logo
    • Buy Crypto
    • Markets
    • Futures
    • Spot
    • Earn
    • Affiliates & AI
    • More
    1. WEEX
    2. Learn
    3. Tiffany Milanovich and the $5M Fake-Support Call Playbook

    Tiffany Milanovich and the $5M Fake-Support Call Playbook

    Altcoin
    By: WEEX|2026-08-11 06:45:00
    0
    Share
    copy
    Prefer us on GooglePrefer us on Google
    FLEXFLEX
    00.00%--
    FLEXFLEX
    APPAPP
    00.00%--
    FASTFAST
    00.00%--
     

    On August 10, 2026, on-chain investigator ZachXBT published a thread naming Tiffany Milanovich, a US-based individual he alleges worked as the "caller" in a series of support-impersonation thefts totalling at least $5 million. The allegations are his — as of August 11, 2026, no law enforcement agency has publicly confirmed her identity, and no charges have been announced.

    The name is trending. The more useful question is the one the coverage keeps skipping: this was not a hack. Nobody broke Trezor's firmware or cracked Coinbase's servers. A person picked up a phone, sounded credible for eleven minutes, and the victim moved the funds themselves. That is a defence problem, not a cryptography problem, and it is the part worth reading.

    What ZachXBT actually alleges about Tiffany Milanovich

    According to the thread posted at roughly 12:03 UTC on August 10, 2026, Milanovich's role in the crew was the voice. She allegedly phoned targets while posing as support staff from a hardware wallet vendor or a centralized exchange, walked them through a "security" procedure, and induced them to hand over access to their own funds.

    ZachXBT lists two anchor incidents. In June 2026, a victim allegedly lost $1.2 million in BTC and ETH from a Trezor wallet after a spoofed BitcoinIRA email sent under the alias "Patricia Massie." In October 2025, roughly $500,000 in BTC was taken from a Coinbase account. He states that a separate actor operating as "bled" and "harm" supplied the phishing-panel infrastructure behind the campaigns, and that proceeds were discussed afterwards in Telegram groups.

    Tiffany Milanovich and the M Fake-Support Call Playbook

    Two details in the thread do more work than the dollar figures. First, he says she recorded herself taunting victims on those calls — meaning the crew kept audio of its own crimes. Second, he notes that some of the "flex" videos appear to have been edited to inflate the apparent size of the hauls, which is a caution against treating scammer self-reporting as data.

    Timeline of the alleged incidents

    DateTargetEntry pointReported lossOn-chain reference cited
    Oct 2025Coinbase accountSupport impersonation call~$500,000 in BTCbc1qw3mej5hx7jhtdagqwt7ljls7wzkda2tym3w0d2; bc1q2r2tjdlcp3s4399g6v0xfamcw40xs5553qx7dx
    Feb 2026—Discord call comparing balancesBalance display, not a theft0x0b8cf7c3c66aa9478b101e203dc31b4e7200dfbc (~631,000 DAI)
    Jun 2026Trezor hardware walletSpoofed BitcoinIRA email, alias "Patricia Massie"~$1.2M in BTC and ETHbc1ql2t0mwtf6unkr8vnlg9hy7njuv7vcvn9nxvlzy; 0x491333e8ea6f4fc2a2475db01b649e1e4602ec3c

    All figures and addresses as reported by ZachXBT on August 10, 2026. The bulk of the June proceeds were still dormant at the time of his post — a detail that matters, because dormant funds are recoverable funds if a seizure ever lands.

    The DAI address is the most instructive line in the table. ZachXBT reports it was funded through multiple instant-exchange transactions originating from Monero. That is the modern laundering shape: take the traceable coin, push it through a privacy chain, come back out into a stablecoin on Ethereum where it sits liquid and spendable. The Monero leg is where conventional chain analysis loses the thread, which is precisely why the case was built on chat logs and call recordings rather than on transaction graphs alone.

    Why the caller is the hardest role to replace

    Phishing panels are commodity infrastructure. Anyone with a few hundred dollars can rent one. Spoofed sender domains are trivial. The scarce input in this business is a person who can hold a stressed, suspicious victim on the line for ten minutes and sound like an employee.

    That is the uncomfortable operational reality behind this case. FatMan, commenting on the thread, made the point bluntly: a caller who reads as a woman from a support desk clears the victim's threat model in a way a generic male voice often does not. Victims are trained by years of security advice to expect a scam to feel like a scam. A calm, apologetic, procedurally competent caller feels like the opposite.

    The practical implication for anyone holding meaningful crypto: your instinct about whether a caller "sounds legitimate" carries no information. It is the single input the attacker optimizes hardest.

