The U.S. Treasury's Financial Crimes Enforcement Network on September 3 published Alert FIN-2026-Alert005 alongside a Financial Trend Analysis documenting $12.7 billion in suspected digital asset investment scam activity that transited the U.S. financial system between September 2023 and December...
"Digital asset investment scams pose one of the most significant fraud threats facing Americans today. The transnational criminal organizations behind these scams exploit both emerging technologies and human vulnerabilities, resulting in devastating financial losses for innocent American victims." — Gene Lange, Performing the Duties of Under Secretary for Terrorism and Financial Intelligence, U.S. Treasury
The U.S. Treasury's Financial Crimes Enforcement Network on September 3 published Alert FIN-2026-Alert005 alongside a Financial Trend Analysis documenting $12.7 billion in suspected digital asset investment scam activity that transited the U.S. financial system between September 2023 and December 2025. The analysis drew on 33,904 Bank Secrecy Act reports, which showed a 10.9% month-over-month increase in filings and an 18% month-over-month increase in reported dollar volume across the review period.
The FinCEN data fits a broader pattern of escalation. The FBI's 2025 Internet Crime Report logged $11.37 billion in cryptocurrency-related losses across 181,565 complaints — a 22% increase year-over-year. Investment scams alone accounted for $8.6 billion, with 72% involving cryptocurrency. The United Nations Office on Drugs and Crime estimated that scam-center operations across East and Southeast Asia, Australia, and New Zealand generated between $88.3 billion and $114.1 billion in losses during 2025 alone — a figure the agency noted exceeds the GDP of several countries in the region.
The alert carries direct compliance consequences. FinCEN has instructed all covered financial institutions — banks, money transmitters, casinos, and others — to implement 16 specified red flags and file suspicious activity reports using standardized keywords when scam-center activity is suspected.
FinCEN's Financial Trend Analysis reviewed 33,904 BSA reports filed between September 8, 2023, and December 31, 2025. The aggregate reported financial activity totaled approximately $12.7 billion. Two metrics stand out: the 10.9% month-over-month increase in the number of scam-related filings, and the 18% month-over-month increase in reported dollar volume. These growth rates indicate the problem was accelerating through the end of the review period, not plateauing.
The filings describe schemes commonly referred to as "pig butchering," "romance baiting," or "cryptocurrency confidence schemes." The operational model is consistent across cases: fraudsters use assumed identities to pose as romantic partners, friends, or business contacts. They build trust over weeks or months, then steer victims to fraudulent websites and mobile applications that mimic legitimate investment platforms. Fake portfolio displays show fabricated gains. When victims attempt withdrawals, the operators block access and demand additional fees.
Victims were identified across all 50 U.S. states and several territories. According to the FBI's 2025 data, individuals aged 60 and older reported roughly $4.43 billion in crypto-related losses — the highest of any age group.
The composition of filers is significant for understanding where these flows touch the traditional financial system. Money services businesses — a category that includes cryptocurrency exchanges — filed 55% of the BSA reports, flagging approximately $5.5 billion in suspected activity. Depository institutions (banks and credit unions) filed 41% of reports but flagged a larger dollar volume: approximately $6.4 billion.
The higher dollar volume from banks, despite fewer filings, suggests that fiat-to-crypto on-ramps and associated wire transfer activity represent the higher-value chokepoint. Banks are seeing the larger individual transactions — retirement account liquidations, international wires, precious metals purchases — that precede conversion to digital assets.
FinCEN's analysis describes a professionalized, industrialized fraud infrastructure centered in Southeast Asia. Transnational criminal organizations operate physical compound facilities primarily in Cambodia, Burma (Myanmar), and Laos, with expansion into South Asia, Pacific Islands, Africa, the Middle East, and South America.
The human cost is documented in the alert. The UNODC has reported that "hundreds of thousands" of individuals have been trafficked to these compounds. Workers face passport confiscation, coercion under threat of violence, beatings for failing to meet fraud quotas, and forced commercial sex work. The compounds operate as vertically integrated fraud factories, with specialized teams handling recruitment, social engineering, money movement, and counter-detection.
A key piece of infrastructure is the "guarantee marketplace" — Chinese-language, Telegram-based platforms that function as one-stop shops for cybercrime services. These marketplaces provide account creation services, phishing kits, pre-built scam websites, money laundering networks, and peer-to-peer cryptocurrency exchange services. They connect scam operators with professional money launderers who establish shell companies and financial accounts to move proceeds.
FinCEN's data identifies stablecoins as the primary on-chain instrument used in these operations. The alert specifically names USDT, USDC, and at least 22 other digital assets as being used by scammers, with proceeds typically consolidated into USDT stablecoins before being routed through offshore exchanges.
The laundering pattern, as described by FinCEN, follows a consistent sequence: victim funds enter the crypto ecosystem through U.S.-based centralized exchanges; proceeds are moved through a series of on-chain transactions designed to obscure their origin; DeFi protocols are used to bridge funds across blockchains; and the consolidated stablecoins exit through exchanges in jurisdictions with limited KYC enforcement.
The DOJ has pursued enforcement along this chain. In February 2026, federal authorities seized $61 million in USDT linked to a single pig-butchering network — one of the largest stablecoin seizures in U.S. history. In January 2026, the government transferred $225 million in previously seized USDT from a pig-butchering operation directly to Tether for redemption.
