ZachXBT says fake Coinbase support agent may have stolen over $2M

Well-known crypto detective ZachXBT wrote that he compared screenshots from Telegram chats, social media posts, and wallet activity onchain. He said that work led him to a “Canadian suspect” and helped him connect multiple incidents to the same person.

As an example, the researcher shared what he described as a leaked video. In it, someone on a call plays the role of customer support and speaks as if they’re helping fix an account problem. ZachXBT did not lay out the full playbook step by step, but the pattern is familiar: create urgency, build trust, and then push the target to hand over access or approve a transfer.

According to ZachXBT, the suspect tried to cover their tracks by regularly buying expensive Telegram usernames and deleting older accounts. He also claimed the scammer showed off their lifestyle too often, which ended up leaving additional clues. ZachXBT added that he was able to identify a home address using open-source information but chose not to publish it.

In recent weeks, ZachXBT has appeared in multiple reports as someone who collects victim addresses and pieces together scattered complaints into a single timeline. In December, for example, he warned Trust Wallet users about suspicious drains that coincided with a Chrome extension update. In the Coinbase-related case, he’s describing similar investigative work, but with a different kind of risk: not malicious code, but impersonation and persuasion.

The basic rule is simple: legitimate support staff won’t ask for your seed phrase, 2FA codes, or password. They won’t tell you to “move funds to a safe address,” and they won’t push you to continue the conversation on Telegram. If you get an unsolicited call or message claiming to be support, end the conversation and contact the company through the official website or app.