Alleged Coinbase Scammer Blew Millions at Crypto Casinos, Flaunted Rolexes Online

Christian Nieves, known online as “Daytwo,” stands accused of masterminding a $4 million cryptocurrency scam that defrauded unsuspecting victims under the guise of Coinbase employee outreach.

According to an in-depth investigation by prominent on-chain analyst ZachXBT, most of the stolen funds were quickly lost to crypto casinos and luxury spending.

On Monday, ZachXBT published a detailed thread on X, alleging that Nieves orchestrated a sophisticated social engineering scheme in which he and a network of associates posed as Coinbase representatives. “They convinced victims to open Coinbase accounts to protect their cryptocurrency,” ZachXBT wrote, “but in reality, the alleged criminals were steering investors to phishing sites.”

By directing victims to these fake Coinbase portals, Nieves and his collaborators were able to seize control of private keys, gaining full access to users’ digital assets and leaving the victims helpless. One particularly tragic case occurred in November of last year, when a senior citizen lost $240,000 after being deceived by a Nieves associate named Justin, who also goes by “Paranoia.”

The investigator noted that the stolen sum from that incident was split into three parts, with a portion being gambled away at Roobet—a crypto casino known for its lack of licensing in major jurisdictions such as the United States, Australia, and Canada. The rest of the funds were funneled into Monero (XMR), a privacy-focused cryptocurrency favored by cybercriminals for its anonymity features.

Nieves, it seems, did little to cover his tracks. As ZachXBT pointed out, “he recorded some of his wagering activity on Roobet, where he’s known by the username ‘pawsonhips.’” In a move that flaunted his ill-gotten wealth, Nieves also posted photos of himself online, showcasing expensive purchases like Rolex watches, paid for with funds allegedly siphoned from victims.

ZachXBT’s research uncovered that Nieves’ Roobet deposit address is linked to over 30 suspected cryptocurrency thefts. “I expect there’s many additional victims I am unable to directly link,” he added. “While there’s potentially overlap between multiple threat actors, the vast majority of activity pertains to Daytwo.”

The investigation suggests that Nieves’ motivation may stem from a serious gambling addiction. “Daytwo has a gambling problem,” said ZachXBT. “And you’ll see onchain how casino deposits get smaller as he loses funds.” The problem appears to have escalated recently, with Nieves allegedly resorting to stealing shares of the profits from his own accomplices. “Recently this escalated to the point where he started stealing cuts from accomplices,” ZachXBT reported.

Monero’s role in the case also highlights its controversial place in the crypto ecosystem.

Although ranked only 22nd by market cap, Monero is often the currency of choice for illicit transactions due to its blockchain’s ability to mask sender and recipient addresses, as well as transaction amounts. “It’s no small feat that ZachXBT was able to trace Daytwo’s ties to the Coinbase fraud,” given the challenges of tracking activity on the Monero network.

Still, ZachXBT clarified that Monero’s association with this kind of criminal activity shouldn’t overshadow its intended use. “To be fair to Monero and its supporters, its purpose is not to facilitate or hide criminal activity,” he noted. Monero has gained popularity primarily due to its robust privacy protocols—although, as this case shows, they only work when users are vigilant with their own security practices.

Nevertheless, the cryptocurrency’s reputation as a tool for dark web dealings and financial crime has led to increased scrutiny by regulators and prompted a number of exchanges to delist it. There’s growing speculation that some bad actors, unable to access Monero through major platforms, are being forced to revert back to using Bitcoin.

The exposure of Nieves and the unraveling of his operation have underscored once again how intertwined crypto crime, online anonymity, and addiction-fueled behavior can be—and how digital sleuths like ZachXBT continue to play a crucial role in holding such perpetrators accountable.

By fLEXI tEAM