logo
    • Buy Crypto
    • Markets
    • Futures
    • Spot
    • Earn
    • Affiliates & AI
    • More
    1. WEEX
    2. Learn
    3. Tiffany Milanovich and the $5M Fake-Support Call Playbook

    Tiffany Milanovich and the $5M Fake-Support Call Playbook

    Altcoin
    By: WEEX|2026-08-11 06:45:00
    0
    Share
    copy
    Prefer us on GooglePrefer us on Google
    FLEXFLEX
    00.00%--
    FLEXFLEX
    APPAPP
    00.00%--
    FASTFAST
    00.00%--
     

    On August 10, 2026, on-chain investigator ZachXBT published a thread naming Tiffany Milanovich, a US-based individual he alleges worked as the "caller" in a series of support-impersonation thefts totalling at least $5 million. The allegations are his — as of August 11, 2026, no law enforcement agency has publicly confirmed her identity, and no charges have been announced.

    The name is trending. The more useful question is the one the coverage keeps skipping: this was not a hack. Nobody broke Trezor's firmware or cracked Coinbase's servers. A person picked up a phone, sounded credible for eleven minutes, and the victim moved the funds themselves. That is a defence problem, not a cryptography problem, and it is the part worth reading.

    What ZachXBT actually alleges about Tiffany Milanovich

    According to the thread posted at roughly 12:03 UTC on August 10, 2026, Milanovich's role in the crew was the voice. She allegedly phoned targets while posing as support staff from a hardware wallet vendor or a centralized exchange, walked them through a "security" procedure, and induced them to hand over access to their own funds.

    ZachXBT lists two anchor incidents. In June 2026, a victim allegedly lost $1.2 million in BTC and ETH from a Trezor wallet after a spoofed BitcoinIRA email sent under the alias "Patricia Massie." In October 2025, roughly $500,000 in BTC was taken from a Coinbase account. He states that a separate actor operating as "bled" and "harm" supplied the phishing-panel infrastructure behind the campaigns, and that proceeds were discussed afterwards in Telegram groups.

    Tiffany Milanovich and the M Fake-Support Call Playbook

    Two details in the thread do more work than the dollar figures. First, he says she recorded herself taunting victims on those calls — meaning the crew kept audio of its own crimes. Second, he notes that some of the "flex" videos appear to have been edited to inflate the apparent size of the hauls, which is a caution against treating scammer self-reporting as data.

    Timeline of the alleged incidents

    DateTargetEntry pointReported lossOn-chain reference cited
    Oct 2025Coinbase accountSupport impersonation call~$500,000 in BTCbc1qw3mej5hx7jhtdagqwt7ljls7wzkda2tym3w0d2; bc1q2r2tjdlcp3s4399g6v0xfamcw40xs5553qx7dx
    Feb 2026—Discord call comparing balancesBalance display, not a theft0x0b8cf7c3c66aa9478b101e203dc31b4e7200dfbc (~631,000 DAI)
    Jun 2026Trezor hardware walletSpoofed BitcoinIRA email, alias "Patricia Massie"~$1.2M in BTC and ETHbc1ql2t0mwtf6unkr8vnlg9hy7njuv7vcvn9nxvlzy; 0x491333e8ea6f4fc2a2475db01b649e1e4602ec3c

    All figures and addresses as reported by ZachXBT on August 10, 2026. The bulk of the June proceeds were still dormant at the time of his post — a detail that matters, because dormant funds are recoverable funds if a seizure ever lands.

    The DAI address is the most instructive line in the table. ZachXBT reports it was funded through multiple instant-exchange transactions originating from Monero. That is the modern laundering shape: take the traceable coin, push it through a privacy chain, come back out into a stablecoin on Ethereum where it sits liquid and spendable. The Monero leg is where conventional chain analysis loses the thread, which is precisely why the case was built on chat logs and call recordings rather than on transaction graphs alone.

    Why the caller is the hardest role to replace

    Phishing panels are commodity infrastructure. Anyone with a few hundred dollars can rent one. Spoofed sender domains are trivial. The scarce input in this business is a person who can hold a stressed, suspicious victim on the line for ten minutes and sound like an employee.

    That is the uncomfortable operational reality behind this case. FatMan, commenting on the thread, made the point bluntly: a caller who reads as a woman from a support desk clears the victim's threat model in a way a generic male voice often does not. Victims are trained by years of security advice to expect a scam to feel like a scam. A calm, apologetic, procedurally competent caller feels like the opposite.

    The practical implication for anyone holding meaningful crypto: your instinct about whether a caller "sounds legitimate" carries no information. It is the single input the attacker optimizes hardest.

