Lina Irawan
On August 10th, a prominent on-chain investigator, known pseudonymously as ZachXBT, leveled serious accusations against Tiffany Milanovich, a United States resident, alleging her direct involvement in a series of sophisticated cryptocurrency scams that have defrauded victims of at least $5 million. The allegations, detailed in a comprehensive thread on the social media platform X (formerly Twitter), paint a picture of a perpetrator who not only executed but also brazenly documented and boasted about her illicit activities. ZachXBT described Milanovich as a key "caller" in these operations, employing tactics of impersonation to gain the trust of victims and ultimately drain their digital assets.
ZachXBT’s Unveiling of the Impersonation Scheme
The core of ZachXBT’s investigation centers on Milanovich’s alleged role in "support impersonation" scams. This insidious form of social engineering targets users by mimicking trusted entities such as cryptocurrency exchanges, hardware wallet providers, and custodial services. Rather than exploiting technical vulnerabilities in blockchain infrastructure, these scams prey on human psychology, leveraging fear, urgency, and a misplaced sense of trust. Scammers often initiate contact through deceptive emails, spoofed phone numbers, or seemingly legitimate login and transaction approval interfaces.
According to ZachXBT’s meticulous on-chain analysis and evidence gathering, Milanovich allegedly went a step further than most perpetrators by actively recording her interactions with victims after their funds had been siphoned. These recordings, along with screenshots and chat logs, were reportedly shared on social media platforms, where Milanovich is accused of publicly flaunting her ill-gotten gains. The investigator highlighted instances of Milanovich boasting about luxury purchases, the scale of her stolen money, and her gambling activities, seemingly without remorse or fear of detection.
The evidence presented by ZachXBT includes a compelling thread on X, accompanied by video clips, screenshots of communications, and a detailed mapping of cryptocurrency wallet addresses to illustrate the flow of stolen assets. This "paper trail," as described by the investigator, is crucial in connecting Milanovich to the alleged criminal enterprise and substantiating the scale of the alleged fraud.
A Chronology of Alleged Victimization
ZachXBT’s investigation has identified several alleged victim cases, spanning from late 2025 through mid-2026, with the most significant single loss documented at a staggering $1.2 million. The timeline of these alleged incidents provides a clearer picture of the operational period and the methodology employed by the scam network.
-
October 2025: The Coinbase Case and a $500,000 Loss
One of the earliest highlighted cases involved a victim who reportedly lost approximately $500,000 worth of Bitcoin. The assets were allegedly drained from a Coinbase account following a support impersonation scam. ZachXBT claims that Milanovich not only participated in the fraudulent call but also recorded it and subsequently shared screenshots of the illicit withdrawal transactions on social media. This incident suggests an early involvement in high-value targets and a pattern of documenting and broadcasting the criminal acts. -
February 2026: Discord "Band 4 Band" and Exodus Wallet Activity
In February 2026, Milanovich is accused of orchestrating the transfer of around $100,000 from an Exodus wallet. This activity is reportedly linked to a social media interaction on Discord, specifically a practice known as "band 4 band." This term typically refers to individuals flexing their financial holdings or balances to compare wealth. ZachXBT’s analysis indicates that an associated cryptocurrency address at this time held approximately $631,000 in DAI, a stablecoin, which had been funded through multiple instant exchanges. This suggests a deliberate effort to obfuscate the origin of the funds and potentially launder them. -
June 2026: The $1.2 Million Bitcoin and Ether Heist
The most substantial alleged theft occurred in June 2026, when a victim lost $1.2 million in Bitcoin and Ether. This incident reportedly stemmed from a phishing email that impersonated BitcoinIRA, with the scammer posing as an individual named "Patricia Massie." Following this major heist, ZachXBT claims that Milanovich began showcasing her newfound wealth in Telegram groups, while the majority of the stolen funds remained largely untouched, possibly awaiting further laundering or conversion.
Beyond Milanovich, ZachXBT’s exposé also pointed to the involvement of several other individuals allegedly connected to the phishing infrastructure and the Telegram channels where stolen funds were later displayed. While these additional connections have not been independently verified by this publication, they underscore the possibility of a broader, organized network facilitating these social engineering attacks, rather than an isolated operation.
