to determine whether criminal charges and cross-border cooperation are warranted.