A single Exodus wallet holds 631,000 DAI—a silent testament to Monero's broken promise of anonymity. The address, flagged by on-chain detective ZachXBT, is the terminal node of a chain that began with a phone call.
Four years of ledgers never lie, only distort. This time, the distortion came from a human voice, not a smart contract. The caller—a 26-year-old woman named Grecia Milanovich—allegedly posed as Trezor and Coinbase support to drain over $5 million in crypto. Her methods were not zero-day exploits but rehearsed scripts. She was the human vulnerability in a system designed to be trustless.
Context: The Anatomy of a Social Engineering Attack
The attack vector was brutally simple. Milanovich, acting as a "caller," contacted victims by phone, impersonating official support from hardware wallet providers or exchanges. She used a phishing infrastructure provided by another threat actor known as "bled" or "harm." Fake emails, sent under the name "Patricia Massie" from a fabricated BitcoinIRA account, lured victims into granting access to their Trezor wallets and Coinbase accounts.
One victim lost approximately $1.2 million in BTC and ETH from a Trezor wallet. Another lost $500,000 in BTC from a Coinbase account. The stolen funds were then routed through instant exchanges, converting Monero into DAI, and eventually deposited into an Exodus wallet and an online casino called Shuffle.
The attack was not novel in technique—it was a textbook social engineering play. But its scale and the subsequent investigation revealed systemic weaknesses in the crypto ecosystem's human layer.
Core: The On-Chain Evidence Chain
ZachXBT's investigation is a masterclass in modern crypto forensics. The evidence chain includes three pillars: chat logs, recorded phone calls, and on-chain data.
First, the chat logs. Milanovich boasted in private groups about her exploits, even mocking her victims. She shared screenshots of her Exodus wallet and bragged about luxury purchases. These logs were leaked by a fellow threat actor, John Daghita (known as "Lick"), after a dispute over commission splits. Daghita, previously exposed by ZachXBT for stealing $46 million from the US government, retaliated by publicly naming Milanovich.
Second, the recorded calls. Milanovich allegedly recorded her own calls with victims, including the moment she tricked them into revealing their seed phrases or transferring funds. These recordings were later shared with ZachXBT, providing irrefutable evidence of the fraud.
Third, the on-chain data. By tracing the flow of stolen funds, ZachXBT identified a critical pivot point: the conversion of Monero to DAI through instant exchanges. While Monero transactions are opaque, the exit ramp is not. When the attacker converted to DAI and sent it to a tracked Exodous wallet, the privacy veil lifted. The wallet held 631,000 DAI at the time of public disclosure.
Further investigation showed that a portion of the stolen funds flowed into Shuffle, an online casino. After ZachXBT presented evidence, Shuffle locked the associated account and froze the remaining balance. This marked the first instance of a platform cooperating with an independent investigator to freeze assets before formal law enforcement involvement.
Contrarian: The Attack Was Low-Tech, But the System's Blind Spots Are High-Consequence
Conventional wisdom says that crypto security is about code audits, bug bounties, and hardware wallets. This case proves otherwise. The most devastating attack vector was not a vulnerability in Trezor's firmware or Coinbase's exchange—it was the human trust in official communication channels.
The code whispered what the whitepaper hid: customer support is the weakest link in the trustless chain.
Milanovich's method required no technical expertise. She simply dialed numbers and read scripts. The phishing infrastructure was basic. The fake emails were convincing only because BitcoinIRA and other platforms did not have robust anti-phishing measures. The instant exchange used to convert Monero to DAI did not flag the transaction as suspicious, despite the amounts involved.
Here is the counter-intuitive twist: The attackers' arrogance, not their technical sophistication, led to their downfall. Milanovich recorded herself, boasted in chat logs, and even edited her own videos to make the theft appear larger than it was. She booked a flight to escape but left the funds untouched in monitored wallets. This is not the behavior of a professional criminal—it is the behavior of someone who believed the system was too fragmented to catch her.
But the data doesn't forget. The on-chain trail, once followed, exposes everything. The instant exchange that accepted the Monero-to-DAI trade became a chokepoint. The casino that accepted the DAI deposit became a net. The attacker's own words became the rope.
Takeaway: The Next Phase of Crypto Security Is Human, Not Algorithmic
This case is a blueprint for the future of crypto crime and countermeasures. Expect more social engineering attacks targeting high-net-worth individual who use hardware wallets and centralized exchanges. The industry’s response must evolve from pure code security to comprehensive user education and platform accountability.
What happens when the next "caller" uses deepfake audio or video? What happens when the phishing infrastructure is hosted on decentralized storage? The tools are already here. The question is whether the ecosystem will build the human-layer defenses before the next wave hits.
Whale tails flicker in the NFT gallery shadows, but the real predators are on the phone, not the blockchain.
Based on my experience auditing DeFi protocols in 2020, I learned that composability creates hidden dependencies. The same principle applies to security: the trust in customer support is a composability risk. Every platform that offers voice support must verify identity through out-of-band channels, not just a phone number.
ZachXBT’s work is a model for how independent investigators can bridge the gap between on-chain data and real-world consequences. But the burden cannot fall on a single person. The industry needs standardized protocols—a "Chainalysis for support calls"—that can alert platforms to suspicious activity patterns before funds are swept away.
Until then, the lesson is stark: The code is not the only enemy. The voice on the other end of the line might be.
