Blockchain detective ZachXBT uncovered a New York-based scammer who stole over $4 million from Coinbase users through social engineering.
1/ An investigation into how the New York based social engineering scammer Daytwo/PawsOnHips (Christian Nieves) stole $4M+ from Coinbase users by impersonating customer support, bought luxury goods, and lost most of the funds gambling at casinos. pic.twitter.com/7PsP8ymPtO
— ZachXBT (@zachxbt) June 23, 2025
The scammer, Christian Nieves—known by the aliases “Daytwo” and “PawsOnHips”—then lost almost all of the stolen funds gambling in casinos.
Scammer’s identification card. Source: ZachXBT
Nieves not only ripped off dozens of victims but also openly bragged about his “achievements” on social media.
Phishing Scheme Details
Nieves led a small team of phone scammers who posed as Coinbase support staff. The criminals called cryptocurrency owners and, under various pretexts, directed them to phishing sites where victims entered their account login details.
ZachXBT’s investigation began after a theft in November 2024, when scammers stole $240,000 from an elderly investor. The detective obtained a private recording of the crime and traced the path of the stolen funds.
5/ Daytwo likes to gamble on Discord calls with friends.
The recording below shows his Roobet username ‘pawsonhips’ where he leaks his deposit address in a browser tab.
0x940970549037634c517deb741b16112b52e0ced1 pic.twitter.com/i38XVbocUu
— ZachXBT (@zachxbt) June 23, 2025
The money went to three locations: the Roobet casino and two addresses through which Bitcoin was exchanged for Monero.
More than 30 thefts and open bragging
Blockchain analysis showed that Nieves’ Roobet deposit address is linked to more than 30 suspicious thefts. However, ZachXBT notes that the actual number of victims could be much higher, as many cases have not been identified.
6/ I traced out his casino deposit address which links onchain to 30+ suspected thefts.
I expect there’s many additional victims I am unable to directly link.
While there’s potentially overlap between multiple threat actors the vast majority of activity pertains to Daytwo. pic.twitter.com/lCmPW7z0E2
— ZachXBT (@zachxbt) June 23, 2025
Nieves did not hide his activities, bragging in Discord about laundering money through gambling and openly demonstrating a luxurious lifestyle on social networks. He spent some of the stolen funds on an expensive Corvette with personalized coloring and a high-end Rolex watch.
When ZachXBT launched an investigation last month, Nieves responded with a photo showing his middle finger to the detective on social media.
Losing Millions and Internal Squabbles
Transaction records show Nieves’ casino deposits decreased dramatically, indicating serious losses. “Daytwo has a gambling problem, and you can see on the blockchain how casino deposits are getting smaller and smaller as he loses funds,” wrote ZachXBT.
Source: ZachXBT
As his bankroll depleted, the scammer began taking a larger share of the thefts from his accomplices. The researcher notes that it is rare for a scammer to so openly display his identity and brag about stolen money on social media.
Easy Prey for Law Enforcement
“It’s a pretty straightforward case for law enforcement,” said the blockchain researcher. However, the chances of recovering assets from Nieves and his team are minimal, as most of what he stole has already been lost in casinos after successful thefts.
The investigation comes weeks after Coinbase reported that fraudsters among its outsourcing agents helped leak the data of more than 69,000 users.
The exchange fired those employees and could now face compensation payments of $180 million to $400 million.
Nieves’ story demonstrates how a lack of self-control can derail even a successful criminal scheme. The detailed records on the blockchain and the fraudster’s overt behavior made exposure and prosecution likely.
eToro: Best platform for beginners and social trading
- Trade cryptocurrencies, stocks, ETFs, and commodities on one easy-to-use platform
- Follow and copy top-performing traders with eToro’s unique social trading tools
- Earn passive income with staking on popular coins like ETH, ADA, and TRX
- Fully regulated in multiple jurisdictions with strong security protocols
- 0% commission on real stock trading and competitive spreads on crypto
- 30+ million registered users across 100+ countries
eToro is a multi-asset investment platform. The value of your investments may go up or down. Your capital is at risk. Don’t invest unless you’re prepared to lose all the money you invest. This is a high-risk investment and you should not expect to be protected if something goes wrong.
Source:: The $4M Coinbase Scam That Ended in Casino Losses and Public Exposure