“In the age of digital deception, proof is not in words, but in the transaction trail.”
— ZachXBT, blockchain detective
In January 2026, well-known on-chain analyst ZachXBT uncovered a large-scale fraud scheme in which an attacker impersonating a Coinbase support employee stole approximately $2 million in cryptocurrency from users. The investigation became a textbook example of modern digital forensics: a combination of blockchain analysis, social media research, and the criminal’s own carelessness made it possible not only to link dozens of victims, but also to identify the hacker with a high degree of confidence.
The scammer relied on classic social engineering tactics:
The scam appeared especially convincing because the attacker knew the victim’s name and used stolen personal data—likely sourced from call center leaks or support databases.
The key breakthrough came when ZachXBT obtained access to a leaked video call recording between the scammer and a victim. In the footage, the attacker carelessly revealed:
By correlating this information with on-chain transactions, the analyst discovered that all stolen funds converged on a small set of wallets. He then traced how the hacker spent the money:
The decisive factor was public social media stories: the attacker bragged about a new lifestyle, posted selfies with champagne, and showcased “eGirls,” completely ignoring basic operational security (OPSEC).
Despite the sophistication of the scheme, the hacker made a fatal mistake—he was human. He didn’t just steal; he wanted to be seen. His constant posting created a digital footprint that ZachXBT used to reconstruct the full picture.
The analyst even managed to determine the suspect’s home address using open-source intelligence, but chose not to disclose it due to the rules of X (formerly Twitter).
As ZachXBT himself put it: “He thought he was hidden behind Telegram usernames. But his ego was the best detector.”
Official Coinbase support consistently reminds users that it:
All support interactions must be initiated by the user through the official app or website. Any deviation from this is a 100% scam.
According to the FBI, cybercrime losses exceeded $16 billion in 2025, with impersonation of support services being the most common scheme. Particularly vulnerable groups include:
In May 2025, Coinbase itself acknowledged data leaks from call centers, where bribed agents passed customer information to scammers. This explains how “support” knows your name and phone number.
If someone calls claiming to be from Coinbase, Binance, or any service—hang up. Contact support only through the official app.
All links, numbers, and contacts must come exclusively from coinbase.com or the mobile app. Never from social media, email, or SMS.
Use an authenticator app (Google Authenticator, Authy) instead of SMS. This protects your account even if your phone number is compromised.
If in doubt, end the conversation and double-check via the official website. Scammers rely on urgency—your task is to slow things down.
Experts warn that in 2026 attackers will increasingly use:
The only reliable defense is radical skepticism and a strict refusal to disclose data outside official channels.
The Coinbase phishing case is a reminder: the most dangerous attacks don’t require exploiting code. They only require trust. As ZachXBT said: “You won’t lose your crypto because of a smart contract bug. You’ll lose it by answering a phone call.”
That is why silence is the best protection. If someone calls you—it’s a scam. If they ask for data—it’s a scam. If they offer to “save your funds”—it’s a scam.
