A U.S. citizen found herself at the center of a $5 million crypto theft: the scheme uncovered by an on-chain analyst.
A large-scale investigation conducted by renowned on-chain detective ZachXBT has shed light on a sophisticated scheme to steal digital assets, in which U.S. citizen Tiffany Milanovich played a key role. According to my data, the total damage from this group's actions exceeds $5 million. Milanovich, it appears, served as a "call operator": she called victims, posing as a customer support employee of crypto services, and convinced them to hand over control of their funds. After successfully draining accounts, she did not hesitate to record videos mocking the victims.
Anatomy of the Crime
The scheme was fine-tuned to the smallest detail. Milanovich operated as part of an organized group, imitating the technical support of hardware wallets and centralized exchanges. The infrastructure for phishing sites was provided to her by accomplices under the pseudonyms "bled" and "harm." One of the attacks, dated June 2026, resulted in the loss of $1.2 million in Bitcoin and Ethereum by a victim using a Trezor wallet. Notably, the attack began with a fake email from BitcoinIRA, signed by a certain Patricia Massi.
However, this was not the only episode. In October 2025, another victim lost $500,000 in BTC after the group gained access to their Coinbase account. Milanovich, according to available information, even complained about a "small share" and published screenshots of fund withdrawals, indicating her confidence in impunity.
Traces of Luxury and Gambling
Milanovich's spending was as flashy as it was reckless. She openly showcased purchases of luxury items and casino bets made with stolen funds on social media. Moreover, as it turned out, part of the "boastful" videos was edited to make the theft amounts appear even more impressive than they actually were. The investigation also links Milanovich to John "Lick" Dagita, who was previously accused of stealing cryptocurrency seized by U.S. authorities. Dagita was arrested in Saint Martin in March.
These events are just the tip of the iceberg. The FBI recorded more than 80,000 complaints about impersonation of technical support staff and government agencies in 2025 alone, with losses exceeding $2.9 billion. According to Chainalysis estimates, the number of such schemes in the crypto sector grew by nearly 1400% over the year.
My comment: Such incidents highlight the critical importance of verifying any requests for access to funds. Even the most secure wallets are powerless against social engineering if the user themselves hands over control. The market urgently needs stricter KYC/AML standards and user education, otherwise the trend of such attacks growing will continue.