A "$5 million support" scheme: how an American woman deceived cryptocurrency holders
On-chain analyst ZachXBT has revealed the identity of an alleged participant in a major scam scheme that caused victims to lose at least $5 million in cryptocurrency. The individual in question is U.S. citizen Tiffany Milanovich, who, according to the investigation, acted as a "call operator" in an organized group.
The scheme was brutally simple: Milanovich called victims, posing as a customer support representative for crypto services, and convinced them to hand over control of their funds. After the accounts were drained, she recorded videos mocking the victims and posted them on social media—apparently to prove her "success" in the criminal underworld.
Attack Mechanics
The criminal group operated in a coordinated manner. Milanovich pretended to work in real support for hardware wallets and centralized exchanges, while her accomplices, using the pseudonyms "bled" and "harm," provided the infrastructure for fake websites. This allowed them to create an appearance of legitimacy and deceive victims.
One of the attacks, which occurred in June 2026, resulted in the loss of $1.2 million in Bitcoin and Ethereum from a Trezor wallet. It all started with a fake email from BitcoinIRA, signed with the name Patricia Massie. According to ZachXBT, a significant portion of the stolen funds has not yet been moved—the assets remain on-chain, offering hope for tracking and recovery.
Another incident, recorded in October 2025, cost a victim $500,000 in Bitcoin—the funds were withdrawn from their Coinbase account. Milanovich, according to the investigation, complained about her "small share" at the time and even posted withdrawal screenshots, trying to downplay her earnings.
Traces of Luxury and Casinos
Where did the stolen money go? Milanovich did not hesitate to show off spending on luxury goods and casino games on social media. Bets were placed with victims' funds, and some of the "boastful" videos were edited to make the theft amounts appear even larger than they actually were.
The investigation also links Milanovich to John "Lick" Dagita, who was previously accused of stealing cryptocurrency seized by U.S. authorities. In March, Dagita was detained in Saint Martin, indicating possible international connections of this group.
Such schemes are part of a troubling trend. The FBI recorded more than 80,000 complaints about impersonation of tech support and government agency staff in 2025 alone, with losses exceeding $2.9 billion. Chainalysis, in turn, notes a nearly 1400% year-over-year increase in such attacks in the crypto sector.
My comment: This case is a stark reminder that even the most secure wallets are vulnerable to social engineering. Never hand over control of your funds over the phone or in correspondence, even if the person claims to be a support employee. Legitimate services never ask for seed phrases or private keys. Vigilance is the only reliable shield.