A U.S. citizen has found herself at the center of a scheme to steal $5 million in cryptocurrency: investigation details
Blockchain investigations analyst ZachXBT has revealed the identity of an American woman involved in a major fraudulent operation that resulted in at least $5 million in digital assets being stolen from victims. The individual in question is Tiffany Milanovich, who, according to the investigation, served as a "call operator" within the criminal group.
The scheme was built on classic but effective social engineering. Milanovich called victims, posing as a customer support representative for crypto services, and convinced them to hand over control of their funds. After the accounts were drained, she recorded videos mocking the victims, reflecting her complete moral degradation and cynicism.
Mechanics of the criminal group
The criminal group operated in a coordinated manner. Milanovich pretended to work for real technical support teams of hardware wallets and centralized exchanges. The infrastructure for phishing websites was provided by her accomplices, known under the pseudonyms "bled" and "harm." In June 2026, one victim lost $1.2 million in Bitcoin (BTC) and Ethereum (ETH)—the funds were withdrawn from a Trezor hardware wallet. The attack began with a fake email purportedly from BitcoinIRA, signed by a certain Patricia Massi.
Notably, a significant portion of the stolen funds has still not been moved on-chain. This offers hope for their recovery if the criminals are caught, but for now the assets remain frozen at tracked addresses.
A second attack, dated October 2025, brought the group $500,000 in Bitcoin. The victim lost funds from a Coinbase exchange account. Milanovich, apparently dissatisfied with the size of her share, even published screenshots of the withdrawals, complaining about the "small" percentage.
Extravagance and ties to other criminals
The investigation showed that Milanovich made no effort to hide her extravagance. On social media, she openly boasted about purchases of luxury items and gambling at casinos, placing bets with the victims' money. Moreover, some of the "bragging" videos were edited to make the theft amounts appear even more impressive than they actually were.
ZachXBT also links Milanovich to John "Lick" Dagita, who was previously accused of stealing cryptocurrency seized by U.S. authorities. In March, Dagita was detained in Saint Martin, indicating a possible connection between these criminal networks.
Expert perspective
This story is a striking example of a troubling trend. The FBI recorded more than 80,000 complaints about impersonation of technical support staff and government agencies in 2025 alone, with losses exceeding $2.9 billion. According to Chainalysis, the number of impersonation schemes in the crypto sector grew by nearly 1,400% over the year. Investors need to remember a simple rule: no legitimate support service will ever ask you to transfer funds or disclose your seed phrase. All such requests are 100% fraud. Vigilance is the only reliable shield against these attacks.