Blockchain investigator ZachXBT said an alleged scammer using the alias Tiffany Milanovich stole at least $5 million in crypto by posing as customer support staff for exchanges and hardware wallet providers. ZachXBT published the investigation thread on the evening of Aug. 10 and said the suspect is a minor. Some media reports cited in the article said she is around 17 years old.
According to Foresight News, the suspect acted as a "caller" inside a fraud group, directly phoning victims while pretending to represent an exchange or wallet support team. The calls used claims about unusual account activity or urgent security checks to pressure victims into handing over account access or seed phrases, after which the assets were moved.
Cases highlighted in the investigation
In one case from June this year, a victim received a fake BitcoinIRA phishing email and was directed to a fraudulent support call. That led to the transfer of $1.2 million in Bitcoin and Ether from the victim's Trezor wallet to two addresses tied to the scheme. Most of those funds remain dormant, according to the report.
In another case from October last year, $500,000 in Bitcoin was stolen from a victim's Coinbase account using the same playbook. ZachXBT said Tiffany later complained that her share of the proceeds was too small and then posted a withdrawal screenshot on her own.
Recordings, wallet balances and fund movements
ZachXBT said one thing that set Tiffany apart from other scammers was what happened after the thefts. The report said she openly bragged about the proceeds and mocked victims. ZachXBT also shared a recording that captured part of one call with a victim.
In February this year, she allegedly compared wallet balances with other scammers on Discord and showed about $100,000 in an Exodus wallet. The related address still holds about 631,000 DAI, with funds sourced from repeated conversions of Monero through instant exchanges, the investigation said.
The report also said she used victim funds to gamble on the crypto casino Shuffle while taunting victims during calls. ZachXBT said he reported the activity to the platform and was told the account had been locked. He also said she may have edited several bragging videos to overstate the amount stolen.
Limited public identity trail
Despite the attention-seeking behavior, the article said Tiffany Milanovich did not run public social media accounts under her real name. Most of the boasting and harassment described in the report took place in private channels such as Telegram groups and Discord calls, not on public platforms like X or Instagram. Accounts on X using the same or similar names were either barely active or unrelated to the case.
Public records reviewed for the report did not show any prior formal arrest, prosecution or conviction tied to her. No verified education or work history was identified either. Still, the article said she once shared a screenshot of a Connecticut search and seizure warrant dated earlier than some of the incidents described, suggesting law enforcement may already have investigated her. The reason and outcome were not disclosed.
Ties to John Daghita
The investigation also pointed to a close relationship between Tiffany and John Daghita. In January this year, ZachXBT said Daghita was involved in the theft of $46 million in crypto from wallets seized by the U.S. government. The new report said Tiffany recorded calls mocking him, while Daghita later exposed her name in a public Telegram channel as retaliation.
Daghita was arrested in Saint Martin in March this year by the FBI and French police, according to the article.
A wider pattern of support impersonation scams
Foresight News said this kind of support impersonation and social engineering attack is far from isolated in crypto. In May this year, ZachXBT said Coinbase users lost about $45 million in a single week to similar scams. Several waves of fake support operations from late 2024 to early 2025 led to more than $65 million in thefts, the report said.
The article also referenced the case of Ronald Spektor, a 23-year-old man from New York who was charged after allegedly posing as an elite Coinbase support representative. Prosecutors said he used stolen customer data to call victims and stole nearly $16 million from about 100 victims.
It also cited the earlier Chirag Tomar case, in which the perpetrator built spoofed exchange websites and used phone calls to guide victims through the fraud. Losses in that case topped $20 million, and Tomar was sentenced to five years in prison after pleading guilty in 2024.
Hardware wallet users have also been targeted. The article said this year saw physical mail scams in which fake official letters from Ledger and Trezor were sent to users' home addresses with QR codes prompting seed phrase entry. It also mentioned a fake Ledger Live app that stayed on Apple's App Store for about two weeks and stole about $9.5 million.
Industry data cited by the report
According to reports from Chainalysis and other institutions cited in the article, crypto impersonation scams in 2025 were up more than 1,400% year over year. The FBI has also received complaints tied to technical support and customer service impersonation scams that produced annual losses ranging from hundreds of millions to tens of billions of dollars.
Foresight News said these scams keep working because attackers exploit the trust attached to exchange and wallet brands, then target users with weaker security awareness or larger holdings. Once crypto is transferred out, the transactions cannot be reversed.
For users, the most basic safeguard remains the same: official exchange and wallet teams do not call first to ask for seed phrases, and they do not instruct customers to move assets to a so-called safe address. If such a call comes in, hang up and verify through official channels.