Cross-Chain Laundering Network

Meet Haby (Havard), a Canadian threat actor who has stolen $2M+ via Coinbase support impersonation social engineering scams in the past year blowing the funds on rare social media usernames, bottle service, & gambling.

On Dec 30, 2024 Haby posted a screenshot in a group chat showing off a 21K XRP ($44K) theft from a Coinbase user. rN7ddvk4DrGHZUrBfNARJEEAbPkky9Mwcz

On Jan 3, 2025 Haby posted a screenshot from his Exodus wallet showing his Telegram & IG accounts. I matched up the historical balances to the screenshot and found the XRP address linked to two other Coinbase user thefts for ~$500K total. rfA8MiWkRb6xjveQGKfJpdr8h1Kb4c83Rb

Haby swapped his cut from the thefts from XRP to BTC via instant exchanges. By performing a timing analysis i was able to locate his BTC address. bc1qn3k5cz3905p6k50r44pjlj2rl9qcy72flsq3zh

To further confirm I found the correct BTC address, in February 2025 Haby began showing off a wallet with $237K in a group chat. The historical BTC balance for bc1qn3k from Feb 1, 2025 matched a screenshot shared.

I traced back from bc1qn3k and found three Coinbase support impersonation thefts for another $560K+ total stolen. Theft address bc1qfqyrsrry6ujd9drgv6tpqru9qhu72demakackx bc1qw2nqyjlasjx58v6w6shxhnzf8amggu2pv5mkey bc1qu0sx0qmwmn5wd4nk35axkq056ewnccrjzy2let

In this leaked video here’s Haby as a caller social engineering a target. In the screen recording he leaks the email habyclown@gmail[.]com and his Telegram account with a number.

Haby frequently buys expensive Telegram usernames and deleted his most recent account two days ago. Perviously he shared his alias in various chats confirming the screenshots. TG ID OLD: 8157445457 EQA6_Vbg2bUZ-2daTveoKMzkjnQ5iD4YAfSTZWdZSTHlLeuH TG ID Recent: 8361120781 EQAhXVm0YAN2JIluvOabc8hhG2N-apFXvxzRhkRXnkC9i2Em

Additional screenshots taken from his IG show off more social engineering thefts. One story post leaked "From "Harvi's MacBook Air" A person from their chat even advised him to stop flexing so often.

Haby regularly posts stories and selfies flaunting his lifestyle with little regard for opsec and was also caught simping for eGirls.

Canadian law enforcement may already be familiar with Haby since there’s been several swatting attempts involving his personal details locally. Unfortunately Canada is a jurisdiction that rarely ever prosecutes threat actors from The Com. I hope Canadian LE makes an exception as Haby shows zero remorse for victims and it is a rather easy case due to the large quantity of evidence available.