On Aug. 10, on-chain investigator ZachXBT said a U.S. attacker, Tiffany Milanovich, allegedly stole at least $5 million in crypto assets by posing as customer support for hardware wallet companies and centralized exchanges.
Tiffany allegedly handled the phone-based social engineering
ZachXBT said Tiffany primarily acted as the "caller" in the operation. According to his account, she posed as support staff from trading platforms or wallet providers and persuaded victims to give up access to their accounts. He also said she recorded calls mocking victims after funds had been moved and publicly displayed luxury purchases.
Two cases were specifically described
ZachXBT said that in June 2026, one victim was targeted through a fake BitcoinIRA email, which led to $1.2 million in BTC and ETH being drained from a Trezor wallet.
He added that the attackers later bragged about the funds in a Telegram group. Two other attackers, identified as "bled" and "harm," were also suspected of providing phishing infrastructure.
In a separate case from October 2025, ZachXBT said Tiffany and her group allegedly stole about $500,000 in bitcoin from a Coinbase user by impersonating customer service staff.
Reported use of funds and platform response
ZachXBT also said that in February 2026, Tiffany displayed a balance believed to be stolen funds during a Discord call and bragged about it with other attackers. He said she was also suspected of using victim funds for gambling and of mocking victims during the scams.
The related accounts have now been reported, and Shuffle has confirmed that it will take banning action.
ZachXBT also raised concerns about exaggerated theft claims
According to ZachXBT, some attackers may have inflated the amount they claimed to have stolen by fabricating wallet screenshots or editing videos, in an effort to raise their standing in underground circles.