Cryptocurrency Scams & Statistics in 2026

The biggest crypto thefts and scams of 2025 and 2026

The ranking goes by the amount lost at the time. It mixes hacks, where someone breaks into a system, and scams, where the victim is talked into sending the money, because the money is gone either way. The type column says which is which.

Binance: about $6.4 billion (October 2026)

Funds started leaving Binance hot wallets around 4:20 p.m. ET on October 29. TRM Labs counted about $6.36 billion moving across ten blockchains, most of it within roughly 20 minutes. Binance’s own estimate is about $6.3 billion, Elliptic’s $6.43 billion.

Binance’s own investigation, published on November 3, traces the attack back months. In September, an engineer was approached on a job-search platform with a fake interview and asked to run a test exercise that contained malware, which gave the attackers a way into Binance’s internal systems (Malay Mail). Elliptic’s analysis suggests the attacker made Binance’s own systems sign the transactions, using EIP-7702 delegation, instead of stealing private keys. If that’s right, the keys never left Binance. The attacker didn’t need them.

On October 31, the FBI attributed the theft to TraderTraitor, the same North Korean group it named for Bybit. Chainalysis found the stolen funds mixed on-chain with money from the Bitget theft a month earlier.

About $2.85 billion, mostly stablecoins, had been frozen or intercepted by November 4, according to Binance CEO Richard Teng, who says no user bears the loss. The figures are still moving, and we’ll update them.

Bybit: about $1.5 billion (February 2025)

Until October, Bybit held the record. The FBI put the loss at about $1.5 billion and named TraderTraitor within five days. Safe, the wallet software Bybit used, said the attack came from “a compromised Safe{Wallet} developer machine resulting in the proposal of a disguised malicious transaction.”

Both record hacks seem to have started with one person’s computer, not with a flaw in a blockchain.

No hack needed

Two of the ten largest losses involved no break-in at all. In April 2025, an elderly person in the US lost 3,520 BTC, then worth about $330 million, in a social engineering theft flagged by on-chain investigator ZachXBT.

In January 2026, someone posing as Trezor support talked a victim into revealing a hardware wallet seed phrase and took more than $282 million in Bitcoin and Litecoin. In both cases the money was swapped into Monero, which is very hard to trace.

Immutable, until it isn’t

Recovery has become more common, and some of it would have been unthinkable a few years ago. After the Cetus exploit in May 2025, Sui validators froze about $162 million of the stolen tokens. Arbitrum froze $71 million taken from Kelp DAO.

After the Tectonic exploit in August 2026, the Cronos chain was rolled back, reversing about $111.2 million. The Liquid Network attacker returned about 3,400 of 4,000 BTC within a day.

Good news for victims. It also shows that “code is law” holds until enough money is at stake.

Why every report gives a different total

The FBI, the FTC, Chainalysis, TRM Labs and CertiK all published figures for 2025, and none of them match. They aren’t contradicting each other so much as counting different things.

Three things explain most of the gap. Complaint data only counts victims who report, and many never do.

On-chain data only counts addresses an analytics firm has identified, so it grows as more are found: Chainalysis first put 2024 scam revenue at $9.9 billion, then $12 billion after a recalculation. And hack totals measure a different crime: crypto stolen from exchanges, protocols and wallets, not money victims were tricked into sending.

For a single figure on US victims, the FBI’s $11.37 billion is the one to use. For a global scam estimate, Chainalysis’s $17 billion projection is the most cited. The $14 billion is the part it has actually traced.

How much crypto fraud cost Americans in 2025

The FBI’s Internet Crime Complaint Center (IC3) received 181,565 complaints that involved cryptocurrency in 2025, up 21%, with $11.37 billion in reported losses, up 22%. That’s more than half of the $20.88 billion lost to all the online crime IC3 recorded. The average crypto complaint involved $62,604, and 18,589 people lost more than $100,000 each.

• Crypto investment fraud: 61,559 complaints and $7.23 billion in losses, the costliest type of fraud in the US for the year. Complaints rose 48%.
• Recovery scams: 10,516 complaints and $1.4 billion. These are victims scammed a second time by fake firms that promise to get stolen crypto back.
• Crypto ATMs and kiosks: 13,460 complaints and $389 million, up 58% on 2024.
• AI-related complaints (all fraud types, not only crypto): 22,364 complaints and $893.3 million.

