Stolen Crypto From Coinbase Users Lost to Gambling: ZachXBT

Blockchain investigator ZachXBT reported that a New York-based scammer who stole more than $4 million from Coinbase users lost most of the funds gambling at a crypto casino.

1/ An investigation into how the New York based social engineering scammer Daytwo/PawsOnHips (Christian Nieves) stole $4M+ from Coinbase users by impersonating customer support, bought luxury goods, and lost most of the funds gambling at casinos. pic.twitter.com/7PsP8ymPtO

— ZachXBT (@zachxbt) June 23, 2025

In a report shared on Monday, ZachXBT identified the suspect as Christian Nieves, known as “Daytwo” and “PawsOnHips.” Nieves allegedly operated a small team that impersonated Coinbase support staff to lure users into phishing traps.

Stolen Crypto Tracked to Roobet and Monero Wallets

The group’s activity came under closer scrutiny after a $240,000 theft from an aged victim in November 2024. ZachXBT stated that it reviewed a private audio recording of the incident and traced the funds to Roobet, a cryptocurrency casino, and two addresses used for swapping Bitcoin for Monero.

Further blockchain analysis linked Nieves’ Roobet deposit address to over 30 suspected scams, suggesting the group may have been active far longer than initially believed. The blockchain investigator also noted that many victims likely remain unidentified.

Despite the criminal nature of the operation, Nieves reportedly flaunted his lifestyle online. He posted images of a Corvette and a Rolex and bragged on Discord about laundering money through gambling. Following an earlier exposé, he even mocked the allegations by posting a photo flipping off ZachXBT’s profile.

On-chain data also revealed that Nieves’ Roobet deposits declined over time, pointing to significant gambling losses. As his funds dwindled, he allegedly began taking larger cuts from his team’s fraudulent proceeds.

Stolen Crypto Likely Gone

ZachXBT described the case as easy for law enforcement to pursue due to the volume of on-chain evidence. However, the crypto sleuth warned that most of the stolen assets are likely gone.

“Sadly any recovery for victims is likely a small amount given the funds were mostly gambled away after thefts,” ZachXBT commented.

The comments followed renewed on-chain activity from the threat actor, who recently re-emerged on the blockchain radar. Weeks after disappearing, the hacker moved approximately $42.5 million in stolen bitcoin and sent a mocking message to the crypto sleuth.

Using Ethereum’s input data field, the hacker wrote “L bozo,” a slang insult implying that ZachXBT took an “L,” or loss, and is a “loser” or incompetent.