Identity swap scheme: American woman found involved in theft of $5 million in cryptocurrencies
The cryptocurrency world is once again facing a sophisticated scam scheme where the human factor becomes the attackers' main weapon. During my analysis of recent events, details have emerged pointing to the involvement of U.S. citizen Tiffany Milanovich in the theft of over $5 million in digital assets. This is not about code hacking or exploits, but rather classic social engineering taken to the extreme.
Milanovich, acting as part of an organized group, served as a "call operator." She called victims, posing as a customer support representative of crypto services, and convinced them to hand over control of their funds. After successfully draining their accounts, she recorded videos mocking the victims, demonstrating a cynical attitude toward her actions. The infrastructure for phishing sites was provided by her accomplices under the pseudonyms "bled" and "harm."
The scale of the group's activity is impressive. In June 2026, one victim lost $1.2 million in Bitcoin and Ethereum, which were withdrawn from a Trezor hardware wallet. The attack began with a fake email from BitcoinIRA, signed by a fictitious employee. Notably, a significant portion of the stolen funds has not yet been moved and remains on on-chain addresses, offering hope for their recovery in the future.
Brazen attacks and conspicuous spending
In October 2025, the group struck again: a victim lost $500,000 in Bitcoin from their Coinbase account. Milanovich, not satisfied with the theft, complained about her "small share" and even published screenshots of the fund withdrawals. Such behavior indicates not only greed but also a lack of fear of justice.
The stolen funds were spent with astonishing audacity. Milanovich openly showcased luxury purchases and casino bets on social media, with some of the "boastful" videos edited to make the theft amounts appear even larger than they actually were. My investigation also revealed a connection between Milanovich and John "Lick" Dagita, who was arrested in March in St. Martin on charges of stealing cryptocurrency seized by U.S. authorities.
This story is just the tip of the iceberg. The FBI recorded more than 80,000 complaints about impersonation of tech support and government agency staff in 2025 alone, with losses exceeding $2.9 billion. Chainalysis notes a nearly 1,400% increase in such schemes in the crypto sector over the past year.
My expert take: This case highlights a troubling trend: attackers are increasingly targeting people rather than technology. Even the most secure hardware wallets are powerless if the user hands over the keys themselves. Investors should treat any incoming calls and emails with skepticism, and exchanges should strengthen verification when customers contact support. The 1,400% rise in such attacks is a signal that cannot be ignored.