    -- Price

    --

    How the attack chain runs, step by step

    Reconstructed from the incidents ZachXBT describes, the sequence is consistent:

    1. Data sourcing. Victims are pulled from leaked customer lists — the BitcoinIRA angle in the June case points at a targeted list, not cold calling.
    2. Priming email. A spoofed message from a plausible sender, under a fabricated staff name, plants the idea that something is wrong with the account.
    3. The call. The caller phones shortly after, referencing the email. Referencing a message the victim genuinely received is the entire trick — it converts a cold call into a warm one.
    4. The manufactured emergency. The account is compromised; funds must be "migrated to a secure address" or a recovery phrase must be "verified."
    5. The victim moves the money. No exploit. The withdrawal is signed by the rightful owner.
    6. Immediate dispersal. Funds hop to instant exchangers, through Monero, and back into stablecoins.

    Step 5 is why hardware wallets did not help here. A Trezor faithfully signs whatever its owner approves. It has no opinion about why.

    What real support never does

    BehaviourLegitimate supportThe impersonation call
    Initiates contactRarely; usually responds to your ticketAlways calls you first
    Asks for your recovery phraseNever, under any circumstanceFrames it as "verification"
    Asks you to move fundsNeverThe core ask, dressed as a rescue
    Creates time pressureNo"Your funds will be drained in minutes"
    Objects to a callbackNo — encourages itDiscourages hanging up, stays on the line

    The single rule that defeats this entire class of attack: hang up and call back through a number or channel you found yourself. Every one of these operations dies at that step, which is why the caller works so hard to keep you from taking it.

    The defences that would have stopped this

    None of these are exotic. All of them are boring, and boring is the point.

    LayerControlWhat it stops
    AccountWithdrawal address whitelist with a cooling-off periodThe panicked transfer to an attacker address
    Account2FA via authenticator app, not SMSCredential reuse and SIM-swap follow-ons
    WalletRecovery phrase never typed into anything, everSeed extraction over a call
    ProcessCallback rule on every inbound "support" contactThe entire pretext
    ProcessA second signer or a 24-hour delay on large movesSole-decision-maker failure

    Withdrawal whitelisting is the one most people skip and the one that matters most in this scenario, because it converts an instant loss into a delay the victim can wake up from. WEEX's own account security guide walks through enabling it alongside 2FA and session monitoring, and the broader account security and risk management guide covers the settings side. Exchange support desks, including WEEX's, will never ask for your password or seed phrase by phone, email, or social media.

    What traders usually miss

    The frequent takeaway from cases like this is "use a hardware wallet." That advice is now partly contested. On July 16, 2026, ZachXBT argued that hardware wallets are not the answer he once considered them and said he does not recommend them for storing significant funds, suggesting technically capable users consider a dedicated iPhone instead, citing the Secure Enclave and app sandboxing.

    Reasonable people disagree with that, and it is a strong claim about a broad product category. But the underlying observation holds: in the June 2026 case the hardware wallet worked exactly as designed and the money left anyway. Device security and human security are different problems, and only one of them was under attack.

    The second thing traders miss is the recovery window. Dormant stolen funds — like the June proceeds ZachXBT describes — are the cases where reporting fast actually changes the outcome. Exchanges can freeze; casinos can lock accounts, as Shuffle reportedly agreed to do after ZachXBT submitted evidence. The first hour after realising you have been drained is worth more than the next six months of forensics.

    Has anyone been charged?

    Not publicly, as of August 11, 2026. ZachXBT's thread includes a screenshot of a Connecticut search-and-seizure warrant he says predates several of the listed incidents, and he notes a connection to John Daghita, known online as "Lick," whom he previously linked to the theft of roughly $46 million in crypto that had been seized by the US government and who was arrested in March 2026. Milanovich is described as close to Daghita.

    That is context, not a charging document. Everything in this article about Milanovich is an allegation by a private investigator, and the appropriate posture until a prosecutor files something is exactly that. WEEX's news desk covered the initial report on August 10, 2026.

    FAQ

    1. Who is Tiffany Milanovich?

    A US-based individual named by on-chain investigator ZachXBT on August 10, 2026 as an alleged participant in crypto support-impersonation thefts totalling at least $5 million. She has not been charged publicly, and the allegations have not been confirmed by law enforcement.

    2. How much crypto is she alleged to have helped steal?

    At least $5 million across multiple incidents, per ZachXBT. The two largest cited are roughly $1.2 million in BTC and ETH from a Trezor wallet in June 2026 and about $500,000 in BTC from a Coinbase account in October 2025.

