Christian “Daytwo” Nieves, reportedly the mastermind behind a $4 million fraud scheme that deceived investors of their digital currency, squandered a significant portion of those illicit gains at cryptocurrency casinos, according to an in-depth report from an on-chain investigator. 

In a Monday X thread, ZachXBT pointed out that Nieves executed a social engineering scam where he and his associates contacted victims pretending to be staff members of Coinbase, the top cryptocurrency exchange in the US. Nieves and his team persuaded the victims to create Coinbase accounts to safeguard their cryptocurrency, but in truth, the supposed offenders were directing investors to phishing websites. This enabled them to obtain private keys, allowing them to seize digital assets and leaving the victims with no options for recovery. 

A significant loss from the Nieves plot was experienced by an elderly individual last November when a Nieves employee named Justin, nicknamed “Paranoia,” stole $240,000 from them. 

ZachXBT reports that the illegal earnings were divided into three portions, with part of the funds going to the Roobet crypto casino and the remainder invested in Monero (XMR), a cryptocurrency. Similar to other crypto casinos, Roobet is not licensed or regulated within the US. It is likewise banned from functioning in other major industrialized gaming markets like Canada and Australia. 

Coinbase Fraudster Poorly Concealed His Footprints 

Similar to numerous financial con artists, Nieves allowed his ego to interfere with his ability to hide his actions. He not only documented some of his betting activities on Roobet, where he uses the username "pawsonhips," but also shared photos on social media of high-end items, such as Rolexes, which he bought with some of the unlawfully obtained money. 

An image of Christian Nieves’ Instagram account where he flaunts purchases of luxury items allegedly purchased with ill-gotten gains derived from a social engineering scam. (Image: Instagram)

ZachXBT reports that his probe uncovered information connecting Nieves’ Roobet deposit address onchain to over 30 alleged thefts.

"I expect there’s many additional victims I am unable to directly link. While there’s potentially overlap between multiple threat actors the vast majority of activity pertains to Daytwo,” notes the investigator.

It’s possible that Nieves is driven to commit financial frauds due to a gambling addiction, which ZachXBT believes is nearly compulsive. This would include Nieves in a lengthy roster of alleged offenders who committed crimes to finance their gambling addictions. 

“Daytwo has a gambling problem and you’ll see onchain how casino deposits get smaller as he loses funds. Recently this escalated to the point where he started stealing cuts from accomplices,” observes ZachXBT.

Monero Usage May Indicate Nieves' Illegal Actions 

In terms of market capitalization, Monero ranks as the 22nd-largest cryptocurrency, but it is thought to be popular among malicious users dealing in digital currencies since, unlike Bitcoin, the Monero blockchain conceals information like sender and recipient addresses along with the transaction amount. In other words, it’s quite an achievement that ZachXBT managed to track Daytwo’s connections to the Coinbase fraud. 

To give credit to Monero and its advocates, its aim is not to enable or conceal illegal activities. It has gained popularity among crypto users primarily due to its privacy protocols, which are most effective when the end user prioritizes security — a stance that Nieves arguably did not take. 

Nonetheless, the cryptocurrency’s associations with crime and the Dark Web have attracted regulatory attention in certain areas, leading some exchanges to remove it from their listings.