According to @zachxbt, on Dec 30, 2024 an individual named Haby posted a group chat screenshot boasting about stealing 21,000 XRP worth about $44,000 from a Coinbase user, highlighting a concrete theft incident traders should note (source: @zachxbt). According to @zachxbt, the XRP address tied to the theft is rN7ddvk4DrGHZUrBfNARJEEAbPkky9Mwcz, providing a direct on-chain handle for surveillance (source: @zachxbt). According to @zachxbt, traders can track transfers from this address and watch for potential exchange deposit attempts that could affect short-term XRP liquidity and order book dynamics (source: @zachxbt). Based on @zachxbt, XRP market participants can set address alerts, monitor exchange inflows, and adjust risk with tighter stops or reduced leverage around any address-linked movements (source: @zachxbt). According to @zachxbt, COIN equity traders may also monitor sentiment and headline risk since the report references a Coinbase user (source: @zachxbt).

According to @zachxbt, Haby swapped his portion of the theft proceeds from XRP to BTC via instant exchanges (source: ZachXBT on X, Dec 29, 2025, post 2005649194435195201). According to @zachxbt, a timing analysis identified the BTC address bc1qn3k5cz3905p6k50r44pjlj2rl9qcy72flsq3zh for these flows (source: ZachXBT on X, Dec 29, 2025, post 2005649194435195201). According to @zachxbt, the concrete path XRP -> instant exchanges -> BTC and the disclosed address provide a direct on-chain indicator for traders to monitor potential movements linked to the reported theft proceeds (source: ZachXBT on X, Dec 29, 2025, post 2005649194435195201).