    -- Price

    --

    How the attack chain runs, step by step

    Reconstructed from the incidents ZachXBT describes, the sequence is consistent:

    1. Data sourcing. Victims are pulled from leaked customer lists — the BitcoinIRA angle in the June case points at a targeted list, not cold calling.
    2. Priming email. A spoofed message from a plausible sender, under a fabricated staff name, plants the idea that something is wrong with the account.
    3. The call. The caller phones shortly after, referencing the email. Referencing a message the victim genuinely received is the entire trick — it converts a cold call into a warm one.
    4. The manufactured emergency. The account is compromised; funds must be "migrated to a secure address" or a recovery phrase must be "verified."
    5. The victim moves the money. No exploit. The withdrawal is signed by the rightful owner.
    6. Immediate dispersal. Funds hop to instant exchangers, through Monero, and back into stablecoins.

    Step 5 is why hardware wallets did not help here. A Trezor faithfully signs whatever its owner approves. It has no opinion about why.

    What real support never does

    BehaviourLegitimate supportThe impersonation call
    Initiates contactRarely; usually responds to your ticketAlways calls you first
    Asks for your recovery phraseNever, under any circumstanceFrames it as "verification"
    Asks you to move fundsNeverThe core ask, dressed as a rescue
    Creates time pressureNo"Your funds will be drained in minutes"
    Objects to a callbackNo — encourages itDiscourages hanging up, stays on the line

    The single rule that defeats this entire class of attack: hang up and call back through a number or channel you found yourself. Every one of these operations dies at that step, which is why the caller works so hard to keep you from taking it.

    The defences that would have stopped this

    None of these are exotic. All of them are boring, and boring is the point.

    LayerControlWhat it stops
    AccountWithdrawal address whitelist with a cooling-off periodThe panicked transfer to an attacker address
    Account2FA via authenticator app, not SMSCredential reuse and SIM-swap follow-ons
    WalletRecovery phrase never typed into anything, everSeed extraction over a call
    ProcessCallback rule on every inbound "support" contactThe entire pretext
    ProcessA second signer or a 24-hour delay on large movesSole-decision-maker failure

    Withdrawal whitelisting is the one most people skip and the one that matters most in this scenario, because it converts an instant loss into a delay the victim can wake up from. WEEX's own account security guide walks through enabling it alongside 2FA and session monitoring, and the broader account security and risk management guide covers the settings side. Exchange support desks, including WEEX's, will never ask for your password or seed phrase by phone, email, or social media.

    What traders usually miss

    The frequent takeaway from cases like this is "use a hardware wallet." That advice is now partly contested. On July 16, 2026, ZachXBT argued that hardware wallets are not the answer he once considered them and said he does not recommend them for storing significant funds, suggesting technically capable users consider a dedicated iPhone instead, citing the Secure Enclave and app sandboxing.

    Reasonable people disagree with that, and it is a strong claim about a broad product category. But the underlying observation holds: in the June 2026 case the hardware wallet worked exactly as designed and the money left anyway. Device security and human security are different problems, and only one of them was under attack.

    The second thing traders miss is the recovery window. Dormant stolen funds — like the June proceeds ZachXBT describes — are the cases where reporting fast actually changes the outcome. Exchanges can freeze; casinos can lock accounts, as Shuffle reportedly agreed to do after ZachXBT submitted evidence. The first hour after realising you have been drained is worth more than the next six months of forensics.

    Has anyone been charged?

    Not publicly, as of August 11, 2026. ZachXBT's thread includes a screenshot of a Connecticut search-and-seizure warrant he says predates several of the listed incidents, and he notes a connection to John Daghita, known online as "Lick," whom he previously linked to the theft of roughly $46 million in crypto that had been seized by the US government and who was arrested in March 2026. Milanovich is described as close to Daghita.

    That is context, not a charging document. Everything in this article about Milanovich is an allegation by a private investigator, and the appropriate posture until a prosecutor files something is exactly that. WEEX's news desk covered the initial report on August 10, 2026.

    FAQ

    1. Who is Tiffany Milanovich?

    A US-based individual named by on-chain investigator ZachXBT on August 10, 2026 as an alleged participant in crypto support-impersonation thefts totalling at least $5 million. She has not been charged publicly, and the allegations have not been confirmed by law enforcement.

    2. How much crypto is she alleged to have helped steal?

    At least $5 million across multiple incidents, per ZachXBT. The two largest cited are roughly $1.2 million in BTC and ETH from a Trezor wallet in June 2026 and about $500,000 in BTC from a Coinbase account in October 2025.

