2026 Crypto Crime Report: Scams

TL;DR

• We estimate $17B was stolen in crypto scams and fraud in 2025 — as impersonation scams present large 1400% year-over-year (YoY) progress. AI-enabled scams had been 4.5 occasions extra worthwhile than conventional scams.
• Main rip-off operations grew to become more and more industrialized, with subtle infrastructure, together with phishing-as-a-service instruments, AI-generated deepfakes, {and professional} cash laundering networks.
• Sturdy connections to East and Southeast Asian crime networks had been recognized, significantly by means of pressured labor compounds in Cambodia, Myanmar, and different areas, the place trafficking victims are pressured to function scams.
• Legislation enforcement made record-breaking seizures, together with a 61,000 bitcoin restoration within the UK and a $15 billion seizure linked to the Prince Group criminal organization, displaying improved functionality to fight crypto fraud.

In 2025, cryptocurrency scams acquired at the very least $14 billion on-chain, a major improve from the $9.9 billion we first reported in 2024, which reached $12 billion at our recalculation as of this writing – a quantity that was broadly in step with our projected $12.4B for the yr. Primarily based on historic tendencies, wherein our annual estimates develop by a median of 24% between reporting durations, we undertaking that the 2025 determine may exceed $17 billion as we determine extra illicit pockets addresses within the coming months.

This yr’s knowledge present scammers persevering with to adapt and innovate, with the common rip-off cost growing from $782 in 2024 to $2,764 in 2025, a progress of 253% YoY. Total rip-off inflows have additionally surged, significantly by means of impersonation ways that noticed a staggering 1400% year-over-year (YoY) progress. Whereas high-yield funding applications (HYIP) and pig butchering stay dominant classes by quantity, we’re seeing growing convergence throughout rip-off sorts as fraudsters leverage AI, subtle SMS phishing providers, and complicated money laundering networks to focus on victims extra successfully than ever earlier than.

Conventional rip-off categorizations have gotten much less distinct as fraudsters incorporate a number of ways into their operations. For instance, many pig butchering and funding scams incorporate components of impersonation, social engineering, and even technical- or wallet-focused scams.

Impersonation scams see explosive progress

Impersonation scams have emerged as a very regarding development, rising greater than 1400% in comparison with 2024, with the common severity (i.e., quantity) of funds made to those clusters growing by over 600%. These scams contain fraudsters posing as legit organizations or authority figures to control victims into transferring funds.

Authorities impersonation: The E-ZPass rip-off community

Authorities impersonation has develop into an efficient tactic, with scammers leveraging the inherent belief folks place in official communications. One of the vital prolific examples was the widespread “E-ZPass” phishing marketing campaign that focused hundreds of thousands of Individuals utilizing the E-ZPass digital highway toll assortment system in 2025.

This operation was attributed to a Chinese language-speaking cybercriminal group generally known as “Darcula” often known as the “Smishing Triad.” This China-based cybercrime community used phishing-as-a-service instruments to distribute SMS messages impersonating toll assortment businesses, significantly concentrating on E-ZPass customers throughout at the very least eight states. This group makes a speciality of these ways and has additionally impersonated the U.S. Postal Service.

In response to Google’s lawsuit, filed in November 2025, Smishing Triad leveraged software program from “Lighthouse,” a Chinese language-language vendor that gives cybercriminals “phishing for dummies,” with a whole lot of templates for faux web sites, area setup instruments, and options designed to evade detection.

The group created fraudulent web sites mimicking authorities businesses, together with the New York Metropolis authorities official web site (nyc.gov) and New York E-ZPass (e-zpassny.com), designed to be indistinguishable from the legit web sites they impersonated.

Along with illustrating how cybercriminals leverage infrastructure bought with cryptocurrency to hold out felony exercise, this case reveals how the on-chain footprints left by cybercriminals generates actionable disruption alternatives. As depicted within the graph under, varied Chinese language felony underground entities, such because the Taihe Gong scamming group, have bought Lighthouse phishing kits and acquired funds from a number of Chinese language-language cash laundering networks (CMLNs) and fraud retailers. Taihe Gong contains Chinese language-speaking operators suspected of participating in fraudulent cybercriminal actions, together with the sale of phishing kits. Its operational construction suggests established distribution channels for malicious instruments designed to facilitate illicit exercise, equivalent to on-line scams and credential theft.

