Tiffany Milanovich
Last changed 2026-10-10 · Score recalculated — Rescored under Scoring v2, the published formula (avoid.net/scoring): 0 → 26. Problems weighed by who is responsible: the subject's own conduct −143, problems around the subject, caused by others −1.5; no established finding that it defrauded anyone, so it stays out of the red band; fact-check adjustments (−10) now shown as page reliability, not in the score. Version history →
Why this score
| Every page starts at | 65 |
| The subject's own conduct | -143 |
| Problems around it, caused by others | -1.5 |
| Sum | -79 |
- No established finding that it defrauded anyone, so it stays out of the red band (26 or above).
Score: 26/100 (kept between 0 and 100)
How scoring works →Summary
Tiffany Milanovich is a U.S.-based individual whom on-chain investigator ZachXBT publicly identified on August 10, 2026 as a participant in a crypto support impersonation operation alleged to have caused at least $5 million in verified victim losses. She is alleged to have operated as a 'caller' — the voice contact who phoned victims while impersonating customer support representatives for hardware wallet providers and centralized exchanges including Trezor, Coinbase, and BitcoinIRA — and is connected to other named threat actors and to John Daghita ('Lick'), arrested in March 2026 in connection with a $46 million theft of U.S. government-seized cryptocurrency. No criminal charges against Milanovich had been publicly confirmed as of the date of this report, though ZachXBT stated that a search and seizure warrant in Connecticut predated some of the later incidents he documented.
Connected Entities
10 entities · 60 linked investigations- John Daghita (aka Lick) — US Marshals Crypto Theft→mentioned with→Ethereum(65%)
- Ethereum→mentioned with→Coinbase(60%)
- John Daghita (aka Lick) — US Marshals Crypto Theft→mentioned with→ZachXBT(70%)
- Ethereum→mentioned with→Bitcoin(60%)
- Monero→mentioned with→Bitcoin(60%)
- Monero→mentioned with→ZachXBT(65%)
- Dean Daghita / CMDSS (Command Services and Support)→mentioned with→ZachXBT(70%)
- ZachXBT→mentioned with→Ethereum(70%)
- ZachXBT→mentioned with→Bitcoin(65%)
- Shuffle (shuffle.com)→mentioned with→Ethereum(60%)
- + 24 more
Connected Through
8 shared actors · 623 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- □Ethereumorganization
- □ZachXBTorganization
- ♦Bitcointoken
- ♦Coinbasetoken
9 submissions awaiting moderator review.
Timeline(7 events)
October 2025
Alleged theft of approximately $500,000 in Bitcoin from a Coinbase account via phone-based support impersonation. Exact date within October 2025 unconfirmed.
ZachXBT via CryptoTimes23 January 2026
John Daghita ('Lick'), alleged associate, participated in a Telegram 'band-for-band' exchange and screen-shared a wallet containing tens of millions of dollars traceable to U.S. government seizure addresses. ZachXBT observed and began tracing the funds.
TRM Labs26 January 2026
CoinDesk reported that U.S. Marshals were investigating claims that the son of a government contractor had stolen $40 million in seized cryptocurrency.
CoinDeskFebruary 2026
Milanovich allegedly participated in a Discord call in which participants compared cryptocurrency balances. A connected Ethereum address held approximately 631,000 DAI. Exact date within February 2026 unconfirmed.
ZachXBT via CryptoTimes5 March 2026
John Daghita arrested on Saint Martin island by joint FBI and French Gendarmerie operation in connection with alleged $46 million theft from U.S. Marshals Service seizure wallets.
CoinDesk / ForbesJune 2026
Alleged theft of $1.2 million in Bitcoin and Ethereum from a Trezor hardware wallet victim via spoofed BitcoinIRA email under alias 'Patricia Massie' and phone-based social engineering. Exact date within June 2026 unconfirmed.
ZachXBT via CryptoTimes10 August 2026
ZachXBT published a public investigation on X publicly naming Tiffany Milanovich and linking her to at least $5 million in crypto support impersonation thefts. Multiple crypto news outlets reported on the findings the same day. Shuffle casino confirmed account lockdown.
ZachXBT on X / CryptoTimes / PANewsDecision Log
- slot 455358420 · hash B2xpQEWfomYpJq53FcZmjFszdKU4WmKPEKb1c45U7NrM
- slot 449605521 · hash 7kuJ5s3iKcxcrB1fRWTpgA8bPkf7PxdwK7tzDtxByMbq
- slot 443516148 · hash jvSvt793TXkKLeWLuFsWnHGQVsTNxvznqQSXNqitcvp
- slot 443516115 · hash DPhGEcX22sAeMHNrijLosFRJHK3ptPDSc3w5Zo94fC9X
- slot 443506572 · hash DRuo5PLcQopSiWYcX5L7MDwqVSYJrfPZPWv6zPLprvNv
This investigation is cryptographically anchored to the Solana blockchain (5 decisions). 10 of 13 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 8/10/2026, 5:10:03 PM
last updated: 10/10/2026, 6:40:08 PM
10 viewsavoid.net — verified advice for a post-truth world