FinCEN's red flags specifically identify stablecoins from issuers that advertise non-cooperation with law enforcement or claim assets "cannot be seized or frozen" as suspicious indicators. The alert also references USDH, a stablecoin issued by Huione Group, as a specific example.
The FinCEN alert references the Cambodia-based Huione Group as a case study in the infrastructure supporting these operations. In October 2025, FinCEN issued a final rule under Section 311 of the USA PATRIOT Act severing Huione Group from the U.S. financial system. The agency assessed that Huione processed at least $4 billion in illicit funds between 2021 and 2025.
Huione operated as a conglomerate: Huione Pay PLC provided fiat payment processing; Huione Crypto handled digital asset transactions; and Haowang Guarantee operated the Telegram-based marketplace connecting scam operators with laundering services. The operation combined traditional banking rails with cryptocurrency infrastructure, creating a vertically integrated financial services platform for fraud.
FinCEN has since published a notice of proposed rulemaking to expand enforcement to newly formed corporate vehicles linked to Huione, indicating the agency is tracking successor entities and shell companies. The agency also identified connections between Huione and illicit financial activities linked to the Democratic People's Republic of Korea.
The alert organizes its 16 red flags into three categories:
Victim Payment Indicators: Customers claiming law enforcement or government agencies directed them to make digital asset payments; international wire transfers or precious metals purchases preceding crypto conversion; liquidation of retirement or investment accounts; references to unverifiable "law firms" or "asset recovery services"; claims of accounts at exchanges advertising "no KYC" services; and money services businesses claiming "FinCEN approval" they do not possess.
Guarantee Marketplace Activity: Transactions involving digital asset tokens associated with known guarantee marketplaces; activity with exchanges operating in Burma, Cambodia, or Laos with obscured physical locations; blockchain transactions linked directly or indirectly to marketplace-attributed addresses; and connections to underground banking networks lacking KYC/AML controls.
Laundering Technique Indicators: Stablecoin transactions from U.S. centralized exchanges showing on-chain layering patterns; digital asset addresses posted on messaging platforms near Chinese-language money-laundering terminology; use of DeFi protocols to move suspected proceeds across blockchains; and transactions involving stablecoins from issuers advertising resistance to law enforcement seizure.
Three datasets converge to establish the scale of the problem:
FBI IC3 2025 Report: Total U.S. cybercrime losses reached $21 billion across 1,008,597 complaints. Cryptocurrency-related losses totaled $11.37 billion — a 22% year-over-year increase across 181,565 complaints. Investment scams accounted for $8.6 billion, with 72% involving cryptocurrency. The FBI's Operation Level Up, which proactively notified over 8,000 potential victims, prevented an estimated $500 million in additional losses.
UNODC 2025 Assessment: Annual scam-center losses across East and Southeast Asia, Australia, and New Zealand reached an estimated $88.3 billion to $114.1 billion. The agency characterized the regional cyberfraud industry as having "outpaced other transnational crimes, given that it is easily scalable and able to reach millions of potential victims online." More than 250 scam factories continue to operate across Cambodia alone, staffed by an estimated 100,000-plus trafficked and forced laborers.
Financial Action Task Force: The FATF has designated cyber-enabled fraud as "now one of the most widespread and damaging profit-motivated forms of crime, generating large volumes of illicit proceeds through the exploitation of victims around the world."
The alert imposes specific SAR filing requirements. Financial institutions must include the keyword "FIN-2026-SCAMCENTERS" in SAR field 2 and the narrative. They must select "Fraud—Other" in SAR field 34(z) with the description "Scam Centers." Where applicable, fields 36 (Money Laundering) and 38 (Other Suspicious Activities) should also be selected. Institutions are instructed to include all available technical indicators: chat logs, phone numbers, social media usernames, email addresses, digital asset types, blockchain addresses, transaction hashes, application names, and URLs.
FinCEN encourages participation in Section 314(b) of the USA PATRIOT Act, which provides safe harbor protections for voluntary information sharing between financial institutions. The alert also references Executive Order 14390 on cybercrime prevention and the DOJ Scam Center Strike Force.
For cryptocurrency exchanges and other digital asset platforms, the implications are direct: the 10.9% monthly growth in BSA filings means regulatory expectations for detection and reporting are rising. Institutions that fail to implement the specified red flags face examination risk. FinCEN's Rapid Response Program, which has facilitated recovery of over $1 billion in fraud proceeds since 2015, requires real-time institutional cooperation.
The FinCEN alert quantifies what has been observable in enforcement actions throughout 2025 and 2026: crypto-denominated investment fraud has industrialized. The scam-center model — combining human trafficking, social engineering, and cryptocurrency laundering — generates losses measured in tens of billions of dollars annually at the global level.
The regulatory response is converging on two points. First, stablecoins are the laundering rail of choice, and the red flags in FIN-2026-Alert005 reflect that reality. Second, the detection burden is shifting to financial institutions through explicit filing requirements and examination expectations. The 10.9% monthly growth in filings suggests either that the problem is still expanding, that detection capabilities are improving, or both. In either case, the compliance cost for institutions handling digital asset flows is rising.
The economic value question for the crypto industry is whether the infrastructure that enables these flows — centralized exchanges, stablecoin issuers, DeFi protocols — can be sufficiently monitored without undermining the efficiency gains that justify their existence. The $12.7 billion figure represents value extracted from victims and laundered through systems that also serve legitimate users. The industry's ability to separate those two use cases will shape its regulatory trajectory.