Investment fraud is the line that keeps climbing. It has grown eightfold in four years.

The FTC sees the same pattern from a different angle. Consumers reported $15.9 billion in fraud losses in 2025, investment scams accounted for over $7.9 billion of it, and cryptocurrency was the payment method with the second-highest losses, after bank transfers.

Social media is a common starting point: people reported $2.1 billion lost to scams that began there, $1.1 billion of it in investment scams.

Some victims get a warning in time. Through Operation Level Up, the FBI contacted 3,780 victims of crypto investment fraud in 2025, and 78% of them didn’t know they were being scammed. The FBI estimates that saved them $225.9 million.

Crypto scam losses by state (our analysis)

The FBI publishes crypto losses per state. On their own, those totals mostly tell you which states are big: California lost $2.1 billion, Texas $1.02 billion, Florida $914.5 million. To compare states fairly, we divided each state’s 2025 losses by its population, using the Census Bureau’s Vintage 2025 estimates.

Across the 50 states and DC, crypto fraud cost $31.02 per resident. Oregon stands apart at $127.75, about four times that.

Its complaint rate is close to average (50.9 per 100,000 residents, against 45.2 nationally), but the average loss per complaint was $251,006, more than three times the average across all states (about $68,700). So Oregon doesn’t have unusually many victims. It has some very large losses, and a handful of big cases can move a state of 4.3 million people a long way.

Nevada has the highest complaint rate (76.7 per 100,000) and comes second per resident at $62.58. Hawaii, Washington, D.C., and California follow. The lowest losses per resident were in Louisiana ($11.62), Vermont ($11.68) and Rhode Island ($12.67).

Older Americans carry the heaviest losses

People aged 60 and over filed 42,271 crypto complaints with the FBI in 2025 and reported $4.35 billion in losses, up 53% from $2.84 billion in 2024. That’s 38% of all crypto losses, from a group that filed less than a quarter of the complaints.

(The report’s age chart for crypto shows a slightly higher $4.43 billion from 44,555 complaints; we use the figures from its elder fraud table, which also gives the 2024 comparison.)

At crypto ATMs, the gap is wider. People 60 and over lost $257.5 million there, two-thirds of all ATM losses.

In the FTC’s report on older adults, people describe being told to move money, mail cash or deposit cash into Bitcoin ATMs to keep it “safe.” The same report says older adults’ losses on scams paid in cryptocurrency have grown more than 27-fold since 2020.

The scams behind the numbers

Investment scams and “pig butchering”

Fake investment platforms are the biggest single category everywhere we looked. In the US, crypto investment scam losses went from $907 million in 2021 to $7.2 billion in 2025, according to FinCEN.

Many start with a friendly stranger online, a romance or a “wrong number” text that turns into investment advice over weeks. Hence the industry name, pig butchering: the victim is fattened up before the slaughter.

Much of it runs from scam compounds in Southeast Asia. The UN Office on Drugs and Crime estimates that scams cost people in East and Southeast Asia, Australia and New Zealand between $88.3 billion and $114.1 billion in 2025, and that people from at least 80 countries have been found in the compounds.

The UN human rights office puts the workforce at at least 300,000 people, many of them trafficked and forced to work. The US government estimates that Americans lost at least $10 billion to Southeast Asian scam operations in 2024.

Impersonation

Chainalysis counted more than 1,400% growth in impersonation scams in 2025, where criminals pose as a company or an official the victim trusts. The $282 million fake Trezor support case above is the extreme version.

Stolen customer data makes the script more convincing. In May 2025, Coinbase disclosed that criminals had paid support contractors outside the US for customer data, including names, addresses and balance snapshots, and it estimated $180 million to $400 million in costs, including voluntary reimbursements to customers.

AI makes scams pay better

Scams linked to AI vendors on-chain earned about $3.2 million per operation in 2025, against $719,000 for the rest, Chainalysis found. That’s 4.5 times the revenue.

