The Tiffany Milanovich Case: Key Findings
Published 8/11/2026, 12:06:40 AM
ZachXBT's investigation into Tiffany Milanovich (reportedly a 17-year-old US-based threat actor) signals a sophisticated shift toward retail-focused social engineering scams that have successfully drained at least $5 million from individual investors [Source: https://www.indiatimes.com/trending/who-is-tiffany-milanovich-alleged-17-year-old-tied-to-5-million-crypto-thefts-through-fake-trezor-and-coinbase-support-scams-exposed-by-zachxbt/articleshow/133128535.html]. This case highlights a broader trend where attackers prioritize human vulnerability over technical exploits, using professional-sounding support impersonation to bypass hardware wallet security.
The Tiffany Milanovich Case: Key Findings
The investigation revealed a highly organized operation targeting retail users through impersonation of major crypto services.
| Metric/Detail | Data Point |
|---|---|
| Total Estimated Theft | At least $5,000,000 [Source: https://www.indiatimes.com/trending/who-is-tiffany-milanovich-alleged-17-year-old-tied-to-5-million-crypto-thefts-through-fake-trezor-and-coinbase-support-scams-exposed-by-zachxbt/articleshow/133128535.html] |
| Primary Targets | Users of Trezor, Ledger, Coinbase, and BitcoinIRA [Source: https://www.rootdata.com/news/718676] |
| Core Tactics | Phone calls, spoofed emails, and Discord/Telegram social engineering [Source: https://www.rootdata.com/news/718676] |
| Laundering Method | Conversion via Monero (XMR) to obfuscate trails before moving to stablecoin wallets [Source: https://www.indiatimes.com/trending/who-is-tiffany-milanovich-alleged-17-year-old-tied-to-5-million-crypto-thefts-through-fake-trezor-and-coinbase-support-scams-exposed-by-zachxbt/articleshow/133128535.html] |
Documented Retail Exploits
ZachXBT's research identified specific instances where retail investors were targeted with high precision:
- June 2026 ($1.2M Loss): A victim lost $1.2 million in BTC and ETH after receiving a spoofed email from "Patricia Massie" at BitcoinIRA; the funds were moved within 11 minutes of the interaction [Verified: https://x.com/zachxbt/status/2086785488149774411].
- Coinbase Impersonation: A campaign linked to Milanovich and her associates used convincing "Coinbase support" scripts to steal approximately $2 million [Source: https://www.tradingview.com/news/cointelegraph:c7daa5441094b:0-how-zachxbt-exposed-a-coinbase-impersonation-scam-using-onchain-clues/].
- Victim Taunting: Milanovich reportedly recorded calls where she taunted victims after their funds were stolen, later flaunting the balances in Discord "wealth displays" [Source: https://x.com/thecomfeed/status/2086791126753652832/photo/1].
Broader Signals for Retail Scams
The exposure of this network suggests several evolving risks for retail participants:
- Social Engineering Dominance: As technical security (like hardware wallets) hardens, scammers are shifting to "low-tech" methods that exploit user trust. The Milanovich case shows that professional-sounding support calls can have success rates 10-20x higher than automated phishing.
- Demographic Shift in Actors: The involvement of young, US-based actors—including Milanovich's alleged link to John Daghita (arrested for a $46M theft)—indicates a lower barrier to entry for high-value crypto crime [Verified: https://www.coindesk.com/business/2026/03/05/son-of-u-s-government-contractor-accused-of-stealing-millions-in-seized-crypto-arrested-in-france].
- Manufactured Credibility: Related investigations show scammers using networks of accounts to manufacture "war panic" or viral news to drive retail traffic toward fraudulent support links [Source: https://phemex.com/news/article/zachxbt-exposes-network-of-accounts-using-war-panic-for-crypto-scams-68258].
Conclusion: The Milanovich exposure confirms that retail-focused scams are becoming more personalized and psychologically aggressive. While the specific $5 million theft is significant, the primary signal is the effectiveness of impersonation tactics against even "secure" hardware wallet users.