BitcoinIRA and iTrustCapital, two prominent crypto retirement account platforms, have been hit by data breaches that enabled social engineering attacks, with on-chain investigator ZachXBT linking the incidents to US-based threat actor Tiffany Milanovich. The damage so far amounts to at least $5 million in stolen cryptocurrency, including one victim who lost $1.2 million in Bitcoin and Ethereum after receiving a spoofed email that appeared to come from BitcoinIRA. Evidence suggests Milanovich gained unauthorized access to customer databases at both platforms, allowing her to impersonate customer support via fraudulent emails and phone calls to trick victims into revealing private keys and seed phrases. The exposed information reportedly included personal data, investment portfolios, bank-account and custodial-account details, and verification status. As of mid-August, neither platform has publicly acknowledged the breaches. The FBI logged 80,000 complaints related to tech-support impersonation in 2025 with losses totaling $2.9 billion, while Chainalysis tracked a 1,400% increase in such scams over recent years.