ZachXBT detailed how Milanovich called victims on the phone, impersonating customer support staff from centralized cryptocurrency exchanges or hardware wallet services, deceitfully convincing people to grant access to their funds. The blockchain investigator wrote that the accomplice, using the aliases 'bled' and 'harm', created websites mimicking the login pages of crypto services. When a victim clicked a link from a phishing email and entered their credentials on such a site, the perpetrators gained access to their cryptocurrency wallet.
In June, one victim lost $1.2 million in Bitcoin and Ethereum from a Trezor hardware wallet. The scammers sent an email posing as an employee of the crypto service BitcoinIRA named Patricia Massi. The victim was tricked into revealing access to the wallet—and all funds were stolen. ZachXBT tracked that the majority of the stolen assets remain unmoved to this day. Earlier, in October 2025, the fraudsters misappropriated $500,000 worth of Bitcoin, stolen from a hacked account on the Coinbase exchange. This case caught ZachXBT's attention because for Milanovich, the amount of stolen money seemed too small, a fact she publicly complained about and even posted a screenshot of the withdrawal transaction.
The on-chain detective recounted how, after draining victims' accounts, the woman mocked the deceived individuals in her Telegram channel. Milanovich posts photos and videos, flaunting expensive purchases and talking about using the stolen money for casino bets. The online investigator asserts she specifically edits some videos to exaggerate the scale of the thefts.
1/ Meet Tiffany Milanovich, a US based threat actor tied to at least $5M in thefts from hardware wallet and centralized exchange support impersonation scams.
— ZachXBT (@zachxbt) August 10, 2026
She's recorded herself taunting victims on calls after draining their funds.
Tiffany openly flaunts luxury purchases,... pic.twitter.com/mRMD4yhWiz
ZachXBT wrote that he discovered a connection between Milanovich and John Daghita, whom he named in January 2026 as involved in the theft of over $46 million in crypto assets, which were seized by US authorities. In March, Daghita was detained on the island of Saint Martin—the man gave himself away during a dispute in a messenger app. Earlier, Milanovich recorded a phone call with Daghita and made it publicly available. In retaliation, Daghita published her real name in his Telegram channel, which allowed the blockchain detective to track down the scammer.
Recently, ZachXBT suggested abandoning the use of Ledger hardware wallets. In his opinion, frequent Ledger updates change the interface and could disrupt the device's basic functions.
end-content
