An American woman found herself at the center of a $5 million cryptocurrency theft: the scheme has been revealed
On-chain analyst ZachXBT has revealed the identity of American Tiffany Milanovich, involved in the theft of over $5 million in crypto assets. The scheme, built on fake calls from purported support services, demonstrates how social engineering is becoming the primary weapon in the arsenal of malicious actors.
According to my analysis, Milanovich acted as a "call operator": she phoned victims, posing as a tech support employee, and convinced them to transfer control over their funds. After draining the accounts, she recorded videos mocking the victims—a boldness that ultimately drew the attention of investigators.
How the scam was structured
Milanovich operated as part of an organized group. She mimicked the operations of real support services for hardware wallets and centralized exchanges, while the infrastructure for fake websites was provided by her accomplices under the pseudonyms "bled" and "harm." This was not random improvisation but a carefully planned multi-step operation.
One of the attacks, recorded in June 2026, brought the group $1.2 million in Bitcoin and Ethereum. The victim lost funds from a Trezor hardware wallet after receiving a fake email from BitcoinIRA. Notably, most of the stolen funds have not yet been moved—the assets remain on traceable addresses, offering hope for their recovery.
In October 2025, another victim lost $500,000 in BTC after the group gained access to their Coinbase account. Milanovich then publicly complained about her "small share" and even posted screenshots of the withdrawals—a blatant disregard for operational security.
Traces of luxury and casinos
An analysis of Milanovich's spending shows that she openly bragged on social media about expenditures on luxury goods and gambling. Casino bets were made with the victims' money, and some of the "boastful" videos were edited to make the theft amounts appear even larger than they actually were. This speaks to the criminal's psychological profile: she valued not only the financial gain but also recognition.
ZachXBT also links Milanovich to John "Lick" Dagita, who was previously accused of stealing cryptocurrency seized by U.S. authorities. Dagita was arrested in March on Saint Martin, indicating the transnational nature of this network.
A troubling trend
Such schemes are part of a growing wave of impersonation fraud. The FBI recorded more than 80,000 complaints about fake tech support and government officials in 2025 alone, with losses exceeding $2.9 billion. Chainalysis notes that the number of such attacks in the crypto sector has grown by nearly 1400% year over year.
My conclusion: this case is not just a criminal story but a systemic signal. The crypto industry must more actively implement identity verification and multi-factor authentication, and users must remember forever: no legitimate support service will ask you to transfer funds or reveal your seed phrase. Vigilance is the only reliable shield against such attacks.