Scams

Blockchain security firm CertiK reports that crypto ATM scams in the United States led to about $333.5 million in losses in 2025 as criminals exploited fast cash-to-crypto conversions with minimal verification. Older adults bore roughly 86% of these losses, while the FBI received over 12,000 related complaints from January to November 2025, a 33% increase from 2024. Organized criminal groups, including Asian syndicates, allegedly used social engineering, AI-enhanced scams, and large-scale laundering operations to move illicit funds.

Analysis covering the 90 days before and after the December 3 Ethereum Fusaka upgrade shows a sharp rise in address poisoning scams and dust transfers, especially in stablecoins. USDT transfers under $0.01 jumped 612% to 29.9 million, while USDC, ETH, and DAI dust activity also climbed, enabling large-scale attacks that have already caused tens of millions of dollars in losses. Researchers say lower fees now allow attackers to bombard high-value wallets with spoofed transactions, and recommend always checking full addresses instead of copying from history.

According to reports citing a forensic review of lobbyist Mauricio Novelli's phone, a draft agreement outlined a $5 million payment structure linked to Argentine President Javier Milei's promotion of the Libra token in February 2025. The note, dated Feb. 11, 2025, reportedly broke the sum into three tranches and referenced crypto entrepreneur Hayden Davis, while a second draft message from Feb. 16, 2025, appeared to script a crisis response after the Libra scandal erupted and the token later crashed after briefly hitting a $4 billion market cap.

An analysis by TRM Labs found that less than 1% of on-chain crypto activity in Australia between March 2025 and February 2026 involved illicit counterparties, even as local entities processed about $50 billion in transaction volume. Sanctions-related flows made up roughly 70% of identified illicit volume, while darknet markets, investment fraud, and illegal goods and services formed the next largest categories. Australia's framework requiring digital currency exchanges to register with the Australian Transaction Reports and Analysis Centre has coincided with a diversified crypto ecosystem and limited criminal exposure.

Blockchain security firm Nominis reports that crypto attack losses dropped from $385 million in January to $49.3 million in February, with a single Step Finance incident on Solana accounting for over 60% of the damage. The study indicates that attackers are increasingly targeting users through phishing, address poisoning and malicious approvals, rather than focusing solely on protocol code vulnerabilities.

A French couple in their late 50s in Le Chesnay-Rocquencourt was allegedly forced at knifepoint to transfer more than €900,000 (about $1 million) in Bitcoin to attackers posing as police officers. The suspects tied up the man, injured the woman, and fled in a white van, while authorities opened an investigation into suspected kidnapping, armed robbery by an organized group, and criminal conspiracy. Wrench attacks involving physical coercion to steal crypto have become more frequent in France as Bitcoin prices climb.

The United States Attorney's Office has filed a civil forfeiture action to seize about USDT 3.4 million in Tether tied to a crypto investment scam conducted on Ethereum. Authorities say the scheme targeted at least four victims in Massachusetts, Utah and South Carolina, with the funds later converted into USDT and confiscated in February and March 2025.

On 14 March 2026, the U.S. Treasury's OFAC imposed sanctions on six people and two companies accused of using remote IT jobs to channel roughly $800 million in 2024 to North Korea's weapons programs. The network allegedly relied on stolen identities, deepfake-enhanced job interviews, and crypto conversions, while global illicit crypto flows climbed to an estimated $154–$158 billion in 2025 with sanctions evasion, large-scale hacks, and industrialized fraud on the rise.

The US Department of Justice and Europol dismantled the SocksEscort residential proxy network, seizing 34 domains, taking 23 servers offline across 7 countries, and freezing $3.5 million in cryptocurrency. The operation, running since 2009, allegedly hijacked 369,000 devices in 163 countries and was used to support account takeovers, ransomware, and crypto fraud, exposing 124,000 registered users to potential enforcement action.

Losses tied to cryptocurrency ATM scams in the United States climbed to $333.5 million in 2025, according to blockchain security firm CertiK, with organized groups exploiting an "attribution gap" that separates cash deposits from on-chain records. Older Americans suffer the bulk of these losses as scammers use breach data, live phone coaching and AI tools, while regulators test responses ranging from state-level bans to stalled federal legislation.