Tiffany Milanovich apparently never got the memo on an old rule in crime: the moment you start showing off, you start leaving evidence.
While allegedly draining victims of millions in crypto, she wasn’t hiding in the shadows, she was posting the receipts herself, recording her own taunts, and flexing stolen funds like trophies. Now, on-chain investigator ZachXBT says all that bragging has caught up with her, in a report that reads less like a crime blotter and more like a masterclass in how not to get away with it.
I’ve followed enough of these ZachXBT threads to know they rarely stay quiet for long, and this one is no exception. It’s messy, personal, and honestly a little unsettling, because the victims in this story weren’t just robbed. Some of them were mocked while it happened.
Who Is Tiffany Milanovich
According to ZachXBT’s investigation on X, Tiffany Milanovich is a US-based threat actor tied to at least $5 million in thefts from hardware wallet and centralized exchange support impersonation scams. This isn’t a case of someone lurking quietly in the background of a hacking crew. She’s recorded herself taunting victims on calls after draining their funds, and has openly flaunted luxury purchases, stolen funds, and casino gambling on social media.
Her alleged role has a name in this underworld: the “caller.” She reportedly operates as the person who phones victims while posing as exchange or wallet support, talking them into handing over access to their funds. What struck me most is that ZachXBT didn’t just describe this, he published audio said to capture what one of her calls actually sounds like. Hearing it, even secondhand through the thread, makes the whole thing feel less like an abstract “crypto scam” headline and more like something that could happen to anyone’s parent, sibling, or friend.
The $1.2 Million Trezor Heist That Started With A Fake Email
The most damaging case in the report reportedly happened in June 2026. Per the thread, a victim lost $1.2 million in Bitcoin and Ethereum after Tiffany and her group drained the victim’s Trezor wallet, following a spoofed BitcoinIRA email sent under the alias “Patricia Massie.” It didn’t start with a hack in the technical sense, it started with a fake email, designed to make a retirement-savings holder believe they were talking to genuine support.
What happens after theft is often more telling than the theft itself, and this is where the story turns almost cartoonish. ZachXBT says the group flaunted the proceeds inside Telegram groups within hours, while two other alleged accomplices, using the aliases “bled” and “harm”, are believed to have built the phishing infrastructure behind the scam. Most of the stolen funds are reportedly still sitting dormant on-chain, untouched, which honestly might be the smartest thing anyone in this story has done, though it also means the money is one careless transaction away from being traced. You can follow the addresses ZachXBT listed directly in his thread.
A Pattern Of Coinbase Drains And Flexing Stolen Balances
This wasn’t a one-time slip. An earlier case from October 2025 allegedly saw Milanovich and her group steal roughly $500,000 in Bitcoin from a Coinbase account, again through fake support impersonation. And again, the aftermath is where things get almost absurd, she was reportedly recorded complaining about her cut of the payout, then posted a screenshot of the withdrawal herself. It’s the kind of detail that makes you wonder whether some of these alleged scammers actually want to get caught, or simply never think that far ahead.
By February 2026, the bragging had turned into a full-blown competition. ZachXBT describes a Discord call where Milanovich reportedly went “band for band” with another threat actor, comparing wallet balances like it was a rap battle, allegedly moving around $100,000 through an Exodus wallet in the process. It’s a laundering pattern often used to blur the trail between stolen crypto and its final resting place and one ZachXBT lays out address by address in his own report.
The Connection To A Separate $46 Million Government Seizure Case
The part of this story that really pulled me in is Milanovich’s alleged closeness to John Daghita, known online as “Lick.” ZachXBT had previously exposed Daghita for stealing $46 million in crypto that had been seized by the US government. The two were said to be close, close enough that Milanovich allegedly recorded a private call with Daghita and shared it publicly just to embarrass him. It backfired. Daghita reportedly retaliated by naming her on his own public Telegram channel, dragging her further into the spotlight she seemed to enjoy a little too much.
Gambling With Stolen Funds And Doctored Flex Videos
The excess didn’t stop at spending. Milanovich is accused of gambling a victim’s stolen funds on a casino platform while calling and mocking them directly, according to the thread. ZachXBT says he reported the account, and the platform reviewed the evidence and confirmed it would be locked, a rare moment of actual accountability in a story otherwise full of taunting and impunity.
There’s also a twist worth sitting with: not everything she’s flaunted online may even be real. ZachXBT notes that several of her flex videos appear to have been altered to make it look like she’s stolen more than she actually has. In one clip, she reportedly staged footage in a Ledger Live wallet interface, posing as the owner of a service’s hot wallet holding 7,700 JITOSOL, a claim ZachXBT believes was fabricated purely to boost her standing in underground crypto circles.
What Happens Next For Tiffany Milanovich
It’s important to say plainly: none of this is a conviction. ZachXBT himself flags a curious detail, Milanovich reportedly shared a screenshot of a search-and-seizure warrant issued against her in Connecticut, dated before several of the incidents described in the thread. If accurate, that suggests she may have already been under investigation while allegedly continuing to operate. In a separate recording, she reportedly mentions a booked flight and insists her funds remain untouched.
What ZachXBT has assembled is a paper trail few alleged scammers leave behind voluntarily, call recordings, chat logs, public flexing, and on-chain wallet activity, much of it published by Milanovich herself. As ZachXBT put it in closing his thread, she stole from people, taunted them directly, and flexed the proceeds online without a trace of remorse, yet left a complete trail of evidence behind her while doing it. Whether it leads to formal charges is now out of the crypto community’s hands. But for the people who lost life savings to a friendly voice on the other end of a “support call,” this may be the first real crack of accountability they’ve seen. and it came, fittingly, from the very bragging that was supposed to make her untouchable.
Disclosure: This is not trading or investment advice. Always do your research before buying any cryptocurrency or investing in any services.
Follow us on Twitter @themerklehash to stay updated with the latest Crypto, NFT, AI, Cybersecurity, and Metaverse news!