Canadian Scammer Drains $2M from Coinbase Users via Impersonation Scheme

An alleged scammer impersonating a Coinbase support representative has reportedly stolen over $2 million from users of the cryptocurrency exchange, according to blockchain investigator ZachXBT. The scam, which has been uncovered through the analysis of social media posts, wallet transactions, and leaked video evidence, highlights the growing threat of social engineering in the digital asset space. The individual, described as a Canadian, allegedly used fake customer support tactics to extract private data and funds from unsuspecting users.

ZachXBT shared details of the scam in a Monday post, noting that the scammer spent the stolen funds on social media usernames, bottle service, and gambling. The investigator also revealed that the suspect attempted to cover his tracks by frequently changing Telegram usernames and deleting old accounts. Despite these efforts, the scammer's identity and activities were easily uncovered due to excessive social media sharing and poor operational security.

Further evidence of the scam includes a leaked video showing the alleged fraudster speaking with a victim over the phone, offering false customer support. The video also features the scammer's personal email and a number associated with their Telegram account. This kind of impersonation has become increasingly common as attackers exploit victims' trust in customer service channels.

The Rise of Social Engineering in Crypto

Social engineering attacks have become a major vector for crypto-related theft in 2025. According to Gideon Cohen, Security Advisor to SQHWYD GLOBAL Ltd., the year marked a turning point in how digital assets are stored and protected. The advisory firm Halborn, which Cohen founded, issued a report outlining how traditional cold storage methods proved insufficient for high-frequency trading environments. Over 60% of major exchange hacks in 2025 involved the compromise of static private keys stored in conventional methods.

Cohen argues that the "Bunker Model" of security failed this year due to the prevalence of insider threats and sophisticated phishing attacks. Many breaches occurred after attackers spent months moving laterally through corporate networks before accessing and exfiltrating sensitive data. This trend underscores the need for more advanced custodial solutions like Multi-Party Computation (MPC), which split cryptographic keys into multiple parts to prevent a single point of failure.

Lessons for Investors and Users

The Coinbase scam and broader 2025 security failures highlight the importance of proactive measures for digital asset holders. ZachXBT emphasized the need for users to remain vigilant about safeguarding private data, avoid reusing passwords, and store significant holdings in hardware wallets rather than on exchanges. Social engineering tactics often rely on human error, making user education a critical defense layer.

Cohen's advisory also highlights the role of cyber insurance in shaping institutional custody practices. According to the advisory, major insurers now require institutions to use MPC-based architectures to qualify for coverage, effectively making it a baseline for security in 2025. This shift reflects a broader industry recognition that traditional security models are no longer sufficient to protect against evolving threats.

The Coinbase support scam serves as a stark reminder of the vulnerabilities in the crypto ecosystem and the importance of adopting more robust security practices. As the industry continues to evolve, so too must the strategies used to protect digital assets from increasingly sophisticated threats.