Alleged $5M Crypto Fraudster Tiffany Milanovich Dumps Telegram Usernames After ZachXBT Investigation

ZachXBT delivered a particular kind of irony that only crypto Twitter can produce, and this week it arrived right on schedule.

Days after the on-chain investigator dragged Tiffany Milanovich out of the shadows and into a viral thread accusing her of running fake “support” scams worth millions, her prized Telegram usernames are already changing hands.

Not gifted, not lost, sold. The very handles she once used to build her online persona are now sitting in marketplace channels with a price tag attached, and the crypto community is watching it unfold in real time.

It is the kind of plot twist that writes itself: expose someone for allegedly draining strangers’ wallets, and within days, watch them start liquidating their own digital assets. Whether it is panic, damage control, or simply an attempt to cash out before things get worse, the timing has not gone unnoticed.

Who Is Tiffany Milanovich And Why She Is Trending

Until this week, Tiffany Milanovich was mostly known inside insular Telegram and Discord circles for flaunting luxury purchases, casino wins, and screenshots of crypto balances. That changed when ZachXBT, one of the industry’s most followed blockchain sleuths, published a detailed investigative thread naming her as a US-based “threat actor” tied to at least $5 million in cryptocurrency theft.

According to the thread, Milanovich did not write the phishing code or build the fake websites herself. Her alleged role was more human, and arguably more damaging: she was the voice on the phone. Investigators describe her as a “caller,” someone who rang victims while posing as hardware wallet or exchange support staff, coaxing them into handing over the access codes that protected their funds. ZachXBT says she even recorded herself mocking victims after their accounts were drained, clips that reportedly still circulate in private groups.

Inside The Alleged $5 Million Fake Support Scam

The most damaging allegation centers on an incident from June 2026, when a victim is said to have lost $1.2 million in Bitcoin and Ethereum after a spoofed BitcoinIRA email, sent under the alias “Patricia Massie,” tricked them into compromising a Trezor hardware wallet. From there, ZachXBT alleges the group split the stolen funds, with a separate operator known by the aliases “bled” and “harm” allegedly supplying the phishing infrastructure behind the scenes.

It was not an isolated case, either. The thread points to an earlier theft in October 2025, where roughly $500,000 was pulled from a compromised Coinbase account, and describes Milanovich allegedly gambling stolen funds away on an online casino while still on the phone with the person she had just scammed. ZachXBT says he reported the activity, and that the casino, Shuffle, reviewed the evidence and confirmed the account tied to the funds would be locked. The thread also claims some of her “flex” videos showing off crypto balances were doctored to exaggerate how much she actually controlled, and that a search and seizure warrant tied to her name has already surfaced out of Connecticut.

The John Daghita Connection That Blew Her Cover

Part of what pushed this story into the mainstream crypto news cycle is Milanovich’s alleged proximity to John Daghita, known online as “Lick,” the man ZachXBT previously linked to the theft of more than $46 million in cryptocurrency seized by the US government. Daghita was later arrested in the Caribbean in a joint operation between the FBI and French authorities, a case that made international headlines earlier this year.

Per the thread, Milanovich and Daghita were close before their falling out. She allegedly recorded a call with him and shared it publicly to troll him, and he retaliated by posting her real name in his own Telegram channel. That single act of retaliation is reportedly what set ZachXBT’s investigation into motion, turning a private feud into a public exposé that has now cost Milanovich her anonymity entirely.

From Flaunting Stolen Funds To A Telegram Fire Sale

This is where the story takes its most talked-about turn. Shortly after the thread went live, ZachXBT posted an update noting that multiple Telegram username NFTs linked to both Milanovich and her associate, known online as “Haby,” had been listed for sale in a popular Telegram marketplace channel. Haby himself is no stranger to ZachXBT’s radar; he was previously named in a separate investigation tied to more than $2 million in Coinbase impersonation scams.

These username NFTs, minted through Telegram’s Fragment marketplace on the TON blockchain, are treated as genuine digital real estate inside crypto circles. Rare, short, or brandable handles can sell for thousands of dollars, and owning a recognizable username is often part of how influencers, and apparently threat actors, build online credibility. Multiple listings tied to Tiffany and Haby have reportedly surfaced in channels such as @edge, alongside several other resale marketplaces, as buyers move quickly to snap up handles now attached to a very public controversy.

What The Username Sale Could Really Mean

It is worth asking the obvious question: why sell now? Crypto sleuths on social media are floating a few theories. Some believe it is a straightforward liquidity move, an attempt to convert digital assets into cash before accounts get frozen or scrutinized further. Others suspect it is about abandoning a burned identity altogether, cutting ties with usernames that are now permanently associated with a public investigation. There is also the simple possibility that notoriety itself has made these handles more valuable to collectors, ironic as that may sound, and someone is capitalizing on the attention while it lasts.

Whatever the motive, the optics are hard to ignore. A person accused of taking money from victims is now selling off personal digital property just as public and possibly legal scrutiny intensifies.

The Bigger Lesson For Every Crypto Holder

Beyond the drama, this case is a reminder of how social engineering, not smart contract exploits or code vulnerabilities, remains one of the biggest threats in crypto today. No hardware wallet, cold storage setup, or seed phrase discipline can fully protect someone from a convincing voice on the phone claiming to be “support.” The Milanovich case underscores a simple rule that bears repeating: legitimate exchanges and wallet providers will never call and ask for your recovery phrase or remote access to your device.

As ZachXBT’s investigation continues to ripple across timelines and marketplace channels, one thing is clear. In crypto, exposure travels fast, reputations can collapse overnight, and sometimes the clearest sign that someone knows the walls are closing in is watching them start selling off what is left.

Disclosure: This is not trading or investment advice. Always do your research before buying any cryptocurrency or investing in any services. Follow us on X @nulltxnews