An American woman found herself at the center of a scheme to steal $5 million in cryptocurrencies — investigation details
Blockchain investigations analyst ZachXBT has established the involvement of U.S. citizen Tiffany Milanovich in a series of cyberattacks in which attackers stole at least $5 million in digital assets. The scheme was built on the use of fake calls allegedly from cryptocurrency service support teams.
According to my data, Milanovich served as a "call operator": she contacted victims, posing as a technical support employee, and convinced them to hand over control of their funds. After draining their accounts, she recorded videos mocking the victims, highlighting the cynical nature of the criminal activity.
Mechanics of the criminal group
Milanovich operated as part of an organized group, imitating the real support of hardware wallets and centralized exchanges. The infrastructure for phishing sites was provided by two other participants known by the pseudonyms "bled" and "harm." In June 2026, one victim lost $1.2 million in Bitcoin (BTC) and Ethereum (ETH) — the funds were withdrawn from a Trezor wallet. The attack began with a fake email from BitcoinIRA, signed with the name Patricia Massi.
Notably, a significant portion of the stolen assets has still not been moved — the funds remain on on-chain addresses, giving investigators the opportunity to track them. In October 2025, another victim lost $500,000 in Bitcoin after the group gained access to their Coinbase account. Milanovich then openly complained about the "small share" and published transaction screenshots.
Spending and connections
During the investigation, it was revealed that Milanovich did not hide her spending: she purchased luxury goods and placed large bets at casinos using the stolen funds. Some "boastful" videos were edited to make the theft amounts appear even larger than they actually were.
A connection was also established between Milanovich and John "Lick" Dagita, whom ZachXBT accused in January of stealing cryptocurrency seized by U.S. authorities. In March, Dagita was detained in Saint Martin.
This story is just the tip of the iceberg. The FBI recorded more than 80,000 complaints about impersonation of technical support and government agency staff in 2025 alone, with losses exceeding $2.9 billion. According to Chainalysis, the number of such schemes in the crypto sector grew by nearly 1400% over the past year.
My conclusion: this case confirms a troubling trend — social engineering is becoming the primary tool of cybercriminals, bypassing even the most reliable technical protections. Investors should treat any incoming requests to transfer funds with skepticism and always verify support contacts through official channels.