On-chain investigator ZachXBT on August 10 accused Tiffany Milanovich, an individual in the US, of involvement in at least $5 million in stolen crypto assets through hardware wallet and centralized exchange customer support impersonation scams. In a thread on X, ZachXBT described Milanovich as a <\/span>\u201ccaller,\u201d <\/span><\/i>who made calls impersonating support personnel to convince victims to grant access or perform actions that led to assets being drained from their accounts.<\/span><\/p>\n According to ZachXBT, Milanovich not only participated in scam calls but also recorded, posted, or shared interactions with victims after funds were drained. The investigator accused her of publicly boasting about luxury spending, stolen money, and gambling activities on social media.<\/span><\/p>\n 1\/ Meet Tiffany Milanovich, a US based threat actor tied to at least $5M in thefts from hardware wallet and centralized exchange support impersonation scams.<\/p>\n She’s recorded herself taunting victims on calls after draining their funds.<\/p>\n Tiffany openly flaunts luxury purchases,\u2026 pic.twitter.com\/mRMD4yhWiz<\/a><\/p>\n \u2014 ZachXBT (@zachxbt) August 10, 2026<\/a><\/p>\n<\/blockquote>\n According to the allegations, Milanovich played a role in<\/span> \u201csupport impersonation\u201d<\/span><\/i> incidents, a form of social engineering in which scammers impersonate support staff from exchanges, crypto wallets, or custody services. Rather than exploiting technical vulnerabilities directly, this playbook targets user panic and trust, often through fake emails, urgent phone calls, or spoofed login\/approval interfaces.<\/span><\/p>\n ZachXBT said Milanovich left behind a \u201cpaper trail\u201d including chat logs, recordings, and on-chain data. The thread was also accompanied by videos, screenshots, and wallet addresses to illustrate the flow of funds as well as how the involved parties communicated after the alleged thefts.<\/span><\/p>\n The cases highlighted by ZachXBT span from late 2025 to mid-2026, with the largest amount in a single case reaching $1.2 million.<\/span><\/p>\n October 2025: A victim lost approximately $500,000 in Bitcoin after assets were drained from their Coinbase account. ZachXBT said Milanovich recorded the call related to this case and posted screenshots of the withdrawal transactions.<\/span><\/p>\n February 2026: Milanovich was accused of moving<\/span> around $100,000<\/b> in an Exodus wallet after engaging in a <\/span>\u201cband 4 band\u201d <\/span><\/i>on Discord with another threat actor\u2014meaning flexing balances or holdings to compare who had more money. ZachXBT said an associated address currently holds around $631,000 DAI and was funded via multiple instant exchanges.<\/span><\/p>\n June 2026: A victim <\/span>lost $1.2 million<\/b> in Bitcoin and Ether after receiving a phishing email impersonating BitcoinIRA under the name <\/span>\u201cPatricia Massie.\u201d<\/b> Following this incident, according to ZachXBT, Milanovich began flexing money in Telegram groups, while most of the stolen funds remained unmoved.<\/span><\/p>\n In addition to Milanovich, ZachXBT mentioned several other actors allegedly linked to the phishing infrastructure and Telegram groups where stolen funds were later flexed. These details have not been independently verified, but they help place the allegations in the context of a broader social engineering network rather than an isolated incident.<\/span><\/p>\n ZachXBT\u2019s allegations reflect a familiar model in crypto: scammers do not need to hack a wallet if they can trick users into handing over control themselves. In customer support impersonation scams, victims are typically maneuvered into a state of urgency via emails, phone calls, or fake login interfaces, then persuaded to confirm transactions, share security codes, or transfer assets to addresses controlled by scammers.<\/span><\/p>\n The dangerous aspect of this playbook is that it is often disguised as an account protection procedure. Requests such as <\/span>\u201ctransaction verification,\u201d \u201clocking suspicious access,\u201d or \u201cmoving funds to a safe wallet\u201d <\/span><\/i>can make victims believe they are mitigating risk, when in reality they are completing the final step for their funds to be drained.<\/span><\/p>\n The case highlighted by ZachXBT comes amid a sharp surge in crypto impersonation scams. <\/span>Chainalysis<\/span><\/a> estimates that crypto-related scams and fraud received at least $14 billion on-chain in 2025, and this figure could <\/span>exceed $17<\/b> billion as newly identified illicit addresses are added. Impersonation scams alone increased by over 1,400% year-over-year, while the average payout per scam address rose from $782 in 2024 to $2,764 in 2025.<\/span><\/p>\nZachXBT\u2019s Allegations<\/b><\/h2>\n
\n
Alleged Victim Cases<\/b><\/h2>\n
A Familiar Scam Playbook<\/b><\/h2>\n
Crypto Impersonation Scams Are Surging<\/b><\/h2>\n
![\"Annual](\"https:\/\/nftplazas.com\/wp-content\/uploads\/2026\/08\/r-charts-ccr-2026.png\")