The E-ZPass case demonstrates how low-cost the scamming infrastructure is, with some phishing kits doubtless bought for underneath $500. However a comparatively cheap rip-off at scale can nonetheless have an enormous influence: the E-ZPass scheme allegedly reached 330,000 texts in a single day as a part of a separate toll payment rip-off marketing campaign, amassing $1 billion over three years and duping over 1 million folks in at the very least 121 nations, in accordance with Google’s lawsuit. In response to Cisco Talos, the phishing kits had completely different pricing tiers, together with $50 in cryptocurrency for a “full-feature improvement,” $30 for proxy improvement, and $20 for model updates and help. Lighthouse acquired over 7,000 deposits and amassed over $1.5 million in cryptocurrency in three years.

Sadly, Lighthouse is just not the one vendor. Gary Warner, Director of Intelligence at DarkTower, is monitoring eight main Chinese language-language “Crime-as-a-Service” teams on Telegram, every of which has a number of distributors providing iMessage and RCS phishing providers. The objective of those phish, in accordance with Warner, is to load bank cards onto cell wallets, then deploy to a community of consumers world wide who facilitate trade-based cash laundering by buying luxurious items and electronics for resale, usually utilizing “distant Faucet-to-Pay” providers.  All the things from phishing design, internet hosting, and spamming, to procuring, cash-pickup, and items buying is offered in these Chinese language felony Telegram teams, a few of which have greater than 300,000 members. All shopping for, promoting, and promoting are finished utilizing stablecoins because the forex of selection. Warner provides that a lot of the abroad cash laundering additionally goals to transform items or money into stablecoins for simple transmission again abroad.

Personal sector impersonation: Coinbase impersonation marketing campaign

In December 2025, the Brooklyn District Legal professional’s workplace indicted Ronald Spektor, a 23-year-old Brooklyn resident, for orchestrating a classy cryptocurrency rip-off that defrauded victims of practically $16 million. Spektor and his conspirators impersonated Coinbase customer support representatives, contacting customers – whose info that they had stolen in a bribery scheme – with alarming claims about unauthorized entry to their accounts and convincing them to switch their cryptocurrency to “safe” wallets managed by the scammers. The recent arrest in India of a former Coinbase customer support agent who allegedly accepted $250,000 in bribes as a part of this rip-off underscores how human belief stays among the many most exploitable vulnerabilities in safety infrastructures, as this insider breach compromised practically 70,000 clients’ knowledge and enabled credible impersonation assaults regardless of sturdy technical safeguards.

The scheme particularly focused cryptocurrency exchange customers by exploiting their belief in what seemed to be legit customer support communications, demonstrating how impersonation scams have developed to leverage customers’ anxieties about account safety. This case exemplifies the rising sophistication of alternate impersonation ways and their devastating influence on victims who believed they had been defending their digital property. As Brooklyn District Legal professional Gonzalez mentioned, “My workplace…will proceed to root out each occasion of cryptocurrency fraud, which is a major problem that’s been exploding all through the nation. We’ll examine offenders utilizing the newest expertise, freeze their property each time potential, and help the victims.”

Following funds from impersonation scams demonstrates evolving DeFi laundering ways

Impersonation scams even have distinctive laundering patterns that rely closely on the DeFi ecosystem. This development contrasts sharply with different scams, which proceed to rely closely on centralized exchanges to launder funds (a development we’ll confer with later when discussing pig butchering scams). Curiously, impersonation scams appear to have moved in distinctive waves when leveraging DeFi to layer funds. In 2024, these scams noticed spikes related to laundering through good contracts and token good contracts. In 2025, these pronounced volumes subsided in lieu of alternating waves related to bridge use (early-to-mid 2025) and DEX use (second half of 2025). These patterns present the consistently adapting nature of rip-off operations, which fluctuate by way of main laundering factors and the kinds of providers used.

