American woman exposed for involvement in stealing $5 million in cryptocurrency through fake tech support.
My analytical work in blockchain security has uncovered yet another high-profile scheme: U.S. citizen Tiffany Milanovich has found herself at the center of an investigation into the theft of at least $5 million in digital assets.
Milanovich acted as a "call operator" in a criminal group, posing as a customer support employee of crypto services. She called victims, convinced them to hand over control of their funds, and after draining their accounts, recorded videos mocking the victims. Her role was key in a multi-stage fraudulent infrastructure, where the technical backbone was provided by accomplices under the pseudonyms "bled" and "harm."
Mechanics of the crimes
One of the attacks, dated June 2026, brought the group $1.2 million in Bitcoin and Ethereum stolen from a Trezor hardware wallet. It all started with a fake email purportedly from BitcoinIRA, signed by a fictitious author named Patricia Massi. Notably, a significant portion of these funds has still not been moved and remains on on-chain addresses, leaving a trail for further investigation.
In October 2025, another victim lost $500,000 in Bitcoin after attackers gained access to her Coinbase account. Milanovich, as it turned out, complained about the "small share" she received from that amount and even published screenshots of the withdrawals, demonstrating her involvement.
Spending and connections
According to my data, Milanovich did not hide her lifestyle: she openly spent the stolen money on luxury items and gambling, placing bets in casinos with victims' funds. Some of her "boastful" videos were edited to make the theft amounts appear even larger than they actually were.
The investigation also links Milanovich to John "Lick" Dagita, who was previously charged with stealing cryptocurrency seized by U.S. authorities and was detained in Saint Martin. This network is just part of a troubling trend: the FBI recorded more than 80,000 complaints about impersonation of tech support staff in 2025, with losses exceeding $2.9 billion. Separate data from Chainalysis indicates a nearly 1,400% year-over-year increase in such schemes in the crypto sector.
My comment: This case highlights the critical vulnerability of users who trust voice calls. The industry needs to implement multi-factor authentication and client education to break this chain of social engineering, which is becoming the main attack vector in 2025–2026.