A former tech support employee has been found involved in the theft of $5 million in cryptocurrency: how the scheme worked
Blockchain investigations analyst ZachXBT has revealed details of a high-profile case involving the theft of $5 million in cryptocurrencies. The key figure turned out to be American Tiffany Milanovich, who, according to the investigation, played the role of a "call operator" in the criminal group.
The scheme was built with frightening precision. Milanovich called victims, posing as a customer support employee of crypto services, and convinced them to hand over control of their funds. After draining the accounts, she recorded videos mocking the victims—such details point to the cynicism and systematic approach of the perpetrators.
Mechanics of the crime
The group operated using phishing infrastructure. Milanovich mimicked the work of real technical support for hardware wallets and centralized exchanges. The technical foundation for the fake websites was provided by accomplices under the pseudonyms "bled" and "harm." In June 2026, one of the victims lost $1.2 million in bitcoin and Ethereum—the funds were withdrawn from a Trezor wallet after a fake email from BitcoinIRA. Notably, most of the stolen assets have not yet been moved and remain on traceable addresses.
Another episode occurred in October 2025, when a victim lost $500,000 in BTC after withdrawing funds from a Coinbase account. Milanovich, according to the data, complained about her "small share" and posted transaction screenshots, trying to downplay the scale of the theft.
Trails and connections
The investigation showed that Milanovich did not hide her spending: she openly showcased purchases of luxury goods and casino bets made with the victims' money on social media. Some "boastful" videos were edited to make the stolen amounts appear even larger than they actually were.
ZachXBT also links Milanovich to John "Lick" Dagita, who was previously accused of stealing cryptocurrency seized by U.S. authorities. In March, Dagita was detained in Saint Martin.
The scale of the problem is confirmed by statistics: the FBI recorded more than 80,000 complaints about impersonation of technical support and government agency employees in 2025 alone, with losses exceeding $2.9 billion. According to Chainalysis, the number of such schemes in the crypto sector grew by nearly 1400% year over year.
My comment: This case is a vivid illustration that social engineering remains the most dangerous attack vector in the crypto industry. Even with perfect technical protection, users are vulnerable to psychological pressure. Investors should adopt a "two-channel" rule for verifying any requests from support and never hand over control of their wallet over the phone.