AI and superior instruments are supercharging rip-off effectiveness

We’re moving toward a future wherein nearly all scams will incorporate AI into their operations to a point. Whereas many scammers purchase AI instruments by means of conventional cost channels, a subset buys these instruments on-chain, making their transactions seen. Exploring the variations between scams with seen on-chain associations to Chinese language AI distributors lets us estimate the dimensions and effectivity of AI.

As depicted under, 76% of AI-enabled scams are within the time-weighted high-value/high-volume quadrant. Because of this a big majority of scams with demonstrable on-chain hyperlinks to usually Telegram-based Chinese language AI distributors promoting face-swap software program, deepfake applied sciences, and LLMs are inclined to (1) scale extra shortly (i.e., larger incoming switch charges) and (2) be extra extreme (i.e., larger each day USD volumes) than scams with out these clear on-chain hyperlinks to AI distributors.

AI-enabled scams extract 4.5 occasions extra money

In response to a report revealed by J.P. Morgan in July 2025, scammers are more and more leveraging deepfake expertise and AI-generated content material to create convincing impersonations in romance and funding scams. Our evaluation reveals that, on common, scams with on-chain hyperlinks to AI distributors extract $3.2 million per operation in comparison with $719,000 for these with out an on-chain hyperlink — 4.5 occasions extra income per rip-off. These AI-related operations additionally exhibit considerably better time-weighed effectivity:

• Greater each day income: $4,838 vs $518 median each day income
• Elevated transaction quantity: 35.1 vs 3.89 common transfers per day (9x extra transaction exercise)

These metrics counsel each larger operational effectivity and doubtlessly broader sufferer attain. The elevated transaction quantity signifies that AI is enabling scammers to succeed in and handle extra victims concurrently, a development per the industrialization of fraud we’ve been monitoring. In distinction, the elevated rip-off quantity means that AI is likewise making scams extra persuasive.

In response to Will Lyne, Head of Financial & Cybercrime on the Metropolitan Police, “Fraud linked to cryptocurrency continues to develop in scale and class, with organised crime teams more and more utilizing impersonation ways, on-line infrastructure, and AI-enabled instruments to focus on victims at tempo and scale. Nonetheless, we’re additionally seeing a step change in regulation enforcement’s capability to reply. By specialist capabilities, worldwide cooperation, and the efficient use of economic and digital intelligence, we’re higher outfitted to determine felony networks, seize illicit property, and disrupt exercise that causes hurt in our communities.”

The industrialization of fraud

The Lighthouse case exemplifies one other key development: the professionalization and commercialization of the instruments wanted by scammers to execute subtle, industrial-scale scams. The Lighthouse Enterprise operated a fancy enterprise mannequin the place completely different actors specialised in distinct elements of the scams and fraud provide chain:

• Developer Group: Provided phishing software program and templates
• Knowledge Dealer Group: Offered focused lists of potential victims
• Spammer Group: Supplied instruments to ship fraudulent textual content messages at scale
• Theft Group: Specialised in monetizing stolen delicate info
• Administrative Group: Ran on-line recruitment and collaboration boards

This modular, service-based method is a pressure multiplier and permits even technically unsophisticated criminals to execute subtle phishing campaigns, considerably reducing the barrier to entry for cryptocurrency fraud. Many of those campaigns have a social media angle, provided that such platforms present entry to hundreds of thousands of customers, and are thus prime targets for sending automated messages. In such instances, scammers might purchase bulk social media profiles and use SMS and phishing kits to speak.

The fabric influence of this large-scale industrialization can’t be understated. Scams leveraging these phishing kits are 688 occasions more practical in greenback phrases and 4 occasions more practical in common transaction measurement than common scams. Scams that purchase bulk social media accounts are likewise 238 occasions more practical in greenback phrases and two occasions more practical in common transaction worth in comparison with common scams.

The UNODC has beforehand warned about rip-off campaigns’ use of malware, a phenomenon we’re more and more seeing on-chain. Chinese language scammers, particularly, frequently lace scams with Stealer Malware or Distant Entry Trojans (RATs) that may drain accounts with out interacting with victims. The bar for fulfillment is then far more achievable for scammers, who solely want one click on from a sufferer somewhat than growing a relationship with them.

