According to @zachxbt, a Canadian threat actor known as Haby (Havard) stole over $2 million in the past year by impersonating Coinbase support and running social engineering scams, then spent the proceeds on rare social media usernames, bottle service, and gambling (source: @zachxbt, X, Dec 29, 2025). This report highlights ongoing account-takeover and recovery-vector risk for centralized exchange users, which is directly relevant for trade execution safety and operational risk controls on CEX venues (source: @zachxbt, X, Dec 29, 2025). Traders should treat unsolicited support contacts as high risk and verify all account-recovery requests out-of-band before authorizing withdrawals or sharing security information, given the impersonation method described (source: @zachxbt, X, Dec 29, 2025). Maintaining withdrawal allowlists, hardware-based two-factor authentication, and minimal hot balances on exchanges can reduce loss exposure if social engineering attempts succeed, as underscored by the reported $2M+ thefts (source: @zachxbt, X, Dec 29, 2025).