Crypto Crime Spree: $4M Coinbase Heist Funds Designer Binge & Casino Bonanza

Another day, another crypto scam—but this one’s got style. A brazen $4M theft from Coinbase just fueled a luxury rampage straight out of a bad Netflix script.

From cold wallets to cold hard cash

The digital bandits didn’t HODL. They went full degens—dumping stolen crypto for designer threads and high-stakes roulette. Because nothing says ‘financial literacy’ like converting ETH into Gucci and gambling losses.

Regulators left holding the empty bag

While compliance teams scrambled, the thieves pulled off the oldest trick in finance: steal first, ask questions never. The ultimate exit strategy? Blowing the loot before the handcuffs click.

Crypto’s wild west era isn’t over—it’s just wearing better shoes now. And the SEC? Still stuck on ‘how do we blockchain’ while criminals out-innovate them.

Coinbase Scams Affects Elderly Victims

Top investigator ZachXBT unveiled a scam allegedly conducted by Christian ‘DayTwo’ Nieves. According to the investigation, the bad actor stole over $4 million from Coinbase users by impersonating a customer support representative for the crypto exchange.

As seen on the image below, and as per the investigation, the perpetrator used the stolen funds to buy luxury items. ZachXBT claims that most of the stolen funds were lost while gambling at online casinos.

The investigator explained the Modus Operandi used by DayTwo to conduct the scam. As per the findings, the bad actor operated a call center where he also worked as a caller, later he convinced crypto users to install and set up a Coinbase wallet.

These wallet’s private keys were compromised, allowing the group to MOVE and withdraw funds without the owners’ authorization. In order to verify the malicious activities conducted by Daytwo and his associates, ZachXBT tracked a $240,000 transaction stolen from an elderly victim.

As seen in the video, recorded in November 2024, $240,000 were directly linked to the wallet involved in the scam. A portion of the stolen assets were converted to Monero (XMR) and deposited into an online casino, Roobet.

5/ Daytwo likes to gamble on Discord calls with friends.

The recording below shows his Roobet username ‘pawsonhips’ where he leaks his deposit address in a browser tab.

0x940970549037634c517deb741b16112b52e0ced1 pic.twitter.com/i38XVbocUu

— ZachXBT (@zachxbt) June 23, 2025 

ZachXBT also claims that it was usual for DayTwo to gamble with his friends while streaming on Discord. In one of these sessions, DayTwo shows his user name for the online casino Roobet, ‘pawsonhips,’ accidentally leaking one of the addresses connected to the scams.

The investigator stated:

I traced out his casino deposit address which links onchain to 30+ suspected thefts. I expect there’s many additional victims I am unable to directly link. While there’s potentially overlap between multiple threat actors the vast majority of activity pertains to Daytwo.

As DayTwo lost more and more funds on the online casino, and the proceeds from the scams declined, the less funds he deposited on Roobet. Moreover, the bad actor and his friends also openly discussed criminal activities on their Discord calls. ZachXBT added:

It’s rare we see a social engineering scammer with such blatant disregard to mask their identity while flexing stolen funds all over social media.  As Daytwo is not a minor it’s a rather easy case for law enforcement to pursue. Sadly any recovery for victims is likely a small amount given the funds were mostly gambled away after thefts.

Cover image from Unsplash, chart from Tradingview