Legislation enforcement on the offensive, with report seizures concentrating on rip-off operations

The rising scale and class of rip-off exercise prompted unprecedented regulation enforcement motion in 2025, culminating in two of the largest-ever crypto-related regulation enforcement actions straight linked to rip-off operations.

Jian Wen and Yadi Zhang

In November 2025, the UK’s Metropolitan Police secured convictions in a landmark crypto cash laundering case that led to the world’s largest confirmed cryptocurrency seizure, recovering over 61,000 Bitcoin — at the moment valued at round £5 billion — from Chinese language nationwide Zhimin Qian (often known as Yadi Zhang), who orchestrated a multibillion-pound funding fraud in China that victimized greater than 128,000 folks between 2014 and 2017. Qian was sentenced to 11 years and eight months’ imprisonment for possessing and transferring felony property, whereas her confederate Seng Hok Ling acquired a virtually five-year time period for his function in laundering the cryptocurrency. This case not solely underscores the dimensions and class of crypto-linked cash laundering networks spanning jurisdictions, but in addition highlights the persistent risk posed by criminals making an attempt to transform illicit crypto proceeds into real-world property by means of complicated worldwide schemes.

“This was a protracted, complicated, and unprecedented investigation into the laundering of felony proceeds by means of cryptocurrency. Over numerous years, vital efforts had been made to maneuver and disguise the funds and convert them into property within the UK,” mentioned Detective Sergeant Isabella Grotto, the lead investigating officer on the case. “By working carefully with companions within the UK and abroad, with help from Chainalysis, we had been capable of hint the motion of the cryptocurrency, determine property linked to the offending, and in the end recuperate greater than 61,000 bitcoin. That work was central to constructing the case and securing this end result.”

The investigation, constructed on info courting again to 2018, revealed that Qian had fled to the UK underneath a false id after amassing illicit funds and had tried to launder them through luxurious property purchases and different high-value property, a sample seen in lots of large-scale fraud operations. The record-setting seizure and subsequent jail sentences exhibit regulation enforcement’s rising functionality to hint and disrupt subtle fraud-to-crypto cash laundering globally, reinforcing the worth of blockchain transparency in dismantling even deeply entrenched felony networks.

The Prince Group

In a serious disruption of the worldwide rip-off ecosystem, the U.S. Division of Justice (DOJ) unsealed costs towards Prince Group chairman Chen Zhi for allegedly overseeing Cambodian forced-labor rip-off compounds that powered large-scale cryptocurrency fraud concentrating on victims worldwide. In response to prosecutors, these compounds operated as vertically built-in fraud factories: trafficked people had been coerced into working pig butchering funding scams and romance fraud schemes, laundering proceeds by means of cryptocurrency to obscure attribution and scale operations globally. The case underscores how fashionable rip-off networks have professionalized, integrating human trafficking, cash laundering, and crypto-enabled fraud right into a single, industrialized enterprise mannequin.

Critically, U.S. authorities paired these indictments with large-scale monetary disruption, together with arrests throughout transnational cash laundering networks and actions to grab and forfeit greater than $15 billion in illicit proceeds linked to rip-off exercise. In October, working in shut coordination with the UK’s Overseas Commonwealth and Growth Workplace (FCDO), the U.S. Division of the Treasury’s Workplace of Overseas Property Management (OFAC) collectively designated 146 targets inside the Prince Group Transnational Legal Organisation. The designation cited a “laundry checklist of transnational crimes, together with the development, operation, and administration of rip-off compounds reliant on human trafficking and modern-day slavery the place industrial-scale cyberfraud operations goal victims world wide, together with U.S. residents.” In a improvement that demonstrates the complicated geopolitical dimensions of prosecuting transnational crypto crime, Chen was arrested in Cambodia in January 2026 after his Cambodian citizenship was revoked in December, and was subsequently extradited to China for investigation somewhat than to america the place he faces indictment, highlighting the jurisdictional challenges in dismantling international rip-off networks.

These actions mark a shift from reactive sufferer restoration to systematic dismantling, concentrating on not simply front-line scammers, but in addition the executives, infrastructure, shell corporations, and monetary rails that maintain them. Collectively, the Prince Group case and associated DOJ, OFAC, and FCDO actions illustrate a brand new, extra built-in section in rip-off enforcement: one targeted on breaking the financial spine of crypto-enabled fraud at scale and throughout borders, somewhat than treating scams as native, remoted, or purely digital crimes.

