Global cryptocurrency scam and fraud losses reached an estimated $17 billion in 2025, according to the Chainalysis 2026 Crypto Crime Report published in January 2026 and updated through May. The figure represents the highest annual total on record. The FBI's Internet Crime Complaint Center (IC3) ...
"Once you move into these deepfake-type scenarios where people look, for all intents and purposes, like someone you know or a person of authority you've dealt with before, the believability goes up. That means you're more likely to be scammed, and it also lets scammers scale those operations in a way that's really problematic." — Eric Jardine, Head of Research, Chainalysis
Global cryptocurrency scam and fraud losses reached an estimated $17 billion in 2025, according to the Chainalysis 2026 Crypto Crime Report published in January 2026 and updated through May. The figure represents the highest annual total on record. The FBI's Internet Crime Complaint Center (IC3) independently reported $11.4 billion in crypto-related fraud complaints from U.S. victims alone, a 22% increase from 2024, within a broader $20.8 billion cybercrime loss total.
The data describes a structural shift in criminal methodology. Impersonation scams grew 1,400% year-over-year. The average scam payment rose 253% from $782 to $2,764. Operations linked to artificial intelligence tools extracted $3.2 million per campaign on average — 4.5 times the $719,000 average for non-AI operations. Law enforcement responded with record seizures, including a $15 billion forfeiture linked to the Prince Group and a 61,000 bitcoin ($5 billion) recovery in the United Kingdom. The question facing the industry is whether enforcement can scale as fast as the criminal infrastructure it targets.
Chainalysis confirmed $14 billion in on-chain scam inflows for 2025, up from $9.9 billion in 2024. The $17 billion headline figure includes estimated unreported losses. The FBI's IC3 received 181,565 cryptocurrency-related complaints in 2025, a 21% year-over-year increase, with an average loss per case of $62,604. Nearly 18,600 victims lost more than $100,000 each.
The composition of scam activity has shifted. High-yield investment programs and pig-butchering schemes remain the largest categories by volume, but impersonation scams emerged as the fastest-growing threat vector. Government agency impersonation — fraudsters posing as the SEC, FTC, FBI, or DOJ — grew 1,400% year-over-year. Fake exchange customer support scams targeting users of Coinbase, Binance, and Kraken also proliferated. The E-ZPass phishing campaign alone generated approximately $1 billion over three years, affecting more than 1 million victims across 121 countries.
The demographic distribution is notable. FBI data shows victims aged 60 and older accounted for $4.35 billion in losses — 38% of the U.S. total. The IC3 report also recorded 93 victims who were referred for suicide intervention through the bureau's Operation Level Up, which ran from January 2024 through March 2026 and notified 8,935 victims, 77% of whom did not know they were being scammed at the time of contact. Operation Level Up estimates it saved $562 million in potential further losses.
The Chainalysis data quantifies what the industry had suspected: AI tools have measurably increased the profitability of scam operations. Campaigns with demonstrable on-chain links to AI service providers earned a median daily revenue of $4,838, compared to $518 for non-AI operations. AI-linked campaigns averaged 35.1 transactions per day versus 3.89 for conventional scams. Over 70% of AI-enabled scams ranked in the top 50th percentile of all scams by transfer volume.
The primary AI applications in scam operations include deepfake video and audio for identity verification, face-swap software for live video calls, large language models for scaled multilingual outreach, and synthetic identity documents for KYC bypass. According to Chainalysis, the "Darcula" phishing group sent 330,000 text messages in a single day using AI-assisted tools. Phishing kits incorporating AI were 688 times more effective in dollar terms than conventional scam operations.
Eric Jardine of Chainalysis noted that AI enables scammers to achieve "faster scale and better believability" simultaneously. The traditional tradeoff between breadth and depth of targeting is eroding. Short, high-volume SMS campaigns and long-duration relationship scams are converging into hybrid operations that maintain personalization at scale.
The report projects that "virtually all scams will incorporate AI into their operations to some degree" going forward.
The pig-butchering model — named for the practice of "fattening" victims with apparent investment gains before draining their funds — has evolved from individual operations into an industrialized system. United Nations estimates place the number of forced laborers in Southeast Asian scam compounds at over 100,000, primarily across Cambodia, Myanmar, and Laos. An estimated 250 or more compounds are currently operational in Cambodia alone.
The operational model follows a three-tier structure. In the grooming phase, AI-enhanced personas are deployed across dating apps, LinkedIn, and encrypted messaging. Deepfake audio and video are used for identity verification. In the fattening phase, victims are directed to fraudulent investment platforms showing fabricated real-time market data, with early withdrawal allowances designed to trigger sunk-cost psychology. In the slaughter phase, platforms close. Victims who attempt to recover funds face demands for "taxes," "security fees," or "KYC deposits" before final disappearance.
The Prince Group operation illustrates the scale. Chen Zhi, the group's founder and chairman, oversaw operations that at their peak generated over $30 million per day in fraud proceeds. In October 2025, authorities seized 127,271 bitcoin — approximately $15 billion — in connection with the case. Chen was extradited to Beijing. However, according to Chainalysis, Cambodian compounds linked to the operation continue to function.
