How an onchain investigator linked a Coinbase impersonation scam to $2 million in losses and why social engineering remains the real risk.