    3. Was Trezor or Coinbase hacked?

    No. Both incidents as described are social engineering. The victims were persuaded to authorize transfers or surrender access themselves. No vendor exploit is alleged.

    4. How do I tell a fake support call from a real one?

    You cannot, reliably, from the call itself. Hang up and re-initiate contact through a number or in-app channel you look up yourself. Real support has no problem with that; an impersonator will try to keep you on the line.

    5. What should I do in the first hour after being drained?

    Contact the exchange or custodian immediately with the transaction hashes, file with your local law enforcement, and report the addresses publicly or to a chain-analytics contact. Stolen funds that sit dormant are the ones that occasionally get frozen or recovered.

    6. Can stolen crypto that went through Monero be traced?

    Generally not through the privacy leg itself. Investigators typically rebuild those cases from the edges — exchange deposits, instant-swap records, chat logs, and operational mistakes — rather than from the chain alone, which is what ZachXBT appears to have done here.

    Risk Warning

    Crypto assets are volatile and self-custody is unforgiving; a transfer you authorize cannot be reversed, and partial or total loss of funds is possible. Social-engineering losses of the kind described here are almost never covered by any insurance or platform guarantee, because the transaction is technically legitimate — you signed it. Treat every unsolicited call, email, or message claiming to be exchange or wallet support as hostile until you have verified it through a channel you initiated. Never share a recovery phrase, private key, password, or 2FA code with anyone, including anyone identifying themselves as support staff. Details in this article reflect allegations published by ZachXBT on August 10, 2026 and reporting current as of August 11, 2026; no charges have been publicly confirmed, and the situation may change.

    This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.

    You may also like

    XST Coin Buyer's Safety Guide: How to Verify the Real XSolut Token on Solana

    XST Coin Buyer's Safety Guide: How to Verify the Real XSolut Token on Solana

    XST Coin Holder Concentration Risk: What On-Chain Analysis Shows About XSolut's Supply Distribution

    XST Coin Holder Concentration Risk: What On-Chain Analysis Shows About XSolut's Supply Distribution

    Is Reddit Stock a Buy After Falling From Its Highs? What the S&P 500 Inclusion Actually Changes

    Is Reddit Stock a Buy After Falling From Its Highs? What the S&P 500 Inclusion Actually Changes

    Reddit Stock Jumps 11% After S&P 500 Inclusion: What Joining the Index on August 18 Actually Changes

    Reddit Stock Jumps 11% After S&P 500 Inclusion: What Joining the Index on August 18 Actually Changes

    Is Santander Stock a Buy After Its Strongest First Half Ever? What Record EUR 3.8 Billion Profit Actually Implies

    Is Santander Stock a Buy After Its Strongest First Half Ever? What Record EUR 3.8 Billion Profit Actually Implies

    Santander Stock and the Webster Acquisition: What the Federal Reserve Approval Actually Changes

    Santander Stock and the Webster Acquisition: What the Federal Reserve Approval Actually Changes

    What Is IREN? How the AI Data Center Company Behind Microsoft's $9.7 Billion Contract Actually Works

    What Is IREN? How the AI Data Center Company Behind Microsoft's $9.7 Billion Contract Actually Works

    Ondas Stock Falls After Record Q2 Revenue: What the $83.8 Million Beat and EPS Miss Actually Mean

    Ondas Stock Falls After Record Q2 Revenue: What the $83.8 Million Beat and EPS Miss Actually Mean

    Bill Ackman's Pershing Square Re-Enters Netflix: What the Hedge Fund Legend's Return Actually Signals

    Bill Ackman's Pershing Square Re-Enters Netflix: What the Hedge Fund Legend's Return Actually Signals

    IonQ Stock Q2 2026: What 287% Revenue Growth and a $1.87 Billion Net Loss Actually Tell Investors

    IonQ Stock Q2 2026: What 287% Revenue Growth and a $1.87 Billion Net Loss Actually Tell Investors

    IREN Stock and the Microsoft Delivery: What Completing Horizon 1 and Getting Nvidia's Exemplar Status Actually Mean

    IREN Stock and the Microsoft Delivery: What Completing Horizon 1 and Getting Nvidia's Exemplar Status Actually Mean

    XST AI Infrastructure Explained: What XSolut Is Actually Building on Solana

    XST AI Infrastructure Explained: What XSolut Is Actually Building on Solana

    Why XSolut (XST) Chose Solana Over Ethereum: What the Blockchain Choice Actually Means

    Why XSolut (XST) Chose Solana Over Ethereum: What the Blockchain Choice Actually Means

    What Is Crypto Institutional Trading? How Professional Traders and Fund Managers Access Markets Differently

