On-Chain Sleuth ZachXBT Uncovers Elaborate Impersonation Scheme: Canadian Scammer Nets $2M+ Through Fake Exchange Support

An investigation by blockchain researcher ZachXBT has exposed a sophisticated social engineering operation originating from Canada, where a threat actor known as Haby (also identified as Havard) masqueraded as customer support for a major cryptocurrency exchange to defraud unsuspecting users.

The Scam Operation

Over the course of a year, the perpetrator successfully siphoned more than $2 million USD in digital assets by intercepting victims through fraudulent support channels. This modus operandi—posing as legitimate exchange staff—represents a growing vulnerability in the crypto space, where users seeking urgent help often bypass verification protocols.

According to ZachXBT’s findings, once the funds were stolen, Haby didn’t attempt sophisticated money laundering. Instead, the proceeds were lavishly spent on status symbols in the digital world: premium Telegram usernames commanded prices in the thousands, while traditional expenditures included nightclub visits, online gambling, and other conspicuous consumption patterns.

Investigation Breakthroughs

The blockchain detective’s OSINT (Open Source Intelligence) analysis proved instrumental in pinpointing the operation. ZachXBT discovered that Haby had been actively acquiring costly Telegram handles, a telltale sign of sudden wealth influx. The investigation took another turn when the scammer abruptly deleted recent social media accounts—a move that typically indicates awareness of increased scrutiny.

Geolocation analysis narrowed the suspect’s base to Abbotsford, a city near Vancouver in British Columbia, providing law enforcement with a concrete lead.

Law Enforcement Reality Check

While ZachXBT’s work has handed Canadian authorities actionable intelligence, the researcher cautioned that prosecution rates for similar crypto-related fraud cases in Canada remain disappointingly low. This enforcement gap—whether due to resource constraints, jurisdictional complexity, or prosecutorial priorities—creates a chilling scenario where sophisticated scammers face minimal consequences for stealing millions.

The case serves as a stark reminder for exchange users: verify support contacts through official channels and enable all available security measures before ever discussing account credentials with anyone claiming to represent customer service.