Fraudster stole over $4 million from Coinbase users and lost it at a casino
Date: 2025-06-24 Author: Oliver Abernathy Categories: BUSINESS
A crypto analyst using the pseudonym ZachXBT has uncovered a fraud scheme organized by New York resident Christian Nieves, known online as Daytwo or PawsOnHips. He deceived Coinbase users by stealing over $4 million from them by posing as exchange support employees.
The fraudster and his group operated through a fake call center, where victims were forced to create wallets on phishing sites with compromised seed phrases already embedded. As ZachXBT explained, Daytwo himself called the victims and convincing them to use wallets vulnerable to theft of funds.
One of the most notable cases was the theft of $240,000 from an elderly user in November 2024. The investigation mentions Nieves' assistant, known as Paranoia (Justin). To prove his version, the analyst published audio and video recordings related to the criminal group.
Part of the stolen money was transferred to a deposit in the online casino Roobet, and the other was converted into the anonymous cryptocurrency Monero (XMR). ZachXBT noted that the Roobet deposit address associated with the pseudonym pawsonhips was involved in at least 30 episodes of fraud.
Nieves did not hide his actions and even demonstrated successes in Discord chats, where he bragged about a Corvette purchased with the stolen money, decorated with a sticker with his Instagram nickname daytw00000. In addition, he repeatedly provoked crypto analyst ZachXBT by posting a photo with an obscene gesture towards him on social networks.
The analyst emphasized that it is rare to find scammers who so openly demonstrate their identity and luxurious lifestyle earned by criminal means.
Most of the stolen funds have already been lost in gambling, so it is unlikely that the money will be returned to the victims. Since Nives is an adult, law enforcement agencies may initiate a criminal case.
It is worth noting that ZachXBT previously reported more than $90 million stolen from Coinbase users from March to May 2025 as part of similar fraud schemes.
