An American woman found herself at the center of a scheme to steal $5 million in cryptocurrency: investigation details
Analyst ZachXBT has revealed the identity of American Tiffany Milanovich, who, according to his data, played a key role in stealing at least $5 million from cryptocurrency owners. The scheme was built on fake calls made in the name of support services of major crypto services.
Milanovich performed the function of a "call operator": she called victims, posing as a tech support employee, and convinced them to hand over control of their assets. After the accounts were drained, she recorded videos mocking the victims, which points to the cynical nature of the criminal activity.
Attack Mechanics
The attacker operated as part of an organized group, imitating the work of support services for hardware wallets and centralized exchanges. The infrastructure for phishing sites was provided to her by accomplices under the pseudonyms "bled" and "harm." In June 2026, one of the victims lost $1.2 million in Bitcoin and Ethereum, which were withdrawn from a Trezor wallet. The attack began with a fake email from BitcoinIRA, signed with the name Patricia Massie.
In October 2025, another victim lost $500,000 in Bitcoin after withdrawing funds from a Coinbase account. Notably, Milanovich then complained about a "small share" and even published transaction screenshots, which indicates her full awareness of the details of the crime.
Trails and Connections
The investigation showed that Milanovich openly demonstrated on social media what she spent the stolen money on: luxury purchases and casino bets. Some of the "boastful" videos were edited to make the theft amounts appear even larger than they actually were. ZachXBT also links her to John "Lick" Dagita, previously accused of stealing cryptocurrency seized by U.S. authorities. Dagita was detained in March on Saint Martin.
This story is just the tip of the iceberg. The FBI recorded more than 80,000 complaints about impersonation of tech support employees in 2025, with losses exceeding $2.9 billion. According to Chainalysis, the number of such schemes in the crypto sector has grown by nearly 1400% over the year.
My comment: The rise of such attacks is an alarming signal for the entire industry. Even hardware wallets, considered the gold standard of security, turn out to be vulnerable when the victim themselves discloses data. Users should take a critical approach to any incoming requests to transfer funds, and exchanges should strengthen verification for suspicious operations. Criminals are becoming increasingly sophisticated, and only comprehensive protection—both technical and behavioral—can reduce the risks.