Coinbase Phishing Scam Nabs $4 Million From 30 Customers

In a recent revelation, blockchain sleuth ZachXBT exposed a sophisticated phishing scam that targeted Coinbase customers, resulting in the theft of over $4 million. The scam, orchestrated by a New York-based con artist named Christian Nieves, exploited basic human trust and the lack of real-time behavioral checks on large, user-initiated transfers.

Nieves and his small call-center team posed as Coinbase Support representatives, cold-calling customers with urgent warnings about suspicious activity on their accounts. They directed victims to create wallets using seed phrases supplied by the scammers, which gave the criminals full control over the funds. More than 30 customers fell for the scam, losing a combined total of over $4 million. One recorded call captured an elderly man forfeiting $240,000 after believing he was securing his holdings.

The operation thrived by exploiting a gray zone between platform security and personal vigilance. Coinbase’s backend systems remained uncompromised, yet the absence of real-time behavioral checks on large, user-initiated transfers left an opening big enough for the scammers to do their work. ZachXBT’s blockchain analysis later stitched together the scams’ on-chain footprints, revealing how the attackers laundered victim assets once they left Coinbase’s ecosystem.

By mapping each hop the stolen crypto took, from freshly drained wallets to offshore betting sites, ZachXBT exposed the human weaknesses cybercrooks prize, setting the stage for the crackdown that followed. Investigators didn’t need a sophisticated traceback to uncover the human face behind the Coinbase phishing scam. On-chain footprints allegedly led directly to Christian Nieves, a New York resident who operated online as “Daytwo” and “PawsOnHips.”

Unlike most cybercriminals, Nieves didn’t hide—he broadcast. Luxury-brand selfies, open-mic Discord chats, and even video calls during the scam gave blockchain sleuth ZachXBT a trove of breadcrumbs that linked real-world vanity to digital theft. Nieves routinely showed his face while walking victims through wallet “migrations,” a glaring op-sec lapse. Instagram posts displayed designer clothing and high-end gadgets that on-chain analysis traced back to stolen crypto.

Once Nieves allegedly gained control of each hijacked wallet, the money moved fast. Deposits funneled into a Roobet casino account bearing the same “pawsonhips” handle, where—according to blockchain tracers—nearly the entire $4 million haul was gambled away. Large wagers were placed while scammers chatted on Discord, effectively betting with victims’ life savings. The remaining balances were hopped through Monero (XMR) to obscure trails, yet Roobet’s visible deposit address still tied the funds back to Nieves.

By pinning a real name to flamboyant aliases and a Roobet bankroll, ZachXBT turned what began as a low-friction phishing scam into a case study in self-inflicted exposure—one that now places Nieves squarely in the crosshairs of law enforcement. Coinbase’s risk and security teams rolled out layered countermeasures intended to choke off future phishing scams while reassuring shaken customers. Among the steps were enhanced customer education, stricter withdrawal controls, address allowlisting and Vault-style approval delays promoted as default settings for higher balances, and a reimbursement pledge for victims of a May 2025 insider data-leak scam.

Whether those reforms can staunch a phishing scam wave that has already siphoned hundreds of millions is still unclear. However, the heightened focus on transparent cybersecurity protocols—and on holding exchanges accountable alongside users—indicates a new phase in the fight against social engineering in crypto. The lasting lesson from the Coinbase, ZachXBT crypto scam isn’t merely to guard credentials; it’s to recognize that in a decentralized sector, you alone stand between your holdings and the next persuasive imposter.