Prominent blockchain investigator ZachXBT identified Tiffany Milanovich as a US-based threat actor tied to at least $5 million in thefts through hardware wallet and centralized exchange support impersonation scams.

He said Milanovich worked as a “caller” and posed as exchange or wallet support, convincing victims to give up access to their funds. ZachXBT said she has recorded herself taunting victims on calls after draining their accounts. He also said she openly shows luxury purchases, stolen funds, and casino gambling on social media.

From Support Calls to Crypto Flexes

In June 2026, one victim lost $1.2 million in BTC and ETH after Milanovich and her group drained a Trezor wallet. According to the on-chain sleuth, the theft followed a spoofed BitcoinIRA email sent under the alias “Patricia Massie.” The accused later began showing off the theft in Telegram groups.

Another threat actor using the aliases “bled” and “harm” appears to have provided the phishing panel infrastructure. Most of the stolen funds have not moved and remain dormant. In October 2025, another victim lost $500,000 in Bitcoin after Milanovich and her group drained a Coinbase account.

ZachXBT said she was recorded complaining about her share of that theft and later posted a screenshot of the withdrawal herself. In February 2026, she also allegedly went “band 4 band” with another threat actor during a Discord call and showed balances to prove who held more.

The investigator claimed that she moved $100,000 to an Exodus wallet. The address now holds 631,000 DAI, which was funded through multiple instant exchanges from Monero.

Connection to John Daghita

As reported by CryptoPotato, ZachXBT had exposed John Daghita, known as Lick, for allegedly stealing $46 million in seized crypto from the US government. He said Milanovich, who was already close to Daghita, recorded him on a call and shared the recording to troll him.

Daghita later retaliated by posting her name in his public Telegram channel. Milanovich was accused of gambling a victim’s stolen funds at a casino while calling and mocking the victim.

ZachXBT said he reported the account, and that Shuffle reviewed the evidence and confirmed the account would be locked. Milanovich appeared to have altered several videos flaunting funds to make it look like she had stolen more than she actually had. In one Ledger Live clip, she is said to have pretended to be the owner of a service hot wallet that received 7.7K JITOSOL.

Milanovich also shared a screenshot of a search and seizure warrant against her in Connecticut, according to the findings. The warrant was dated before several of the incidents described in his posts. In a separate recording, she mentioned a booked flight and said her funds remained untouched.

“Hopefully Tiffany faces legal consequences soon. She stole from people, taunted them directly, and flexed the proceeds online without a trace of remorse. At the same time, she’s left a complete paper trail of chat logs, recordings, and onchain data.”

Source: CryptoPotato