Blockchain investigator ZachXBT has identified Tiffany Milanovich as a US-based threat actor allegedly involved in a network responsible for at least $5 million in cryptocurrency thefts. The investigator claims Milanovich acted as a “caller,” impersonating hardware wallet and exchange support to convince victims to relinquish access to their digital assets. The evidence presented includes recordings of alleged victim taunting, social media posts flaunting stolen assets, and a digital trail of transactions.
According to ZachXBT, Milanovich’s alleged activities involved impersonating support staff for services like Coinbase and Trezor. One specific incident cited occurred in June 2026, where a victim allegedly lost $1.2 million in Bitcoin and Ethereum. This theft reportedly followed a spoofed BitcoinIRA email sent under the alias “Patricia Massie.” Another threat actor, known by the aliases “bled” and “harm,” is alleged to have provided the phishing panel infrastructure for these operations.
In October 2025, another victim allegedly lost $500,000 in Bitcoin after Milanovich and her group purportedly drained a Coinbase account. ZachXBT claims Milanovich was recorded complaining about her share of this theft and later posted a screenshot of the withdrawal herself. Further alleged activity in February 2026 involved Milanovich engaging in a “band 4 band” competition with another threat actor on Discord, where balances were reportedly displayed.
Obfuscation and Alleged Retaliation
The investigator claimed that Milanovich moved $100,000 to an Exodus wallet. This address is now reported to hold 631,000 DAI, which was funded through multiple instant exchanges from Monero, a common technique for obfuscating the origin of funds. Most of the stolen funds, according to ZachXBT, have remained dormant.
ZachXBT also detailed a past interaction with John Daghita, also known as Lick, whom the investigator had previously exposed for allegedly stealing $46 million in seized crypto from the US government. ZachXBT stated that Milanovich, who was reportedly close to Daghita, recorded him on a call and shared the recording to troll him. Daghita allegedly retaliated by posting Milanovich’s name in his public Telegram channel.
Evidence of Taunting and a Warrant
Further allegations suggest Milanovich gambled a victim’s stolen funds at a casino while taunting the victim on a call. ZachXBT reported the associated account, and Shuffle reportedly reviewed the evidence and reported the account would be locked. Milanovich also appeared to have altered several videos flaunting funds, potentially to exaggerate the amount stolen. In one instance involving Ledger Live, she allegedly pretended to be the owner of a service hot wallet that received 7.7K JITOSOL.
Milanovich reportedly shared a screenshot of a search and seizure warrant against her in Connecticut. The warrant was dated prior to several of the incidents described in ZachXBT’s posts. In a separate recording, she allegedly mentioned a booked flight and stated her funds remained untouched.
Investigator’s Conclusion and Lingering Questions
ZachXBT concluded his findings by stating, “Hopefully Tiffany faces legal consequences soon. She stole from people, taunted them directly, and flexed the proceeds online without a trace of remorse. At the same time, she’s left a complete paper trail of chat logs, recordings, and onchain data.”
Uncertainties remain regarding the exact total amount stolen by Milanovich and her alleged group, the full extent of the network’s involvement, and whether Milanovich has faced legal consequences. The specific details and outcome of the Connecticut search and seizure warrant are also not fully detailed.
Why This Matters
The allegations detailed by ZachXBT highlight sophisticated impersonation scams and the potential for significant financial losses, underscoring the ongoing risks in the cryptocurrency ecosystem and the importance of robust investigative work. The evidence presented, including chat logs, recordings, and on-chain data, suggests a pattern of alleged illicit activity.
Broader Context
These allegations place the factual news in the context of ongoing challenges in cybersecurity and digital asset protection. The case, as presented by ZachXBT, involves a US-based threat actor allegedly tied to substantial thefts through impersonation scams, emphasizing the need for vigilance among cryptocurrency users and the role of investigators in uncovering such activities.
Leave a Reply