    3. Was Trezor or Coinbase hacked?

    No. Both incidents as described are social engineering. The victims were persuaded to authorize transfers or surrender access themselves. No vendor exploit is alleged.

    4. How do I tell a fake support call from a real one?

    You cannot, reliably, from the call itself. Hang up and re-initiate contact through a number or in-app channel you look up yourself. Real support has no problem with that; an impersonator will try to keep you on the line.

    5. What should I do in the first hour after being drained?

    Contact the exchange or custodian immediately with the transaction hashes, file with your local law enforcement, and report the addresses publicly or to a chain-analytics contact. Stolen funds that sit dormant are the ones that occasionally get frozen or recovered.

    6. Can stolen crypto that went through Monero be traced?

    Generally not through the privacy leg itself. Investigators typically rebuild those cases from the edges — exchange deposits, instant-swap records, chat logs, and operational mistakes — rather than from the chain alone, which is what ZachXBT appears to have done here.

    Risk Warning

    Crypto assets are volatile and self-custody is unforgiving; a transfer you authorize cannot be reversed, and partial or total loss of funds is possible. Social-engineering losses of the kind described here are almost never covered by any insurance or platform guarantee, because the transaction is technically legitimate — you signed it. Treat every unsolicited call, email, or message claiming to be exchange or wallet support as hostile until you have verified it through a channel you initiated. Never share a recovery phrase, private key, password, or 2FA code with anyone, including anyone identifying themselves as support staff. Details in this article reflect allegations published by ZachXBT on August 10, 2026 and reporting current as of August 11, 2026; no charges have been publicly confirmed, and the situation may change.

    This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.

    You may also like

    Kioxia Stock and SK Hynix: What Rivals Sharing the Same Shareholder Actually Means

    Kioxia Stock and SK Hynix: What Rivals Sharing the Same Shareholder Actually Means

    Is HIMS Stock a Buy After the Earnings Selloff? What the Full-Year Guidance Raise Actually Implies

    Is HIMS Stock a Buy After the Earnings Selloff? What the Full-Year Guidance Raise Actually Implies

    ASTS Stock Falls After Missing Q2 Estimates: What the Revenue Miss and Japan Launch Actually Mean

    ASTS Stock Falls After Missing Q2 Estimates: What the Revenue Miss and Japan Launch Actually Mean

    Intel Stock Is Up Over 170% in 2026: What the AI Foundry Turnaround Actually Required

    Intel Stock Is Up Over 170% in 2026: What the AI Foundry Turnaround Actually Required

    Intel Stock Sale Draws Over $100 Billion in Demand: What the 5x Oversubscription Actually Signals

    Intel Stock Sale Draws Over $100 Billion in Demand: What the 5x Oversubscription Actually Signals

    RKLB Stock Price Targets Range From $64 to $150: What the Analyst Disagreement Actually Reveals

    RKLB Stock Price Targets Range From $64 to $150: What the Analyst Disagreement Actually Reveals

    RKLB Stock Has Fallen Sharply Since SpaceX's IPO: What History Says Happens to Number Two Players

    RKLB Stock Has Fallen Sharply Since SpaceX's IPO: What History Says Happens to Number Two Players

    SPCX Stock Price Target Raised to $450 by Arete Research: What the Upgrade After the Cursor Deal Actually Means

    SPCX Stock Price Target Raised to $450 by Arete Research: What the Upgrade After the Cursor Deal Actually Means

    SPCX Stock Closes Above Its $135 IPO Price for the First Time in Weeks: What the Recovery Actually Signals

    SPCX Stock Closes Above Its $135 IPO Price for the First Time in Weeks: What the Recovery Actually Signals

    XST Coin: Which Token Is It, and How Thin Is the Market?

    XST Coin: Which Token Is It, and How Thin Is the Market?

    HOOD Stock at $94: Record Revenue, Crypto Slump, 24/7 Access

    HOOD Stock at $94: Record Revenue, Crypto Slump, 24/7 Access

    XRP News: Which August 2026 Headlines Actually Move Price

    XRP News: Which August 2026 Headlines Actually Move Price

    CRWV Stock After Q2: Demand Is Fine, the Interest Bill Isn't

    CRWV Stock After Q2: Demand Is Fine, the Interest Bill Isn't

    Best Crypto Trading Bot Strategies for Beginners

    Best Crypto Trading Bot Strategies for Beginners

    How High Can XST Reach? Buy, Hold, or Wait?

    How High Can XST Reach? Buy, Hold, or Wait?

