Crypto Scams in 2026: How They Work, What the Data Shows, and What to Do After You Have Been Hit

Scams are among the largest sources of losses in crypto. The FBI's 2025 report counts 181,565 crypto-related complaints and $11.4 billion in losses in the United States alone, and Chainalysis estimates that $17 billion was stolen in crypto scams worldwide in 2025. This guide explains, from those primary sources and a peer-reviewed study, how the main scam types work, which warning signs recur, how to reduce the risk, and what to do in the first hours if money has already left. It deliberately does not recommend any "fund recovery" service, because recovery scams are themselves a category in the FBI data.

The numbers, and what each one measures

Two cautions about reading these. First, the FBI numbers come from people who filed a complaint, so they undercount, and they describe only the United States. Second, Chainalysis counts what it can link on-chain to scam activity and revises its estimate upward as it labels more addresses. For example, it first reported $9.9 billion for 2024 and now puts that year at about $12 billion. Neither is a precise count of victims. They agree on the direction: scam losses rose in 2025.

The age pattern in the FBI data is stark. Of the $11.4 billion, people aged 60 and over reported $4.43 billion, more than any other group. In crypto investment fraud, the 60-plus group reported $2.76 billion on 13,685 complaints, and in crypto ATM scams the 60-plus group accounted for $257 million of $389 million.

How the main scams work

1. Investment scams, "pig butchering" and fake platforms

The FBI describes these as sophisticated long-term scams that rely on psychological manipulation and the appearance of legitimacy, "largely perpetrated by organized criminal enterprises based in Southeast Asia using victims of human trafficking as forced labor to run the scam operations". The pattern it reports, step by step:

1. Contact starts through text messages, social media, advertisements or dating apps, then quickly moves to a messaging platform.
2. The victim is introduced to an investment group presented as industry insiders offering guidance on trading cryptocurrency or gold.
3. The victim is encouraged to send crypto to a fake investment platform or app that shows fake profits, and may be offered loans to invest more.
4. When the victim tries to withdraw, they are charged "taxes and fees" as a last attempt to extract money, and then the scammers disappear.

Chainalysis adds that scams that were once distinct are converging: many investment scams now include impersonation, social engineering and wallet-focused tricks. It also notes that, in 2025, the average scam payment it tracked rose from $782 to $2,764, up 253%. Its on-chain analysis ties pig-butchering activity to networks in East and Southeast Asia, and it observed a drop in activity during the seven-day Chinese New Year public holiday since about 2022, which it reads as evidence that operators in that region play a central role. A major case it cites is the US Department of Justice's charges against the chairman of the Prince Group over alleged forced-labor scam compounds in Cambodia, alongside actions to seize more than $15 billion in proceeds. Those are allegations in a case that, as Chainalysis itself notes, has run into jurisdictional complications.

2. Impersonation: banks, authorities and exchange "support"

Chainalysis reports that impersonation scams grew more than 1,400% in 2025, with the average payment to these scams up more than 600%. Two examples it describes show the range. A phishing campaign impersonating road-toll operators was described, in a lawsuit filed by Google in November 2025, as the work of a China-based network using phishing-as-a-service software, and, according to that lawsuit, as having reached more than a million people in at least 121 countries. Separately, a man was charged in Brooklyn with posing as a crypto exchange's customer service to persuade users to move their assets to "secure" wallets controlled by the fraudsters, in a case the Brooklyn District Attorney put at nearly $16 million. Both are described by the sources as allegations or charges.

The common mechanism is urgency plus authority: a message says your account is compromised, a toll is overdue or a transaction is suspicious, and offers a "safe" action that moves money to the attacker. A genuine exchange or bank does not ask you to transfer funds to a new "secure wallet", and does not ask for your seed phrase.

3. Address poisoning

Address poisoning exploits something ordinary: wallet addresses on chains like Ethereum are 40-character hexadecimal strings that nobody memorizes, so people copy an address from their transaction history. A Carnegie Mellon University study presented at the USENIX Security Symposium in 2025 describes how the attacker first generates lookalike addresses similar to one the victim has used, then interacts with the victim to "poison" their history, hoping the victim sends tokens to the lookalike by mistake. Over two years on Ethereum and BNB Smart Chain, the researchers identified 270 million on-chain attack attempts targeting 17 million victims, with 6,633 incidents causing at least $83.8 million in losses. That is the researchers' measurement of confirmed incidents, and the actual total may be higher or lower.

The defense follows from the mechanism: never rely on the first and last characters of an address, and do not copy an address from your history without checking all of it.

