Onchain investigator ZachXBT named a US-based threat actor, Tiffany Milanovich, who is tied to at least $5 million in crypto theft through fake support calls.
According to his findings, Milanovich worked as a “caller,” phoning victims while posing as support staff and talking them into surrendering access to their funds. He said she recorded herself taunting victims after draining them.
Sponsored
Sponsored
How the Impersonation Scheme Worked
Milanovich worked as part of a group. As the caller, she impersonated the hardware wallet and centralized exchange support.
A separate actor using the aliases “bled” and “harm” supplied the phishing-panel infrastructure, according to the report.
In June 2026, a victim lost $1.2 million in Bitcoin (BTC) and Ethereum (ETH) after the group drained the victims Trezor wallet. The attack began with a spoofed BitcoinIRA email sent under the alias “Patricia Massie.” ZachXBT said the bulk of the stolen funds remain dormant onchain.
An earlier theft in October 2025 cost a victim $500,000 in Bitcoin after the group drained a Coinbase account. ZachXBT said Milanovich complained about her cut and posted a screenshot of the withdrawal herself.
Follow us on X to get the latest news as it happens
1Meet Tiffany Milanovich, a US based threat actor tied to at least $5M in thefts from hardware wallet and centralized exchange support impersonation scams.
She's recorded herself taunting victims on calls after draining their funds.
Tiffany openly flaunts luxury purchases,… pic.twitter.com/mRMD4yhWiz
— ZachXBT (@zachxbt) August 10, 2026
Sponsored
Sponsored
How Milanovich Spent the Stolen Crypto
Milanovich openly displayed stolen proceeds, luxury purchases, and casino gambling on social media, the investigator said. She allegedly gambled a victims funds at a casino. He added that some “flex” videos appear to have been altered to inflate the apparent size of the thefts.
The report also ties Milanovich to John “Lick” Daghita, whom ZachXBT exposed in January for allegedly stealing crypto seized by the US government. Daghita was later arrested in Saint Martin in March.
“Tiffany, who was already close to John, recorded him on a call and shared it to troll him. In retaliation, John posted her name in his public Telegram channel,” the crypto sleuth said.
Last night, John Daghita – a U.S. government contractor who allegedly stole more than $46 million in cryptocurrency from the U.S Marshals Service – was arrested on the island of Saint Martin by the French Gendarmeries premier elite tactical unit in a joint operation with the… pic.twitter.com/3ttochgbjk
— FBI Director Kash Patel (@FBIDirectorKash) March 5, 2026
These scams sit within a growing wave of impersonation fraud. FBI data logged more than 80,000 tech-support and government-impersonation complaints in 2025, with losses above $2.9 billion. Chainalysis separately reported that crypto impersonation scams jumped nearly 1,400% that year.