    How to Backtest a Crypto Trading Strategy? A Beginner’s Guide

    How to Backtest a Crypto Trading Strategy? A Beginner’s Guide

    How to Build a Crypto Trading Bot With an Exchange API: A Beginner’s Guide

    How to Build a Crypto Trading Bot With an Exchange API: A Beginner’s Guide

    Crypto Trading Bot vs Manual Trading: Which Is Better?

    Crypto Trading Bot vs Manual Trading: Which Is Better?

    Is Cronos (CRO) Still Worth Buying in 2026? Ecosystem Growth, Staking Yields and Risk Factors

    Is Cronos (CRO) Still Worth Buying in 2026? Ecosystem Growth, Staking Yields and Risk Factors

    Google Stock and the $200 Billion Anthropic Financing Program: What the Largest AI Deal in History Means for GOOG

    Google Stock and the $200 Billion Anthropic Financing Program: What the Largest AI Deal in History Means for GOOG

    Why Is Cronos (CRO) Gaining Trader Attention? Key Drivers Behind the Recent Volume Surge

    Why Is Cronos (CRO) Gaining Trader Attention? Key Drivers Behind the Recent Volume Surge

    Is Bitcoin Preparing for a Bullish Breakout? Key Technical Indicators and On-Chain Data

    Is Bitcoin Preparing for a Bullish Breakout? Key Technical Indicators and On-Chain Data

    How to Avoid Liquidation During Market Crashes? Futures Risk Management Strategies

    How to Avoid Liquidation During Market Crashes? Futures Risk Management Strategies

    Which AI Crypto Tokens Are Surging Today? Top Decentralized AI Projects to Watch

    Which AI Crypto Tokens Are Surging Today? Top Decentralized AI Projects to Watch

    Is Cronos (CRO) Preparing for a Major Rally? Catalysts, Risks and the 2026 Outlook

    Is Cronos (CRO) Preparing for a Major Rally? Catalysts, Risks and the 2026 Outlook

    Which Major Tokens Face Massive Unlocks Tomorrow? Market Impact and Price Predictions

    Which Major Tokens Face Massive Unlocks Tomorrow? Market Impact and Price Predictions

    HIMS Stock Falls After Raising Guidance: What the GLP-1 Regulatory Uncertainty Actually Changes

    HIMS Stock Falls After Raising Guidance: What the GLP-1 Regulatory Uncertainty Actually Changes

    What Are the New Crypto Regulation Laws? Essential Compliance Guide for Traders

    What Are the New Crypto Regulation Laws? Essential Compliance Guide for Traders

    ASTS Stock Price Prediction 2026-2027: Can AST SpaceMobile Recover After the Launch Bottleneck

    ASTS Stock Price Prediction 2026-2027: Can AST SpaceMobile Recover After the Launch Bottleneck

    Is ASTS Stock a Buy After Falling 48% From Its All-Time High? What the $1.3 Billion Backlog Actually Implies

    Is ASTS Stock a Buy After Falling 48% From Its All-Time High? What the $1.3 Billion Backlog Actually Implies

    Kioxia Stock and SK Hynix: What Rivals Sharing the Same Shareholder Actually Means

    Is HIMS Stock a Buy After the Earnings Selloff? What the Full-Year Guidance Raise Actually Implies

    ASTS Stock Falls After Missing Q2 Estimates: What the Revenue Miss and Japan Launch Actually Mean

    Intel Stock Is Up Over 170% in 2026: What the AI Foundry Turnaround Actually Required

    Intel Stock Sale Draws Over $100 Billion in Demand: What the 5x Oversubscription Actually Signals

    RKLB Stock Price Targets Range From $64 to $150: What the Analyst Disagreement Actually Reveals

    ...
    Enjoy 0 fees on 200+ hot stocks and share $100,000
    Register now

    Contents

    What ZachXBT actually alleges about Tiffany Milanovich
    Timeline of the alleged incidents
    Why the caller is the hardest role to replace
    FLEX
    How the attack chain runs, step by step
    What real support never does
    The defences that would have stopped this
    What traders usually miss
    Has anyone been charged?
    FAQ
    Risk Warning

    Popular coins

    Latest articles

    2026/08/10

    Stock Market: The 3 Stocks to Watch This Week (August 10-14, 2026)

    INDEXINDEX
    00.00%--
    FLEXFLEX
    00.00%--
    2026/07/18

    Valuation Doubles to $1.2 Billion in Six Months as Flex Targets Stablecoin + AI Integration

    FLEXFLEX
    00.00%--
    NOWNOW
    00.00%--
    FASTFAST
    00.00%--
    2026/08/12

    Who Really Captures Crypto Revenues?

