ZachXBT identifies Tiffany Milanovich in $5M crypto impersonation scam

A US-based threat actor identified as Tiffany Milanovich has been linked to at least $5 million in cryptocurrency theft through an impersonation scam that allegedly involved posing as customer-support representatives for hardware wallets and centralized exchanges.

Onchain investigator ZachXBT identified Milanovich as a member of a wider group that allegedly contacted victims by phone and persuaded them to surrender access to their cryptocurrency holdings. According to his findings, Milanovich acted as the group’s caller, presenting herself as legitimate support staff while guiding victims through the process of handing over control of their funds.

ZachXBT also alleged that Milanovich recorded herself mocking some victims after their cryptocurrency had been drained.

The operation reportedly relied on multiple participants. While Milanovich allegedly handled calls, another individual operating under the aliases “bled” and “harm” was responsible for providing phishing-panel infrastructure used in the scheme.

The investigation highlights how an impersonation scam can exploit trust in familiar cryptocurrency brands and support services rather than relying solely on technical vulnerabilities.

$1.2 million wallet theft highlights the alleged operation

One of the most significant incidents identified by ZachXBT occurred in June 2026, when a victim reportedly lost approximately $1.2 million worth of Bitcoin and Ethereum.

The victim’s Trezor hardware wallet was allegedly drained after the operation began with a spoofed BitcoinIRA email sent under the name “Patricia Massie.” ZachXBT said most of the stolen cryptocurrency remained dormant on the blockchain.

The case followed an earlier alleged theft in October 2025 involving a Coinbase account. In that incident, a victim reportedly lost approximately $500,000 worth of Bitcoin.

According to ZachXBT, Milanovich later complained about her share of the proceeds and posted a screenshot of the withdrawal herself.

The incidents demonstrate the potential financial impact of an impersonation scam when attackers combine social engineering with phishing infrastructure and telephone-based deception.

Rather than directly compromising a blockchain network, the alleged operation targeted the people controlling cryptocurrency wallets and exchange accounts.

Investigator links suspect to crypto spending and another alleged thief

ZachXBT also alleged that Milanovich publicly displayed proceeds from cryptocurrency theft through luxury purchases and casino gambling on social media.

The investigator said she allegedly gambled a victim’s funds at a casino. He also cautioned that some videos apparently showing large amounts of stolen cryptocurrency may have been edited to exaggerate the scale of the thefts.

The investigation further connected Milanovich to John “Lick” Daghita, whom ZachXBT had previously accused of stealing cryptocurrency seized by the US government. Daghita was arrested in Saint Martin in March, according to the report.

The relationship between the two reportedly became public after a dispute.

“Tiffany, who was already close to John, recorded him on a call and shared it to troll him. In retaliation, John posted her name in his public Telegram channel,” — ZachXBT.

The episode adds another dimension to the investigation, as information about alleged participants appears to have emerged partly through conflicts among people connected to the wider criminal network.

Impersonation scam attacks are rising across crypto

The allegations come amid a broader increase in impersonation-based fraud affecting cryptocurrency users and the wider technology sector.

According to FBI data cited in the report, more than 80,000 complaints involving technology-support and government impersonation were recorded in 2025. Reported losses exceeded $2.9 billion.

Chainalysis separately reported that cryptocurrency impersonation scams increased by nearly 1,400% during the same year.

The scale of the increase underscores why users remain vulnerable even when their cryptocurrency is stored in sophisticated hardware wallets or held through established exchanges. An impersonation scam can instead target the user’s judgment, using convincing communications and fabricated support interactions to obtain access.

In the case investigated by ZachXBT, the alleged attackers reportedly combined spoofed emails, fake support identities, telephone calls and phishing infrastructure.

The investigation also illustrates the difficulty of recovering cryptocurrency onrecovering cryptocurrencyce funds have been transferred. Because blockchain transactions can move assets rapidly across multiple addresses, victims may face significant challenges once unauthorized transfers have occurred.