    What Is Crypto Institutional Trading? How Professional Traders and Fund Managers Access Markets Differently

    How to Monetize a Crypto Trading Community in 2026: What the Broker API Model Actually Changes

    How to Monetize a Crypto Trading Community in 2026: What the Broker API Model Actually Changes

    SanDisk Stock Has 95% Upside According to Evercore: What the $2,800 Target Actually Requires

    SanDisk Stock Has 95% Upside According to Evercore: What the $2,800 Target Actually Requires

    WEEX Mini App Launch Promotion: How to Earn Up to 10 USDT and Win an iPhone 17 Pro

    WEEX Mini App Launch Promotion: How to Earn Up to 10 USDT and Win an iPhone 17 Pro

    SanDisk Stock Jumps After Investor Day: What the 80% Margin Target and 2030 Roadmap Actually Mean

    SanDisk Stock Jumps After Investor Day: What the 80% Margin Target and 2030 Roadmap Actually Mean

    XST Crypto Price: Why XSolut's Valuation Is So Hard to Pin Down

    XST Crypto Price: Why XSolut's Valuation Is So Hard to Pin Down

    WEEX Mini App: How to Trade Crypto in Countries Where the App Is Blocked

    WEEX Mini App: How to Trade Crypto in Countries Where the App Is Blocked

    MU Stock After the 28% Drop: What Micron's HBM Backlog Says

    MU Stock After the 28% Drop: What Micron's HBM Backlog Says

    SPCX Has Four Tickers. Which One Are You Actually Trading?

    SPCX Has Four Tickers. Which One Are You Actually Trading?

    What Is XST Coin and Should You Buy It? A No-Nonsense Guide for Crypto Investors

    What Is XST Coin and Should You Buy It? A No-Nonsense Guide for Crypto Investors

    SpaceX Stock Could Be Worth Tens of Trillions in the 2030s: What the Mach33 Forecast Actually Claims

    SpaceX Stock Could Be Worth Tens of Trillions in the 2030s: What the Mach33 Forecast Actually Claims

    SpaceX Stock Has 66% Upside According to Wall Street: What the $231 Consensus Target Actually Requires

    SpaceX Stock Has 66% Upside According to Wall Street: What the $231 Consensus Target Actually Requires

    Morgan Stanley Says SpaceX Stock Can More Than Double: What the Overweight Thesis Actually Requires

    Morgan Stanley Says SpaceX Stock Can More Than Double: What the Overweight Thesis Actually Requires

    SpaceX Stock Price Targets Range From $62 to $800: What the Analyst Disagreement Actually Reveals

    SpaceX Stock Price Targets Range From $62 to $800: What the Analyst Disagreement Actually Reveals

    XST Coin vs Akash Network: How Two AI Infrastructure Tokens Compare

    XST Coin vs Akash Network: How Two AI Infrastructure Tokens Compare

    XST Coin Tokenomics Explained: What 1 Billion Supply and 100% Circulation Actually Mean

    XST Coin Tokenomics Explained: What 1 Billion Supply and 100% Circulation Actually Mean

    How to Sell XST Coin: When and How to Exit Your XSolut Position

    How to Sell XST Coin: When and How to Exit Your XSolut Position

    XST Coin Buyer's Safety Guide: How to Verify the Real XSolut Token on Solana

    XST Coin Holder Concentration Risk: What On-Chain Analysis Shows About XSolut's Supply Distribution

    Is Reddit Stock a Buy After Falling From Its Highs? What the S&P 500 Inclusion Actually Changes

    Reddit Stock Jumps 11% After S&P 500 Inclusion: What Joining the Index on August 18 Actually Changes

    Is Santander Stock a Buy After Its Strongest First Half Ever? What Record EUR 3.8 Billion Profit Actually Implies

    Santander Stock and the Webster Acquisition: What the Federal Reserve Approval Actually Changes

    ...
    Enjoy 0 fees on 200+ hot stocks and share $100,000
    Register now

    Contents

    What ZachXBT actually alleges about Tiffany Milanovich
    Timeline of the alleged incidents
    Why the caller is the hardest role to replace
    FLEX
    How the attack chain runs, step by step
    What real support never does
    The defences that would have stopped this
    What traders usually miss
    Has anyone been charged?
    FAQ
    Risk Warning

    Popular coins

    Latest articles

    2026/08/10

    Stock Market: The 3 Stocks to Watch This Week (August 10-14, 2026)

    INDEXINDEX
    00.00%--
    FLEXFLEX
    00.00%--
    2026/07/18

    Valuation Doubles to $1.2 Billion in Six Months as Flex Targets Stablecoin + AI Integration

