New Yorker involved in $6.5m crypto theft: ZachXBT

A crypto scammer named Ronald Spektor disabled ZachXBT’s social media pages after he claimed he helped steal $6.5 million from a Coinbase user.

According to Web3 detectives, Ronaldd, as he is known online, participated in a social engineering attack in October. The victim described being contacted by a purported Coinbase support representative and losing their life savings after clicking on a malicious link.

6/ When examining the TON address where Ronald’s Telegram number is located, you can see that he is funded from more than one exchange.

You can do a timing analysis to follow the exchange and find the funding address.

This address is linked to multiple other Coinbase withdrawals… pic.twitter.com/g8UvG3q7HR

— ZachXBT (@zachxbt) 20 November 2024

Threat actors mixed ill-gotten gains into trading venue eXch on Bitcoin (BTC) and Ethereum (ETH). Following the tracking attempt, Ronald allegedly flexed his Ledger Live wallet balance on Discord days later to show $3.1 and made a personal record of an address linked to the theft.

A now-deleted Telegram channel exposed one of Spektor’s on-chain wallets linked to various Coinbase withdrawals. ZachXBT said the data was traced to multiple potential impersonation scam victims.

Spektor was also likely one of many bad actors participating in phishing campaigns. The wallet balance shows other people were also hacked and leaked data showing his whereabouts in New York, according to information shared on November 20.

Spektor quickly deleted his Telegram account about two hours after the blockchain researcher published his findings. The victim also disabled page X, but it is unclear why.

Extreme social engineering attacks have reminded industry participants of the increasing security threats despite blockchain advancement and adoption.

Impersonating Coinbase support has also become a trademark of scammers in recent months. In August, ZachXBT revealed that a single Genesis creditor lost $238 million in Bitcoin to criminals impersonating exchange employees. Miami police soon arrested the suspects named by ZachXBT and other crypto analysts.