$4M Coinbase Scam Ends in Designer Splurge and Casino Blowout

Crypto scams have become more frequent and more sophisticated as the industry grows. Billions of dollars have been taken by malicious actors targeting crypto users, and even those with a technical background have failed to avoid them.

Coinbase Scams Affects Elderly Victims

Top investigator ZachXBT unveiled a scam allegedly conducted by Christian ‘DayTwo’ Nieves. According to the investigation, the bad actor stole over $4 million from Coinbase users by impersonating a customer support representative for the crypto exchange.

As seen on the image below, and as per the investigation, the perpetrator used the stolen funds to buy luxury items. ZachXBT claims that most of the stolen funds were lost while gambling at online casinos.

The investigator explained the Modus Operandi used by DayTwo to conduct the scam. As per the findings, the bad actor operated a call center where he also worked as a caller, later he convinced crypto users to install and set up a Coinbase wallet.

These wallet’s private keys were compromised, allowing the group to move and withdraw funds without the owners’ authorization. In order to verify the malicious activities conducted by Daytwo and his associates, ZachXBT tracked a $240,000 transaction stolen from an elderly victim.

As seen in the video, recorded in November 2024, $240,000 were directly linked to the wallet involved in the scam. A portion of the stolen assets were converted to Monero (XMR) and deposited into an online casino, Roobet.

5/ Daytwo likes to gamble on Discord calls with friends.

The recording below shows his Roobet username ‘pawsonhips’ where he leaks his deposit address in a browser tab.

0x940970549037634c517deb741b16112b52e0ced1 pic.twitter.com/i38XVbocUu

— ZachXBT (@zachxbt) June 23, 2025 

ZachXBT also claims that it was usual for DayTwo to gamble with his friends while streaming on Discord. In one of these sessions, DayTwo shows his user name for the online casino Roobet, ‘pawsonhips,’ accidentally leaking one of the addresses connected to the scams.

The investigator stated:

I traced out his casino deposit address which links onchain to 30+ suspected thefts. I expect there’s many additional victims I am unable to directly link. While there’s potentially overlap between multiple threat actors the vast majority of activity pertains to Daytwo.

As DayTwo lost more and more funds on the online casino, and the proceeds from the scams declined, the less funds he deposited on Roobet. Moreover, the bad actor and his friends also openly discussed criminal activities on their Discord calls. ZachXBT added:

It’s rare we see a social engineering scammer with such blatant disregard to mask their identity while flexing stolen funds all over social media.  As Daytwo is not a minor it’s a rather easy case for law enforcement to pursue. Sadly any recovery for victims is likely a small amount given the funds were mostly gambled away after thefts.

Cover image from Unsplash, chart from Tradingview