Over $5 million stolen. Not from a DeFi hack, not from a smart contract exploit. From a phone call.
That’s the cold reality of the latest on-chain saga uncovered by ZachXBT. A woman named Milanovich, acting as a “caller,” impersonated Trezor, Coinbase, and BitcoinIRA customer support. She convinced victims to hand over access to their wallets. Then, she laundered funds through Monero, instant exchanges, and an online casino called Shuffle.
We didn’t lose to a 0-day; we lost to a script.
This isn’t a story about a broken protocol. It’s a story about broken trust in the infrastructure we built to protect ourselves.
Context: The Anatomy of a Low-Tech Heist
The attack vector is disturbingly simple. Milanovich and her co-conspirator, John Daghita (alias “Lick”), used a two-pronged approach. First, they sent phishing emails, forging BitcoinIRA correspondence under the name “Patricia Massie.” Then, they called the victims, pretending to be exchange or wallet support. The goal? Social engineering. No malware, no zero-day exploits, just a human voice on the other end of the line.
Another threat actor, known by the aliases “bled” and “harm,” provided the phishing panel infrastructure. This is a classic supply chain: one person builds the tool, another uses it. The victims were not small holders. One Trezor wallet was drained of approximately $1.2 million in BTC and ETH. A Coinbase account was cleaned out for $500,000. The total confirmed haul? At least $5 million.
Core: The Forensic Audit of a Crime
Every line of code writes a history of power. In this case, the code was the blockchain, and the history was written in DAI, Monero, and casino chips.
ZachXBT’s on-chain investigation is the technical highlight of this event. He traced the funds to an Exodus wallet holding 631,000 DAI. The DAI originated from Monero, which was converted via multiple instant exchanges. This is the critical point: Monero’s privacy is not absolute. The moment the attacker converted XMR into DAI, the exit became a tracking beacon.
Here’s the flow: - Victim A: Trezor wallet (BTC/ETH) → social engineering attack - Victim B: Coinbase account (BTC) → impersonation - Attackers’ controlled address - Partial transfer to Exodus wallet (~$100,000) - Instant exchange from Monero - Exodus wallet now holds 631,000 DAI - Funds moved to Shuffle (online casino), some spent, some dormant
The attackers’ behavior reads like a textbook case of poor operational security. They spent lavishly on luxury goods, gambling, and even posted videos bragging about their exploits. They modified video footage to make it look like they had stolen more than they actually did. They complained about profit splits in recorded conversations. This is not a sophisticated syndicate; it’s a group of reckless opportunists.
Based on my audit experience, I’ve seen this pattern before. The human factor is always the weakest link. But here, the human factor is on both sides: the victims who trusted the voice, and the attackers who couldn’t keep their mouths shut.
Contrarian: The Pragmatism Test
Let’s push back on the easy narrative. “Monero is for criminals” is a lazy take. The truth is more nuanced.
Monero provided a temporary shield. It delayed the trace, but it didn’t stop it. The exit swap to DAI is where the chain broke. This is not a failure of Monero’s design; it’s a failure of execution by the attacker. They chose to convert to a stablecoin on a transparent chain. Governance isn’t a feature; it’s a firewall.
Another blind spot: the platforms. Trezor, Coinbase, and BitcoinIRA have robust security protocols for their own systems. But they can’t control what a human does over the phone. The real vulnerability here is not in the code, but in the customer service process. There is no standardized verification for “the official support will never ask for your keys.” This is a systemic gap.
And what about Shuffle? The casino locked the accounts after ZachXBT provided evidence. That’s reactive, not proactive. The platform’s AML (Anti-Money Laundering) checks failed to flag the initial deposits. This is a classic case of “exit monitoring” being too little, too late.
Takeaway: The Convergence of Chaos and Code
We are watching the convergence of artificial intelligence, crypto, and human psychology. This case is a preview of what’s coming. Social engineering attacks will become more sophisticated with AI-generated voices and deepfake support calls. The response must be equally sophisticated.
ZachXBT’s methodology—combining chat logs, audio recordings, and on-chain data—is a blueprint for the future. It’s not just about tracking funds; it’s about building a parallel justice system that operates faster than the courts.
But here’s the question I keep asking: What happens when the next caller uses a verified, AI-generated voice of a real Trezor employee?
The infrastructure is ready. The trust is not. Every line of code writes a history of power. But in this case, the power was in the voice, not the code. And we haven’t audited that yet.