Michaela
On-chain investigator ZachXBT has revealed a phone-based support scam engineered by Christian Nieves, a New York-based con artist, siphoned more than $4 million from the wallets of crypto exchange Coinbase customers.
In a lengthy X post, the on-chain sleuth outlined the sophisticated social engineering scheme orchestrated by Nieves, who operated online under the aliases Daytwo and PawsOnHips. According to ZachXBT, Nieves impersonated Coinbase customer support representatives to execute the scam.
Nieves allegedly ran a small call center operation, where he also acted as a caller, targeting victims through phone-based phishing tactics. The group reportedly convinced individuals to create Coinbase wallets using compromised seed phrases on fraudulent websites. ZachXBT shared video evidence appearing to show Nieves in action during this phase of the scam.
In November 2024, an elderly individual was defrauded of $240,000 by a member of Nieves’ operation, identified by the alias “Paranoia.” According to ZachXBT, the individual behind the alias has been identified as a person named Justin.
According to blockchain analysis, the stolen funds were allegedly divided into three portions. One share was reportedly deposited into the crypto-only gambling platform Roobet, while the remaining amounts were converted into Monero (XMR), a privacy-focused cryptocurrency known for its anonymized transactions.
ZachXBT further alleged that Nieves exhibited compulsive gambling behavior, often placing bets on crypto casino platforms while active in Discord calls with acquaintances. In one such recording, Nieves, using the alias “PawsOnHips”, inadvertently exposed his Roobet deposit address through an open browser tab, linking him directly to the flow of stolen funds.
The on-chain analysis also led ZachXBT to identify a cryptocurrency deposit address tied to Nieves’ alleged gambling activity. According to the investigator, the same address is connected to more than 30 suspected crypto thefts, losing over $4 million combined, further implicating Nieves in a broader pattern of fraudulent behavior. “I expect there’s many additional victims I am unable to directly link. While there’s potentially overlap between multiple threat actors the vast majority of activity pertains to Daytwo,” ZachXBT wrote, pertaining to Nieves.
Additionally, ZachXBT noted that Nieves made little effort to hide his identity throughout the scheme. In recorded Discord calls, Nieves and his associates reportedly discussed laundering stolen funds while openly displaying their faces. He also allegedly used a portion of the illicit proceeds to purchase a Corvette, which he branded with a sticker bearing his online alias—further tying his real-world identity to his digital persona.
The investigation spotlights the growing role of independent blockchain analysts in exposing crypto-related fraud. As phishing schemes become increasingly sophisticated, the case highlights the urgent need for stronger user protections, platform vigilance, and public awareness to combat social engineering in the digital asset space.
Read More
- Coinbase Knew of Insider Data Leak Months Before Public Reveal
- Coinbase Hack Triggers DOJ Probe Into $400M Data Breach
- Coinbase Fires Support Agents Linked to Data Leak and Crypto Scams
Michaela has no crypto positions and does not hold any crypto assets. This article is provided for informational purposes only and should not be construed as financial advice. The Shib Magazine and The Shib Daily are the official media and publications of the Shiba Inu cryptocurrency project. Readers are encouraged to conduct their own research and consult with a qualified financial adviser before making any investment decisions.