4. Crypto ATM scams

In the FBI data, crypto ATM and kiosk complaints rose 23% and losses 58% in 2025, reaching $389 million, with people aged 60 and over reporting $257 million of that. Chainalysis notes that funds starting at US crypto ATMs frequently flow into wallets linked to Southeast Asia-based money laundering networks, and that victims are typically told to convert cash into crypto at a kiosk and then send it on. The FBI has published warnings on schemes that use crypto ATMs and QR codes to take payment. A request to feed cash into a crypto ATM, whatever the stated reason, is a red flag.

5. Recovery scams

After a loss, victims are often contacted again. The FBI reports 10,516 recovery-scam complaints with $1.4 billion in losses, a rise in complaints reporting impersonation of government officials and recovery firms, and a pattern of fictitious law firms targeting crypto scam victims. Its note on the figure matters: the losses "may also include losses experienced from previous scams which prompted the contact with the recovery company". The lesson is that someone who contacts you unprompted offering to get your money back, especially for an upfront fee, is more likely a second scammer than a rescuer.

6. Malware and phishing kits

Chainalysis points to stealer malware and remote access trojans used by scammers to drain accounts without needing a long conversation with the victim: "one click" is enough. It also describes how cheap the tools are: one phishing kit vendor it discusses sold packages for as little as $20 to $50 in cryptocurrency, yet the campaigns reached large numbers of victims. Its data indicate that scams using phishing kits earn far more per scam than ordinary ones. We would add one point of our own: the cheaper the kit, the larger the volume of fake messages you will see, so treat every unexpected link, attachment or "support" message as untrusted by default.

7. AI-enabled scams

Chainalysis analyzed scams with on-chain links to vendors of AI tools such as face-swap software and deepfake technology. Those scams extracted $3.2 million per operation on average, against $719,000 for scams without such links, 4.5 times more. The firm also notes that it can only see AI tools bought on-chain, so this is an indication, not a count of all AI use. The practical consequence: a video call or voice message is no longer proof of identity.

Warning signs that recur across scam types

• Unsolicited contact that moves quickly to a private messaging app. This is the first step in the FBI's description of investment scams.
• A guaranteed or unusually steady return, or a "group of insiders" with profit screenshots.
• A platform or app you cannot find in an official store or regulator register, that shows profits you cannot withdraw.
• A demand for fees or taxes before withdrawal. The FBI names this as the last stage of the scam.
• Urgency and authority: a message claims to be your bank, exchange or a government body and presses for immediate action.
• A request to use a crypto ATM or to send crypto to a "safe" or "verification" wallet.
• A request for your seed phrase, private key or remote access to your device. No legitimate service needs these.
• An unsolicited offer to recover lost funds.

How to reduce your risk

This section is general guidance drawn from the mechanisms above, not a guarantee.

1. Check whether a firm is authorized. In the EU, crypto service providers must be authorized under MiCA, and ESMA publishes a register; see our MiCA compliance guide. In the UK, the FCA's ScamSmart pages help you check firms and read its warnings. An authorization does not make an investment safe, but its absence is a serious warning sign.
2. Do not click through from messages. Open the exchange or bank app or type the address yourself. A real fraud alert will be visible inside your account.
3. Never share a seed phrase or private key. Not with "support", not with an "advisor", not for "verification". Our guide to hardware wallets explains how to keep keys offline, and how to buy the device safely, a point the recent Ledger case showed matters: see our reconstruction.
4. Check every character of an address before you send, not only the start and end, and send a small test amount first for new recipients. Save trusted addresses in your wallet's address book rather than copying from history.
5. Use separate email and strong, unique passwords with two-factor authentication on exchange accounts, preferring app or hardware-key authentication over SMS where offered.
6. Slow down. Every scam in the FBI's description depends on you acting before you think. A day of delay costs nothing if the opportunity is real.
7. Talk to someone. The FBI's Operation Level Up notifies victims of crypto investment fraud that they are being scammed; in 2025 it notified 3,780 victims, and the FBI reports that 78% of them were unaware they were being scammed. A second pair of eyes helps.
8. Remember that large exchanges are not immune either. The recent Binance incident, covered in our investigation, is a reminder to keep only what you need on any platform, and to expect scammers to exploit such news with fake "recovery" or "verification" messages.

If you have been scammed: the first hours

Speed matters, but so does not making things worse.

