ZachXBT identifies Tiffany Milanovich in $5 million crypto theft scheme

The blockchain investigator says Tiffany Milanovich, a US national, was part of a phone-based scam operation that stole at least $5 million from victims by impersonating support staff for centralized exchanges and hardware wallet services. For high-risk PSPs, the mechanics matter: this was not a classic on-chain exploit, but a support-impersonation funnel that turned phone calls, phishing pages, and social engineering into wallet access.

1. ZachXBT identified Tiffany Milanovich as a “phone operator” in the group, with an alleged role in calling victims and posing as customer support for centralized crypto exchanges or hardware wallet services. A collaborator using the aliases bled and harm allegedly built fake login pages for crypto services, so victims who clicked phishing links and entered credentials handed over access to their wallets.
2. In June, one victim lost $1.2 million in bitcoin and ether from a Trezor hardware wallet. The scammers reportedly sent an email while pretending to be a BitcoinIRA support employee named Patricia Massey, persuaded the victim to reveal wallet access, and then drained the funds. ZachXBT says most of the stolen assets have remained unmoved.
3. In October 2025, the same network allegedly stole $500,000 in bitcoin from a hacked Coinbase account. ZachXBT said this case drew his attention because Milanovich publicly complained that the amount was too small for her taste and even posted a screenshot of the withdrawal transaction.
4. After the victims’ accounts were emptied, Milanovich allegedly mocked them in her Telegram channel. ZachXBT says she posted photos and videos showing luxury purchases and talking about gambling with stolen funds, and that some clips were edited to inflate the scale of the thefts.
5. ZachXBT also said he connected Milanovich to John Daghita, whom he named in January 2026 as tied to the theft of more than $46 million in crypto assets seized by US authorities. Daghita was arrested in March on Saint Martin after a dispute in a messenger app gave him away; Milanovich had previously recorded a phone call with him and made it public, and Daghita later posted her real name in his Telegram channel, which helped ZachXBT trace her.

ZachXBT also said he recently suggested abandoning Ledger hardware wallets, arguing that frequent Ledger updates change the interface and can break basic device functions. For operators, the broader point is plain enough: support-impersonation scams keep working because they target the user, not the chain.