    FLEXFLEX
    00.00%--
    NOWNOW
    00.00%--
    FASTFAST
    00.00%--
    2026/08/16

    Web3: Foreign Media Reports AI Content Fatigue Gives Rise to Human-Acted Chatbot Platforms

    2026/08/16

    Israel's Largest Bank Partners with Galaxy: Bitcoin Trading to Be Integrated into Banking App by 2027

    2026/08/16

    Taiwan's GDP Grows 13.72% in First Half: AI Export Boom Driving Growth to 40-Year High

    More
    logoCommunity
    iconiconiconiconiconiconicon
    Customer Support:@weikecs
    Business Cooperation:@weikecs
    Quant Trading & MM:bd@weex.com
    VIP Program:support@weex.com
    • About Us
    • Announcement Center
    • Media Kit
    • WEEX Community
    • WXT Zone
    • Announcement
    • Legal Statement
    • Risk Disclosure
    • Terms and Policies
    • Privacy Policy
    • Whistleblower Notice
    • AML/CTF Policy
    • Law Enforcement
    • User Guide
    • Product Launches
    • Crypto News
    • Product Launches
    • Crypto Wiki
    • Learn
    • Q&A
    • Spot
    • Futures
    • Glossary
    • VIP Program
    • Download
    • Affiliate
    • Protection Fund
    • Proof of Reserves
    • Sitemap
    • ETFs
    • Crypto Prices
    • Price Predictions
    • WXT Price
    • BTC Price
    • ETH Price
    • DOGE Price
    • How to Buy Crypto
    • How to Buy WXT
    • How to Buy BTC
    • How to Buy ETH
    • How to Buy DOGE
    • Help Center
    • Fee Schedule
    • Trading Rules
    • WEEX Academy
    • Contact Verifier
    • Submit Feedback
    • About Us
    • Announcement Center
    • Media Kit
    • WEEX Community
    • WXT Zone
    • Announcement
    • Help Center
    • Fee Schedule
    • Trading Rules
    • WEEX Academy
    • Contact Verifier
    • Submit Feedback
    • Customer Support Bot
    • VIP Services
    • Legal Statement
    • Risk Disclosure
    • Terms and Policies
    • Privacy Policy
    • Whistleblower Notice
    • AML/CTF Policy
    • Law Enforcement
    • Proof of Reserves
    • Invite Friends
    • OTC
    • Download
    • Affiliate
    • VIP Program
    • API
    • Broker
    • Listing Application
    • Affiliate T&C
    • Sitemap
    • Futures
    • Spot
    • Copy Trade
    • Markets
    • WEEX Store
    • User Guide
    • Product Launches
    • Crypto News
    • Product Launches
    • Crypto Wiki
    • Learn
    • Q&A
    • Spot
    • Futures
    • Glossary
    • VIP Program
    • Download
    • Affiliate
    • Protection Fund
    • Proof of Reserves
    • Sitemap
    • ETFs
    • Crypto Prices
    • Price Predictions
    • WXT Price
    • BTC Price
    • ETH Price
    • DOGE Price
    • How to Buy Crypto
    • How to Buy WXT
    • How to Buy BTC
    • How to Buy ETH
    • How to Buy DOGE
    • About Us
    • Announcement Center
    • Media Kit
    • WEEX Community
    • WXT Zone
    • Announcement
    • Help Center
    • Fee Schedule
    • Trading Rules
    • WEEX Academy
    • Contact Verifier
    • Submit Feedback
    • Legal Statement
    • Risk Disclosure
    • Terms and Policies
    • Privacy Policy
    • Whistleblower Notice
    • AML/CTF Policy
    • Law Enforcement
    • Customer Support Bot
    • VIP Services
    • Futures
    • Spot
    • Copy Trade
    • Markets
    • WEEX Store
    • Proof of Reserves
    • Invite Friends
    • OTC
    • Download
    • Affiliate
    • VIP Program
    • API
    • Broker
    • Listing Application
    • Affiliate T&C
    • Sitemap
    • User Guide
    • Product Launches
    • Crypto News
    • Product Launches
    • Crypto Wiki
    • Learn
    • Q&A
    • Spot
    • Futures
    • Glossary
    • VIP Program
    • Download
    • Affiliate
    • Protection Fund
    • Proof of Reserves
    • Sitemap
    • ETFs
    • Crypto Prices
    • Price Predictions
    • WXT Price
    • BTC Price
    • ETH Price
    • DOGE Price
    • How to Buy Crypto
    • How to Buy WXT
    • How to Buy BTC
    • How to Buy ETH
    • How to Buy DOGE

    Where new wealth is made

    Download app

    Sign Up
    h5 logo
    Download