An American woman found herself at the center of a scheme to steal $5 million in cryptocurrency: investigation details
Analyst ZachXBT has uncovered the involvement of U.S. citizen Tiffany Milanovich in an organized group that stole at least $5 million from cryptocurrency holders. The scheme relied on phishing calls made in the name of support services of major platforms.
Milanovich, acting as a "call operator," phoned victims, posing as a tech support employee, and convinced them to hand over control of their funds. After draining their accounts, she recorded videos mocking the victims, reflecting cynicism and a belief in impunity.
The infrastructure for the attacks was provided by a second group member operating under the pseudonyms "bled" and "harm." In June 2026, one victim lost $1.2 million in Bitcoin and Ethereum stored on a Trezor hardware wallet. The attack began with a fake email from BitcoinIRA, signed with the name Patricia Massi, highlighting the attackers' high level of preparation.
In October 2025, another victim lost $500,000 in BTC after the group gained access to their Coinbase exchange account. According to the investigation, Milanovich complained about her "small share" and even posted screenshots of withdrawals, demonstrating her involvement.
The spending of the stolen funds was far from refined: luxury goods and casino bets. Social media posts show she bragged about amounts that were sometimes even higher than the real ones to appear more successful. ZachXBT also links Milanovich to John "Lick" Dagita, who was accused in January of stealing cryptocurrency seized by U.S. authorities. In March, Dagita was detained in Saint Martin.
This story is a striking example of the rise in impersonation fraud: the FBI recorded over 80,000 complaints about such schemes in 2025 alone, with losses exceeding $2.9 billion. According to Chainalysis estimates, the number of such attacks in the crypto sector grew by nearly 1400% over the year.
My expert opinion: this case highlights that even hardware wallets do not protect against social engineering. Investors should approach any calls and emails critically, and exchanges should strengthen verification for withdrawal requests. Without multi-factor authentication and direct contact with support, risks remain high.