Tech support phishing report VR-B373F58A
Investigator report
Filed by a vetted PublicAML investigator rather than by an anonymous reader. The account itself has not been independently re-checked.
The addresses below carry a risk label from this report.
- Type
- Phishing
- Reported as
- Tech support phishing
- Chain
- ethereum
- Reported by
- DenysInvestigator
- Incident date
- Jun 19, 2026
- Published
- Sep 9, 2026
What happened
Ethereum leg of the same support-impersonation theft, exposed by ZachXBT on 10 August 2026. In June 2026 a victim lost $1.2M in Bitcoin and Ethereum after the group drained their Trezor wallet, following a spoofed BitcoinIRA email sent under the alias "Patricia Massie". ZachXBT names this address alongside the bitcoin address in post 3/ of the thread. The bitcoin leg (6.9944 BTC, moved 19 June 2026) is filed separately as a Bitcoin report — this form accepts one chain per report. Method: the actor phones victims posing as exchange or hardware-wallet support and talks them into surrendering access to their funds. ZachXBT published recordings of her taunting victims after draining them. A second actor using the aliases "bled" and "harm" appears to have supplied the phishing panel infrastructure. The investigation names Tiffany Milanovich, a US-based threat actor tied to at least $5M in thefts of this type. Amount note: the $1.2M figure is the total loss across both chains as reported by ZachXBT; he does not break it down per chain. The 46 ETH entered here is the largest single movement observed on this address on-chain (11 August 2026), not a confirmed split of the stolen total. The address is now effectively empty. Source: ZachXBT thread, https://x.com/zachxbt/status/2086785488149774411. Filed by PublicAML from public reporting, not by a victim of the incident.
Addresses named in this report
Named here and believe it is wrong? Open the address page above and use the flag on the assessment. Every dispute is read.