    APPAPP
    00.00%--
    SPACESPACE
    00.00%--
    NOWNOW
    00.00%--
    THETHE
    00.00%--
    2026/08/12

    Google and Ryanair Sign Five-Year Cloud and AI Agreement

    POWERPOWER
    00.00%--
    SIGNSIGN
    00.00%--
    2026/08/12

    Google Pixel 11 Released: Minor Hardware Changes, Major Gemini Features

    NOWNOW
    00.00%--
    THETHE
    00.00%--
    CROSSCROSS
    00.00%--
    More
    logoCommunity
    iconiconiconiconiconiconicon
    Customer Support:@weikecs
    Business Cooperation:@weikecs
    Quant Trading & MM:bd@weex.com
    VIP Program:support@weex.com
    • About Us
    • Announcement Center
    • Media Kit
    • WEEX Community
    • WXT Zone
    • Announcement
    • Legal Statement
    • Risk Disclosure
    • Terms and Policies
    • Privacy Policy
    • Whistleblower Notice
    • AML/CTF Policy
    • Law Enforcement
    • User Guide
    • Product Launches
    • Crypto News
    • Product Launches
    • Crypto Wiki
    • Learn
    • Q&A
    • Spot
    • Futures
    • Glossary
    • VIP Program
    • Download
    • Affiliate
    • Protection Fund
    • Proof of Reserves
    • Sitemap
    • ETFs
    • Crypto Prices
    • Price Predictions
    • WXT Price
    • BTC Price
    • ETH Price
    • DOGE Price
    • How to Buy Crypto
    • How to Buy WXT
    • How to Buy BTC
    • How to Buy ETH
    • How to Buy DOGE
    • Help Center
    • Fee Schedule
    • Trading Rules
    • WEEX Academy
    • Contact Verifier
    • Submit Feedback
    • About Us
    • Announcement Center
    • Media Kit
    • WEEX Community
    • WXT Zone
    • Announcement
    • Help Center
    • Fee Schedule
    • Trading Rules
    • WEEX Academy
    • Contact Verifier
    • Submit Feedback
    • Customer Support Bot
    • VIP Services
    • Legal Statement
    • Risk Disclosure
    • Terms and Policies
    • Privacy Policy
    • Whistleblower Notice
    • AML/CTF Policy
    • Law Enforcement
    • Proof of Reserves
    • Invite Friends
    • OTC
    • Download
    • Affiliate
    • VIP Program
    • API
    • Broker
    • Listing Application
    • Affiliate T&C
    • Sitemap
    • Futures
    • Spot
    • Copy Trade
    • Markets
    • WEEX Store
    • User Guide
    • Product Launches
    • Crypto News
    • Product Launches
    • Crypto Wiki
    • Learn
    • Q&A
    • Spot
    • Futures
    • Glossary
    • VIP Program
    • Download
    • Affiliate
    • Protection Fund
    • Proof of Reserves
    • Sitemap
    • ETFs
    • Crypto Prices
    • Price Predictions
    • WXT Price
    • BTC Price
    • ETH Price
    • DOGE Price
    • How to Buy Crypto
    • How to Buy WXT
    • How to Buy BTC
    • How to Buy ETH
    • How to Buy DOGE
    • About Us
    • Announcement Center
    • Media Kit
    • WEEX Community
    • WXT Zone
    • Announcement
    • Help Center
    • Fee Schedule
    • Trading Rules
    • WEEX Academy
    • Contact Verifier
    • Submit Feedback
    • Legal Statement
    • Risk Disclosure
    • Terms and Policies
    • Privacy Policy
    • Whistleblower Notice
    • AML/CTF Policy
    • Law Enforcement
    • Customer Support Bot
    • VIP Services
    • Futures
    • Spot
    • Copy Trade
    • Markets
    • WEEX Store
    • Proof of Reserves
    • Invite Friends
    • OTC
    • Download
    • Affiliate
    • VIP Program
    • API
    • Broker
    • Listing Application
    • Affiliate T&C
    • Sitemap
    • User Guide
    • Product Launches
    • Crypto News
    • Product Launches
    • Crypto Wiki
    • Learn
    • Q&A
    • Spot
    • Futures
    • Glossary
    • VIP Program
    • Download
    • Affiliate
    • Protection Fund
    • Proof of Reserves
    • Sitemap
    • ETFs
    • Crypto Prices
    • Price Predictions
    • WXT Price
    • BTC Price
    • ETH Price
    • DOGE Price
    • How to Buy Crypto
    • How to Buy WXT
    • How to Buy BTC
    • How to Buy ETH
    • How to Buy DOGE

    Where new wealth is made

    Download app

    Sign Up
    h5 logo
    Download