Tickmilleas

The U.S. authorities is pursuing a forfeiture of tickmilleas[dot]com, a rip-off area that served as core infrastructure for a transnational crypto funding fraud community working out of the Tai Chang rip-off compound alongside the Myanmar-Thailand border. Registered in November 2025 through a Singapore-based registrar, the positioning impersonated a legit monetary providers agency to deceive primarily U.S.-based victims into sending BTC, ETH, USDT, and USDC to crypto wallets managed by abroad scammers. Blockchain evaluation reveals victims had been funnelled by means of U.S. crypto exchanges earlier than funds had been quickly moved by means of a number of wallets and consolidation addresses – hallmark ways {of professional} on-chain cash laundering – explicitly linking the area to cross-border skilled cash laundering. Tickmilleas’s operators are tied to Chinese language organized crime syndicates embedded in Southeast Asia’s rip-off compound ecosystem, with on-the-ground safety from the DKBA, an armed group sanctioned by OFAC for supporting cyber rip-off facilities.

These instances exhibit the dimensions of recent cryptocurrency rip-off operations and their growing integration with conventional organized crime. Additionally they reveal the human value of those schemes, which exploit each monetary victims and the trafficked people pressured to function them, itself an unspeakable crime. These prosecutions’ success additionally underscores the rising functionality of worldwide regulation enforcement to hint cryptocurrency flows and dismantle complicated felony enterprises. Nonetheless, the commercial scale of worldwide rip-off operations suggests the problem stays appreciable.

Sturdy regional nexus to East and Southeast Asia persists

Our on-chain evaluation continues to indicate persistent connections between cryptocurrency scams and operations primarily based in East and Southeast Asia. Whereas the Huione Assure platform recognized in our 2025 report was successfully shut down following FinCEN’s 311 designation — which severed its entry to the U.S. monetary system — we’ve noticed enlargement of comparable operations throughout the area.

The centrality of the area to pig butchering is a defining attribute of the rip-off ecosystem. The chart under reveals the ‘vacation impact’ related to the Chinese language New Yr public vacation (7 days initially of the 15-day new yr celebration). Beginning round 2022, roughly when Huione started to play a central function in laundering funds from rip-off compounds equivalent to KK Park, there was a notable discount in pig butchering rip-off exercise in the course of the 7-day public vacation related to the Chinese language New Yr. After the information have been detrended and seasonally adjusted, common each day pig butchering exercise drops notably throughout these brief home windows. This sample means that the Chinese language vacation is related to a discount in inflows to pig butchering scams, indicating that actors in East and Southeast Asia play an vital function on this rip-off ecosystem.

Our research shows that pig-butchering networks throughout Southeast Asia, drawing closely on CMLNs, generate billions of {dollars} yearly and depend on layered pockets buildings, exchanges, shell corporations, and casual banking channels to launder funds and convert crypto into real-world property, together with actual property and luxurious items. The Prince Group case research displays this mannequin, underscoring how rip-off operators and underground laundering networks type a resilient ecosystem that quickly adapts to enforcement strain, shifts infrastructure, and continues to scale globally.

ATM scams concentrating on the aged launder funds through assure providers and CMLNs

Scams concentrating on older adults symbolize a number of the most financially devastating frauds reported within the US, with current estimates indicating that Individuals aged 60 and older lose billions of {dollars} yearly to monetary exploitation and fraud, together with practically $4.9 billion in reported losses in 2024 alone, greater than another age group, according to AARP and FBI knowledge. The FBI’s Web Crime Grievance Middle (IC3) additional underscores this development: in 2024, people aged 60 and older reported $2.8 billion in losses from crypto-related scams, reflecting each the dimensions and the rising function of digital property in fashionable fraud. Whereas elder fraud encompasses a broad vary of schemes, cryptocurrency ATMs have emerged as a notable on-ramp for scams. Reported losses from Bitcoin ATM fraud have risen sharply in recent years, and older victims are disproportionately affected by these kiosk-based conversions. The aged, who usually have vital retirement financial savings but restricted familiarity with irreversible digital cost strategies, stay significantly susceptible to such ways.

