A large-scale fraud scheme has been uncovered in New York, in which a perpetrator named Christian Nieves, also known by the aliases Daytwo and PawsOnHips, deceived users of the cryptocurrency exchange Coinbase out of more than $4 million. The investigation was conducted by a crypto analyst known as ZachXBT, who uncovered numerous pieces of evidence of the criminal activity.
This is reported by Finway
Fraud Scheme and the Role of Phishing Sites
The perpetrator organized a fake call center, through which he, along with a small group of accomplices, called potential victims, posing as customer support representatives from Coinbase. They convinced the victims to create new crypto wallets on counterfeit websites, where they immediately implanted malicious seed phrases. After that, the fraudsters gained full access to the users’ assets and withdrew funds to their accounts.
“Daytwo led a small group of fraudsters and personally called the victims, forcing them to create a Coinbase wallet with a compromised seed phrase,” noted ZachXBT.
One incident occurred in November 2024, when an elderly user had $240,000 stolen. The investigation mentions an accomplice named Paranoia (Justin), and includes audio and video materials that confirm the involvement of the fraudsters.
Casino Expenses, Luxury Purchases, and Social Media Traces
Nieves divided the stolen funds into three parts: one part he deposited into the Roobet casino, another he converted into Monero (XMR) cryptocurrency, which allows for transaction anonymization. The researcher found that the deposit address at Roobet, associated with the alias pawsonhips, was involved in at least 30 episodes of theft.
In addition to gambling, the perpetrator purchased an elite Corvette and put a sticker with his Instagram name daytw00000 on it, thereby confirming the connection between his identity and aliases. Publicly, he also displayed disdain for crypto analysts by posting provocative photos on social media.
“It is rare to encounter a fraudster who is so openly unhidden about their identity while flaunting a lavish lifestyle funded by other people’s money,” concluded the analyst.
Despite the scale of the stolen amounts, the recovery of funds is considered unlikely, as most of it was lost in casinos. Since Nieves is not a minor, his identity and actions are already under the scrutiny of law enforcement, and the case may progress more quickly.
According to ZachXBT, the total amount stolen from Coinbase users from March to May 2025 exceeded $90 million.