1. Stop sending money. Requests for "taxes", "fees" or "unlock" payments are part of the scam, according to the FBI. Do not pay anything to get your funds released.
2. Preserve evidence. Save transaction hashes and the addresses you sent to, screenshots of chats and websites, usernames, phone numbers and the dates and amounts. Do not delete accounts or conversations.
3. Contact the platform you sent from immediately. If you paid from an exchange or a payment provider, report the fraud and give them the transaction details. Funds that are still on a platform can sometimes be frozen. Recent large incidents show that freezing can happen within hours when issuers and exchanges cooperate, for example stablecoin issuers froze billions after the Binance theft, but those cases involved law enforcement and extremely large sums. For an individual victim, the prospects are usually much lower, and early action is what gives any chance.
4. Change passwords and secure devices if you shared any credentials or installed software at the scammer's request. Move any remaining funds to a new wallet with a new seed phrase generated on a clean device if you disclosed a recovery phrase.
5. Report to the authorities. In the United States, file a complaint at the FBI's Internet Crime Complaint Center. In other countries, report to your national police and to the financial supervisor or consumer authority of your country. In the UK, the FCA's ScamSmart pages explain how to report and check firms. Reporting rules and bodies differ by country, so check your own authority's official page.
6. Be alert for recovery scams. Anyone who contacts you offering to get your money back, especially for an upfront fee, or claiming to be a law firm or authority that you did not contact, should be treated as suspect. Verify any law firm independently through the official bar or regulator register of its country.
7. Seek support. Fraud causes real distress. The FBI's report notes that its victim specialists referred victims for suicide-prevention help in 2025. If you or someone you know is struggling, contact local emergency or crisis services.

A checklist before you deposit anywhere

These questions follow from the mechanisms above. If you cannot answer all of them, wait.

1. Who contacted whom? If a stranger or a new online contact introduced the platform, that is the opening move the FBI describes.
2. Is the firm on a regulator's register, and does the web address match the one in that register exactly? Look-alike domains are a standard tool of impersonation.
3. Can you withdraw a small amount first, without paying any fee, before depositing more? A platform that lets you withdraw small amounts and then blocks large ones is still a scam. The FBI says victims are shown fake profits to encourage larger investments.
4. Is anyone promising a return? A guaranteed or unusually regular return from a crypto investment is not credible.
5. Is the money going to an address owned by a regulated firm, or to a wallet the "advisor" gave you? The second should stop you.
6. Are you being rushed, or told to keep the investment secret from family? Both are pressure tactics.
7. Would you still do it if the person disappeared? If the answer depends on one individual's guidance, the risk sits with that individual.

If someone close to you is being scammed

The FBI's Operation Level Up found that 78% of the victims it notified in 2025 did not know they were being scammed. That is the main difficulty when a relative or friend is involved: they may defend the scammer. Some points that follow from what the FBI describes:

• Ask questions instead of accusing. "Can you withdraw a small amount today?" is easier to hear than "this is a scam".
• Point to the pattern, not the person. Fake profits, a demand for fees to release funds and pressure to invest more are the steps in the FBI's description. If your relative recognizes them, it helps.
• Ask them not to send anything else while you look into it together, and not to pay any "release fee".
• Help them preserve evidence and report, even if they are not yet convinced. Reporting can lead to contact from investigators.
• Expect shame. Scam victims often hide their losses, and the same people are then approached by recovery scammers.

What law enforcement is doing, and what it means for you

There is some good news in the data. The FBI's report describes the Scam Center Strike Force, a new US Attorney's Office for the District of Columbia task force combining the Justice Department, the FBI and the Secret Service to pursue scam compounds in Southeast Asia. Operation Level Up, which started in January 2024, has notified more than 8,000 victims and reports $500 million in savings to notified victims. In the UK, the Metropolitan Police secured convictions in a case that led to the recovery of over 61,000 bitcoin, which Chainalysis describes as the world's largest confirmed crypto seizure, from a fraud that victimized more than 128,000 people in China between 2014 and 2017. These cases show that on-chain tracing works and that seizures are possible. They do not mean an individual victim will get money back; recovery generally requires a long legal process.

What we could not verify

• EU-wide victim statistics comparable to the FBI's. We did not find a single primary EU source we could read for 2025 loss totals, so the headline data in this guide are US complaints and a global on-chain estimate.
• The exact current reporting channels and procedures in each country. Check your own national authority's official page.
• Whether the scam figures from Chainalysis will be revised again. The firm says its estimates typically grow as it labels more addresses.
• The loss figures for address poisoning after June 2024. The study we cite covers July 2022 to June 2024.

Frequently asked questions