Our on-chain evaluation reveals that funds originating at U.S. crypto ATMs incessantly move into wallets related to Southeast Asia-based CMLNs and assure providers, which function key intermediaries within the broader international rip-off infrastructure. Whereas not all on-chain flows from scams to CMLNs will be traced on to ATM on-ramps, crypto ATMs stay a crucial enter for scammers concentrating on older adults, who are sometimes instructed to transform money into cryptocurrency at these kiosks earlier than funds are shortly transferred. On this context, actors leveraging crypto ATMs as each cost conduits and loci of fraud more and more rely on CMLNs to launder and combine stolen funds into the broader monetary system, illustrating how conventional elder fraud has developed right into a transnational, crypto-enabled ecosystem.

Regional infrastructure past KK Park and Huione compounds

The regional connection is additional evidenced by the off-ramping patterns we observe, with a good portion of pig butchering rip-off proceeds flowing to CMLNs. In Q1 2022, lower than 1% of pig butchering rip-off laundering flows went to CMLNs. By Q1 of 2024, these providers processed barely over 20% of pig butchering rip-off laundering flows for the quarter, and these networks persistently laundered over 10% of rip-off funds in 2025. Curiously, the expansion in CMLN exercise associated to pig butchering scams has coincided with a gradual decline in using centralized exchanges to launder or offramp funds, doubtlessly as a result of exchanges can freeze funds. Broadly, this speedy and sustained progress of CMLNs showcases the persistent, multi-year interconnection between pig butchering scams concentrating on people within the U.S., Canada, Europe, and elsewhere, and Chinese language-language laundering providers primarily based in Southeast Asia.

The industrialization of cryptocurrency scams calls for a proactive, multidisciplinary method

The 2025 knowledge reveal the extent to which cryptocurrency-enabled scams have gotten extra subtle, organized, and environment friendly. More and more accessible AI instruments, phishing-as-a-service platforms, and the convergence of various rip-off methodologies have lowered boundaries to entry and enabled scamming at scale. Whereas high-profile enforcement successes in 2025 are encouraging, the felony networks orchestrating scams stay of persistent concern. These transnational teams have taken benefit of governance weaknesses in low-capacity jurisdictions, and have demonstrated flexibility and resilience, shifting to new areas inside and past Southeast Asia and adapting their working fashions as crucial.

There are not any silver bullets to tackling such entrenched, industrial-scale scamming exercise and to be efficient, a multi-pronged response is required, together with:

• A stronger emphasis on stopping sufferer hurt, together with better adoption of real-time fraud and mule detection programs equivalent to Chainalysis Alterya by monetary establishments and cryptocurrency companies, and enhanced detection instruments that may assist victims defend themselves;
• Enhanced cross-border regulation enforcement coordination to facilitate speedy fund tracing and freezing, to disrupt monetary flows and make it tougher to money out illicit proceeds; and
• Worldwide help for capability constructing and technical help, to strengthen establishments and enforcement in low-capacity jurisdictions.

As we transfer into 2026, we count on additional convergence of rip-off methodologies as scammers undertake a number of ways and applied sciences concurrently.

This web site accommodates hyperlinks to third-party websites that aren’t underneath the management of Chainalysis, Inc. or its associates (collectively “Chainalysis”). Entry to such info doesn’t suggest affiliation with, endorsement of, approval of, or advice by Chainalysis of the positioning or its operators, and Chainalysis is just not chargeable for the merchandise, providers, or different content material hosted therein. 

This materials is for informational functions solely, and isn’t supposed to supply authorized, tax, monetary, or funding recommendation. Recipients ought to seek the advice of their very own advisors earlier than making most of these choices. Chainalysis has no accountability or legal responsibility for any determination made or another acts or omissions in reference to Recipient’s use of this materials.

Chainalysis doesn’t assure or warrant the accuracy, completeness, timeliness, suitability or validity of the knowledge on this report and won’t be chargeable for any declare attributable to errors, omissions, or different inaccuracies of any a part of such materials.