The on-chain security team recently tracked a systematic scam case spanning over a year. The scammer from Canada, Haby (also known as Havard), impersonated a customer service representative of a major compliant platform and successfully carried out the scam using social engineering techniques, accumulating over $2 million in stolen crypto assets.

The modus operandi of this case is quite covert. The scammer used carefully crafted identities to gain users' trust before gradually executing the scam. The stolen funds ultimately flowed into various non-productive consumption— including purchasing rare social media usernames, entering and exiting high-end nightclubs, and gambling activities.

It is worth noting that Haby has recently exhibited clear signs of anti-investigation behavior. On-chain data shows that this account frequently purchased rare usernames on the Telegram platform in large amounts. Such high-value accounts are often used to establish scam channels or for identity disguise. More importantly, two days ago, the account suddenly deleted recent activity records, a move that indicates it may have become aware of being tracked.

The security team, through open-source intelligence (OSINT) and other tracking methods, has essentially pinpointed key nodes of this scam network. This case serves as a reminder to all users that exchange customer service will never proactively ask for private keys or seed phrases. Any such request should be immediately treated with suspicion. Users are advised to regularly check for abnormal logins, enable two-factor authentication, and remain highly cautious of unfamiliar social media contacts.