A U.S. citizen found herself at the center of a scheme to steal $5 million in cryptocurrency.
On-chain analyst ZachXBT has revealed the identity of an American woman involved in a series of cryptocurrency thefts totaling at least $5 million. The individual in question is Tiffany Milanovich, who, according to the investigation, acted as a "call operator" in a fraudulent group.
The scheme looked frighteningly professional. Milanovich called victims, posing as a customer support representative of crypto services, and convinced them to hand over control of their funds. After draining their accounts, she recorded videos mocking the victims, indicating a cynical and brazen approach to the operation.
Attack Mechanics
The criminal group that Milanovich belonged to mimicked the work of real technical support for hardware wallets and centralized exchanges. The infrastructure for phishing sites was provided by other participants known under the pseudonyms "bled" and "harm." It was a well-oiled machine for siphoning off funds.
In June 2026, one victim lost $1.2 million in Bitcoin and Ethereum. The funds were withdrawn from a Trezor hardware wallet after the scammers sent a fake email on behalf of BitcoinIRA. Notably, most of the stolen assets have not yet been moved and remain on on-chain wallets, offering hope for tracking and possible recovery.
Another attack occurred in October 2025, when a victim lost $500,000 in Bitcoin from their Coinbase account. Milanovich, it seems, complained about the small share she received from that amount and even published screenshots of the withdrawals, indicating her complete confidence in impunity.
Traces of Luxury and Gambling
The investigation showed that Milanovich did not hide her spending. On social media, she openly showcased purchases of luxury goods and casino bets using the victims' money. Some "boastful" videos were edited to make the theft amounts appear even larger than they actually were.
ZachXBT also links Milanovich to John "Lick" Dagita, who was previously accused of stealing cryptocurrency seized by U.S. authorities. Dagita was detained in March on Saint Martin, pointing to a possible connection between these cases.
This story is just the tip of the iceberg. According to FBI data, more than 80,000 complaints about impersonation of tech support and government agency staff were recorded in 2025 alone, with losses exceeding $2.9 billion. Chainalysis, in turn, notes a nearly 1,400% year-over-year increase in such schemes in the crypto sector.
My comment: This case highlights a troubling trend: scammers are increasingly using social engineering rather than technical hacks. It is critically important for users to verify any requests to transfer funds through official communication channels, and for exchanges and wallet manufacturers to strengthen client verification when contacting support. Otherwise, we risk seeing even larger-scale losses.