A specialized variant targeting the crypto industry itself has emerged: fake Web3 job recruitment. The Lazarus Group, a North Korean state-sponsored hacking collective with cumulative thefts exceeding $3.4 billion since 2007, has pioneered this approach. The attack follows a four-stage pattern.
First, targets receive unsolicited messages on LinkedIn, Telegram, or X from accounts impersonating legitimate Web3 companies, offering remote roles at $16,000–$44,000 per month. Second, professional multi-round interviews build rapport over weeks or months. Third, candidates are asked to install "verification tools," clone repositories, or download meeting platforms. Fourth, malware executes, harvesting wallet keys, seed phrases, and credentials within seconds.
The malware families deployed include Redline, Realst, Atomic/AMOS, Stealc, Rhadamanthys RAT, and PylangGhost. Notable breaches attributed to this vector include the $620 million Ronin Bridge exploit (March 2022), the $37 million CoinsPaid theft (July 2023, after a six-month fake Crypto.com recruitment campaign), and the $286 million Drift Protocol infiltration (early 2026, involving six months of engagement including in-person meetings).
The Web3 industry's structural characteristics — remote-first culture, pseudonymous teams, high developer wallet balances, and normalized interaction with unfamiliar entities — make it a particularly fertile target environment.
The scam economy depends on sophisticated laundering infrastructure. Chinese-language money laundering networks (CMLNs) processed approximately $16.1 billion in 2025, roughly $44 million per day, across more than 1,799 active wallets. CMLNs' share of known pig-butchering fund laundering grew from less than 1% in Q1 2022 to over 10% in 2025, and they account for approximately 20% of all known illicit laundering activity.
The Huione Group, before its October 2025 takedown under Section 311 of the USA PATRIOT Act, processed over $98 billion in cryptocurrency inflows over 4.5 years. At minimum, $4 billion of that was confirmed illicit, including $37 million linked to North Korean cyber heists.
Criminals are increasingly bypassing centralized exchanges in favor of decentralized platforms, DeFi bridges, and on-chain protocols to evade detection. In January 2026, Tether settled a $225 million direct-to-issuer redemption on Ethereum linked to a pig-butchering scam seizure, demonstrating the complexity of fund recovery across decentralized infrastructure.
2026 has seen an acceleration of enforcement actions:
| Operation | Date | Scope | |-----------|------|-------| | Operation Level Up | Jan 2024–Mar 2026 | 8,935 victims notified, $562M saved | | Prince Group Forfeiture | Oct 2025 | 127,271 BTC (~$15B) seized | | UK Bitcoin Recovery | 2025 | 61,000 BTC (~$5B) recovered | | Operation Atlantic | Mar 2026 | 20,000+ wallets identified, $12M frozen | | Scam Center Strike Force | Apr 2026 | 503 domains seized, $701.96M restrained | | Dubai Police Operation | Apr 2026 | 275 arrests, FBI/China MPS cooperation |
The Scam Center Strike Force action was notable for including the first-of-its-kind seizure of a Telegram recruitment channel with over 6,000 followers. Evidence collection involved review of 8,000 phones and 1,500 computers from a single compound.
However, the seizure-to-loss ratio remains small. Total confirmed law enforcement recoveries in 2025–2026 amount to roughly $21–22 billion against estimated losses of $17 billion in 2025 alone. Many seizures relate to operations spanning multiple years, and the majority of victims — particularly those outside the United States — have limited recourse.
From an economic value perspective, the $17 billion in scam losses represents a direct extraction from the crypto ecosystem's capital base. For context, Chainalysis estimates total illicit cryptocurrency activity at $154 billion across all categories in its 2026 report. The entire blockchain sector generates approximately $13.7 billion in annual on-chain revenue, according to webthreepedia's economic value framework. Scam losses in a single year thus exceed the entire blockchain industry's legitimate fee revenue.
This creates a measurable drag on adoption. The FBI reported that crypto fraud now accounts for more than half of all U.S. cybercrime losses by dollar value, despite cryptocurrency transactions representing a fraction of overall financial activity. Insurance products, compliance costs, and user friction introduced to combat fraud represent additional economic overhead that is ultimately passed through to legitimate users.
The industrialization of scams also distorts on-chain metrics. Fabricated transaction volumes on fraudulent platforms, laundering flows through DeFi protocols, and synthetic identities inflating user counts all introduce noise into the data that analysts and investors rely on to evaluate protocol health.
The data describes a scam economy that has professionalized faster than the industry's defenses. AI has compressed the timeline from initial contact to fund extraction while increasing per-victim yields. The industrialization of pig butchering — with purpose-built compounds, forced labor, and dedicated laundering networks — has created supply-chain-like efficiency in criminal operations.
Law enforcement response has intensified, with unprecedented seizures in 2025–2026. But the structural incentives remain: scam operations are geographically distributed across jurisdictions with limited enforcement capacity, AI tools continue to reduce operational costs, and the pseudonymous nature of cryptocurrency creates friction in victim recovery.
The $17 billion annual loss figure is not static. Chainalysis notes that AI adoption among scam operations is still early-stage, and the convergence of phishing, impersonation, and relationship scams into hybrid operations suggests the attack surface is expanding. For an industry generating $13.7 billion in legitimate annual fee revenue, the scam economy now represents a parallel economic system of comparable or greater scale — one that extracts value from participants rather than creating it.