On-chain investigator ZachXBT on August 10 accused Tiffany Milanovich, an individual in the US, of involvement in at least $5 million in stolen crypto assets through hardware wallet and centralized exchange customer support impersonation scams. In a thread on X, ZachXBT described Milanovich as a “caller,” who made calls impersonating support personnel to convince victims to grant access or perform actions that led to assets being drained from their accounts.
ZachXBT’s Allegations
According to ZachXBT, Milanovich not only participated in scam calls but also recorded, posted, or shared interactions with victims after funds were drained. The investigator accused her of publicly boasting about luxury spending, stolen money, and gambling activities on social media.
1/ Meet Tiffany Milanovich, a US based threat actor tied to at least $5M in thefts from hardware wallet and centralized exchange support impersonation scams.
She’s recorded herself taunting victims on calls after draining their funds.
Tiffany openly flaunts luxury purchases,… pic.twitter.com/mRMD4yhWiz
— ZachXBT (@zachxbt) August 10, 2026
According to the allegations, Milanovich played a role in “support impersonation” incidents, a form of social engineering in which scammers impersonate support staff from exchanges, crypto wallets, or custody services. Rather than exploiting technical vulnerabilities directly, this playbook targets user panic and trust, often through fake emails, urgent phone calls, or spoofed login/approval interfaces.
ZachXBT said Milanovich left behind a “paper trail” including chat logs, recordings, and on-chain data. The thread was also accompanied by videos, screenshots, and wallet addresses to illustrate the flow of funds as well as how the involved parties communicated after the alleged thefts.
Alleged Victim Cases
The cases highlighted by ZachXBT span from late 2025 to mid-2026, with the largest amount in a single case reaching $1.2 million.
October 2025: A victim lost approximately $500,000 in Bitcoin after assets were drained from their Coinbase account. ZachXBT said Milanovich recorded the call related to this case and posted screenshots of the withdrawal transactions.
February 2026: Milanovich was accused of moving around $100,000 in an Exodus wallet after engaging in a “band 4 band” on Discord with another threat actor—meaning flexing balances or holdings to compare who had more money. ZachXBT said an associated address currently holds around $631,000 DAI and was funded via multiple instant exchanges.
June 2026: A victim lost $1.2 million in Bitcoin and Ether after receiving a phishing email impersonating BitcoinIRA under the name “Patricia Massie.” Following this incident, according to ZachXBT, Milanovich began flexing money in Telegram groups, while most of the stolen funds remained unmoved.
In addition to Milanovich, ZachXBT mentioned several other actors allegedly linked to the phishing infrastructure and Telegram groups where stolen funds were later flexed. These details have not been independently verified, but they help place the allegations in the context of a broader social engineering network rather than an isolated incident.
A Familiar Scam Playbook
ZachXBT’s allegations reflect a familiar model in crypto: scammers do not need to hack a wallet if they can trick users into handing over control themselves. In customer support impersonation scams, victims are typically maneuvered into a state of urgency via emails, phone calls, or fake login interfaces, then persuaded to confirm transactions, share security codes, or transfer assets to addresses controlled by scammers.
The dangerous aspect of this playbook is that it is often disguised as an account protection procedure. Requests such as “transaction verification,” “locking suspicious access,” or “moving funds to a safe wallet” can make victims believe they are mitigating risk, when in reality they are completing the final step for their funds to be drained.
Crypto Impersonation Scams Are Surging
The case highlighted by ZachXBT comes amid a sharp surge in crypto impersonation scams. Chainalysis estimates that crypto-related scams and fraud received at least $14 billion on-chain in 2025, and this figure could exceed $17 billion as newly identified illicit addresses are added. Impersonation scams alone increased by over 1,400% year-over-year, while the average payout per scam address rose from $782 in 2024 to $2,764 in 2025.
Annual cryptocurrency scam losses. Source: Chainalysis
In the US, the FBI IC3 recorded 181,565 crypto-related complaints in 2025, with total losses exceeding $11 billion. Total losses from cyber-enabled fraud surpassed $17.7 billion, with investment fraud accounting for nearly 49% of total scam-related losses. These figures show that customer support impersonation cases are no longer isolated risks, but part of an increasingly professionally organized fraud market.
For crypto users, the clearest warning signs remain unsolicited calls or emails requesting seed phrases, 2FA codes, session tokens, remote access, or asset transfers to “protect the account.” For exchanges and wallet providers, the pressure lies in clarifying official support channels, increasing withdrawal warnings, and early detection of transactions showing signs of social engineering.
What Remains Unverified
The allegations in the thread currently remain solely from ZachXBT, while there are no public statements from the DOJ, FBI, or court filings confirming the entire incident. ZachXBT also posted a photo of a search-and-seizure warrant in Connecticut that he said Milanovich had shared, but this document has not been independently verified through public records.
There is currently no confirmed public response from Milanovich or her legal representatives. Therefore, details regarding her role, the amounts involved, and connections to other threat actors remain allegations from an independent on-chain investigation, not legal conclusions. ZachXBT said Milanovich left behind a paper trail via chat logs, recordings, and on-chain data, while expressing hope that she will soon face legal consequences.
Credit: Source link
