Tech support phishing report VR-B373F58A
Investigator report
Filed by a vetted PublicAML investigator rather than by an anonymous reader. The account itself has not been independently re-checked.
The addresses below carry a risk label from this report, except those marked victim or mentioned - naming one of those is not an accusation and does not move its score.
- Type
- Phishing
- Reported as
- Tech support phishing
- Chain
- ethereum
- Reported by
- DenysInvestigator
- Incident date
- Jun 19, 2026
- Published
- Sep 9, 2026
What happened
Ethereum leg of the same support-impersonation theft, exposed by ZachXBT on 10 August 2026. In June 2026 a victim lost $1.2M in Bitcoin and Ethereum after the group drained their Trezor wallet, following a spoofed BitcoinIRA email sent under the alias "Patricia Massie". ZachXBT names this address alongside the bitcoin address in post 3/ of the thread. The bitcoin leg (6.9944 BTC, moved 19 June 2026) is filed separately as a Bitcoin report — this form accepts one chain per report. Method: the actor phones victims posing as exchange or hardware-wallet support and talks them into surrendering access to their funds. ZachXBT published recordings of her taunting victims after draining them. A second actor using the aliases "bled" and "harm" appears to have supplied the phishing panel infrastructure. The investigation names Tiffany Milanovich, a US-based threat actor tied to at least $5M in thefts of this type. Amount note: the $1.2M figure is the total loss across both chains as reported by ZachXBT; he does not break it down per chain. The 46 ETH entered here is the largest single movement observed on this address on-chain (11 August 2026), not a confirmed split of the stolen total. The address is now effectively empty. Source: ZachXBT thread, https://x.com/zachxbt/status/2086785488149774411. Filed by PublicAML from public reporting, not by a victim of the incident.
Addresses named in this report
- 0x491333E8EA6f4fC2a2475DB01b649e1E4602ec3cPerpetrator
Named here and believe it is wrong? Open the address page above and use the flag on the assessment. Every dispute is read.