The Enduring Playbook of Crypto Impersonation Scams
The modus operandi described by ZachXBT is a chillingly familiar and persistent threat within the cryptocurrency ecosystem. The fundamental principle behind these scams is deceptively simple yet devastatingly effective: instead of breaching a wallet’s technical defenses, scammers manipulate the user into voluntarily surrendering control of their assets. This is achieved through a carefully constructed narrative that exploits the victim’s anxieties and their reliance on perceived official support channels.
In customer support impersonation scams, victims are typically propelled into a state of panic or urgency. This can be triggered by a variety of methods, including fake security alerts via email, urgent phone calls from individuals claiming to be from support teams, or deceptive pop-ups that mimic official websites. Once a sense of crisis is established, the scammers skillfully guide the victim through a series of actions. These often include requests to "confirm transactions," "share security codes" (such as two-factor authentication codes), or, most critically, "transfer assets to a secure wallet" – a wallet that is, in reality, controlled by the scammer.
The insidious nature of this playbook lies in its deceptive framing. Actions that appear to be protective measures, such as "transaction verification," "locking suspicious access," or "moving funds to a safe wallet," are often the very steps that enable the theft. Victims, believing they are safeguarding their assets from an imminent threat, unwittingly complete the final stages of the scam, thereby handing over the keys to their digital fortune.
The Alarming Surge in Crypto Impersonation Scams
The allegations against Milanovich emerge against a backdrop of a significant and escalating global trend of cryptocurrency impersonation scams. Data from reputable blockchain analytics firms paints a stark picture of the financial devastation wrought by these illicit activities. Chainalysis, a leading firm in the field, estimated that in 2025 alone, cryptocurrency-related scams and fraud generated at least $14 billion in illicit on-chain activity. This figure is projected to surpass $17 billion as more newly identified illicit addresses are incorporated into their analysis.
Of particular concern is the dramatic rise in impersonation scams. Chainalysis data indicates a year-over-year increase of over 1,400% in this specific category of fraud. Furthermore, the average payout per scam address has seen a substantial jump, rising from $782 in 2024 to an alarming $2,764 in 2025, suggesting that these scams are becoming more lucrative for their perpetrators.
In the United States, the FBI’s Internet Crime Complaint Center (IC3) reported a staggering 181,565 crypto-related complaints in 2025, with total reported losses exceeding $11 billion. When considering all forms of cyber-enabled fraud, the total losses surpassed $17.7 billion, with investment fraud constituting nearly 49% of all scam-related losses. These statistics underscore a critical point: customer support impersonation cases are no longer fringe occurrences but are indicative of a highly organized and increasingly professionalized fraud market operating within the digital asset space.
Navigating the Perilous Landscape: Warnings and Countermeasures
For cryptocurrency users, the most critical defense against these scams remains vigilance and a healthy skepticism towards unsolicited communications. The clearest warning signs include any requests for sensitive information such as private keys, seed phrases, two-factor authentication codes, session tokens, or demands for remote access to devices. Equally suspicious are any urgent pleas to transfer funds to an external address purportedly for "account protection" or to "secure your assets." Legitimate support channels will rarely, if ever, make such demands.
Exchanges and wallet providers face immense pressure to bolster their security protocols and user education efforts. This includes clearly delineating and promoting their official support channels, implementing more robust withdrawal warnings that explicitly flag potential social engineering tactics, and developing advanced detection mechanisms to identify transactions exhibiting patterns consistent with social engineering attacks. The goal is to create a multi-layered defense system that empowers users and frustrates scammers.
Unverified Claims and the Road Ahead
It is important to note that, at present, the allegations presented by ZachXBT remain largely uncorroborated by official law enforcement agencies. There have been no public statements from the Department of Justice (DOJ), the Federal Bureau of Investigation (FBI), or court filings that definitively confirm the entirety of the incident as described. ZachXBT did share an image of what he claimed was a search-and-seizure warrant in Connecticut, allegedly provided by Milanovich herself, but this document has not been independently verified through public records.
As of the time of this report, there has been no confirmed public response from Tiffany Milanovich or any legal representatives acting on her behalf. Consequently, the specific details regarding her precise role in these alleged crimes, the exact amounts involved in all transactions, and her connections to other purported threat actors are currently based on the independent on-chain investigation conducted by ZachXBT. These remain allegations, not legal conclusions. ZachXBT, however, expressed optimism that Milanovich will eventually face legal consequences, citing the substantial digital footprint she allegedly left behind through chat logs, recordings, and on-chain data as evidence that could aid in future legal proceedings. The ongoing nature of such investigations means that further developments are anticipated.
