A U.S. citizen found herself at the center of a scheme to steal $5 million in cryptocurrency: investigation details
My colleagues in digital forensics continue to uncover sophisticated schemes targeting digital asset holders. In the latest analysis conducted by renowned on-chain detective ZachXBT, an American woman named Tiffany Milanovich was identified, who apparently played a key role in an organized group that stole at least $5 million from investors.
The Mechanics of the Crime
Milanovich acted as a "call operator." Her task was to call victims, posing as a support staff member of crypto exchanges or hardware wallets. Using social engineering techniques, she convinced asset owners to hand over control of their funds. After successfully draining accounts, she reportedly recorded videos mocking the victims, indicating cynicism and a complete lack of moral boundaries.
The infrastructure for these attacks was provided by a second group member, known by the pseudonyms "bled" and "harm." He created phishing sites mimicking official support portals, giving the attacks an appearance of legitimacy.
Major Losses and Brazen Attacks
In June 2026, one victim lost $1.2 million in Bitcoin and Ethereum. Notably, the funds were withdrawn from a Trezor hardware wallet, highlighting that even "cold" storage is not a panacea if the owner themselves discloses critical information. The attack began with a fake email purportedly from BitcoinIRA, signed by a certain Patricia Massi.
Another incident occurred in October 2025, when a victim lost $500,000 in BTC from their Coinbase account. Notably, Milanovich apparently complained about her "small share" and even published screenshots of the withdrawals, demonstrating her involvement.
Traces of Luxury and Links to Other Figures
Analysis of digital traces shows that Milanovich did not try to hide her extravagance. Funds went toward purchasing luxury items and placing bets at online casinos. Moreover, some of the "boastful" videos were edited to make the theft amounts appear even more impressive than they actually were.
The investigation also drew parallels between Milanovich and John "Lick" Dagita, who was previously accused of stealing cryptocurrency seized by U.S. authorities. Dagita was arrested in Saint Martin in March, indicating a possible connection between these criminal groups.
A Worrying Trend and My Assessment
This scheme is part of a broader epidemic. According to the FBI, more than 80,000 complaints of tech support impersonation were recorded in 2025 alone, with losses exceeding $2.9 billion. Chainalysis analysts note that the number of such attacks in the crypto sector has grown by nearly 1400% year over year.
My expert opinion: This case is a stark reminder that the most vulnerable link in the security of any blockchain remains the human. Even the most reliable wallets will not help if a user trusts strangers over the phone. The crypto industry needs to implement stricter verification protocols and educate users on basic principles of digital hygiene; otherwise, we will see a geometric rise in such crimes.