Scams

Blockchain analytics firm TRM Labs reported that illicit entities received roughly $141 billion in stablecoins in 2025, the highest level in five years, driven mainly by sanctions-linked networks and large-scale money laundering. Sanctions-related activity made up 86% of all illicit crypto flows, with around $72 billion tied to the Russian ruble-pegged A7A5 token, while overall illicit use represented about 1% of an estimated $12 trillion in annual stablecoin transactions.

According to Global Ledger, hackers accelerated laundering in the second half of 2025, often moving funds within seconds and using mixers, DeFi, and bridges. Tornado Cash appeared in 42% of exploits, and average laundering time rose to 10.6 days. DeFi flows hit $732M in H2, while bridges routed $2.01B.

Address poisoning is a scam that tampers with a user's transaction history instead of attacking private keys, convincing victims to send funds to a maliciously crafted lookalike address. Incidents including a roughly 3.5 wBTC theft from a Phantom Chat phishing campaign in February 2026 and a $50 million USDT loss in 2025 show how interface design and user habits can lead to large losses. By abusing dust transfers, copy buttons and truncated address displays, attackers exploit behavior and wallet UX to make poisoned addresses appear trustworthy.

In a Wednesday report drawing on roughly 2,500 internal investigations, AMLBot found that 65% of the 2025 crypto incidents it handled involved social engineering and user access or response lapses rather than protocol flaws. By case count, investment scams led at 25%, followed by phishing at 18% and device compromises at 13%.

On February 17, 2026, blockchain security firm Cyvers reported a $600,000 loss tied to an address poisoning scheme that leveraged zero‑value transfers and a copy‑paste mistake. Similar incidents since December 2025 include $514,000 and $12.25 million losses, while researchers estimate more than one million poisoning attempts occur each day on Ethereum.

On Feb. 13, cybersecurity expert Dmitry Smilyanets reported receiving a fake Trezor-branded letter demanding an "Authentication Check" by Feb. 15 or risk device restrictions, with a QR code leading to a phishing site. The scam, which mislabels Trezor CEO Matěj Žák as "Ledger CEO," targets hardware wallet users whose postal data was exposed in past breaches and attempts to trick them into entering seed recovery phrases. Similar physical letters and QR-based attacks have been reported against Ledger users since at least October last year, following multiple data leaks impacting both Ledger and Trezor customers.

According to the report, scammers are mailing hardware wallet users letters that mimic Trezor and Ledger notices, pushing recipients to scan QR codes and enter recovery phrases. The messages cite urgent security checks and route to clone setup pages that accept 12-, 20-, and 24-word seeds. Hardware wallets are not compromised, but revealing a seed enables immediate wallet takeover.

On February 16, South Korea's Financial Supervisory Service said it will expand its AI-driven VISTA platform by adding an Nvidia H100 GPU using a 170 million Korean won ($117,640 USD) budget, aiming to improve real-time detection of market manipulation. The agency targets completing the hardware addition by the second quarter and is advancing algorithms to spot suspicious accounts and abnormal trading patterns.

Indian police conducted a nationwide crackdown from February 7 to 13, arresting six suspects linked to alleged investment, loan app and part-time job fraud involving crypto-related schemes. Authorities say they traced illicit funds across multiple states, recovered about Rs. 16.9 lakh for victims through court orders, and warned residents to be cautious when engaging with unknown contacts online.

Vietnam's crypto sector has cooled as the market retreated from October's record, with industry figures citing closures, layoffs, and relocations. In January, authorities began taking applications for licensed exchanges with a 10 trillion VND ($400 million) capital threshold, while executives say weak sentiment and unclear rules are keeping users and new ventures on the sidelines.