TRM Labs saw AI-enabled scam activity rise by roughly 500% in a year, with deepfake audio and video used to imitate executives, partners and public figures. The average scam payment Chainalysis tracked more than tripled, from $782 in 2024 to $2,764 in 2025.

Recovery scams

Victims are a target list. Fake recovery services promise to get stolen crypto back for an upfront fee, and the FBI received 10,516 complaints about them in 2025, with $1.4 billion in losses. Legitimate law enforcement doesn’t charge you to investigate.

Crypto ATMs

Losses at crypto ATMs rose 58% to $389 million in the US in 2025. States are reacting: 35 states have passed laws on crypto kiosks since 2023, 18 of them in 2026, according to AARP. Indiana became the first state to ban them outright, in March 2026.

Wallet drainers are down, wallet theft is not

Phishing sites that trick people into signing away their tokens lost ground. Scam Sniffer counted $83.85 million stolen by wallet drainers on EVM chains in 2025, down 83% from 2024, from 106,106 victims.

Thefts from personal wallets overall are another matter: Chainalysis recorded 158,000 incidents and at least 80,000 victims in 2025, with $713 million stolen.

Memecoins and rug pulls

There’s no reliable total for rug pulls in 2025 or 2026, but the base rate is grim. Solidus Labs looked at more than 7 million tokens launched on Pump.fun between January 2024 and March 2025 and found that 98.6% ended up with less than $1,000 in liquidity, essentially worthless, typical of a pump and dump.

The best-known case is LIBRA, a token promoted by Argentina’s president, Javier Milei, in February 2025: Nansen found that 86% of the larger wallets that traded it lost money, $251 million in total.

Hacks and North Korea

Thefts from exchanges, protocols and wallets came to about $2.9 billion to $3.4 billion in 2025, depending on who’s counting (Chainalysis, CertiK, TRM Labs). North Korea took about $2 billion of it, a record at the time, with Bybit as the bulk.

2026 was busy before Binance. In the first half alone, CertiK counted 344 incidents and $1.32 billion in losses. With Binance, the year’s total stands at $8.7 billion, the highest on record, and North Korea accounts for $7.4 billion of it, 85%. TRM puts North Korea’s crypto thefts since 2017 at about $12.8 billion.

The method has shifted from code to people. In the first half of 2026, CertiK counted 204 code-vulnerability incidents, but they cost only $151.6 million together. Wallet compromises, where attackers get hold of keys or the devices that hold them, cost $444.5 million in just 33 incidents, and phishing $366.3 million.

The Drift Protocol exploit in April 2026 ($295 million) is the textbook case: Mandiant attributed it to a North Korea-linked actor after what Drift calls a “sophisticated operation.”

Hardware wallets are not a guarantee

The old advice, ours included, was to keep crypto in cold storage. It still beats an exchange account, but 2026 showed its limits.

From July 30, attackers drained about 1,816 BTC (around $116 million) from more than 5,200 addresses tied to Coldcard wallets: a 2021 firmware version had generated seeds with a weak random number generator, which made them guessable.

In October, Ledger confirmed that devices sold by the reseller CryptoBilis carried hidden LTE implants that sent out recovery phrases during setup. On-chain researchers estimate losses above $86 million, a figure Ledger hasn’t verified. MediaMarkt Saturn stopped selling Ledger devices on October 13.

Wrench attacks: when crypto theft turns violent

If the wallet can’t be hacked, the owner can be threatened. Chainalysis counted 95 violent theft attempts on crypto holders in 2025, of which 47 succeeded, taking a record $58 million. Through late June 2026 there were 46, against 40 at the same point in 2025, and more than $30 million was extracted.

France has seen the sharpest rise: 19 incidents in 2025 and 30 publicly known by mid-2026, mostly around Paris. The best-known case was the kidnapping of Ledger co-founder David Balland and his wife in January 2025; police freed them within days.

France, the US, Brazil and Thailand have the most incidents since 2023. These are reported cases only. Many victims never go to the police, for the obvious reason that saying how much crypto you own is how this starts.

Crypto scams outside the US

United Kingdom. Victims reported £879.8 million lost to investment fraud in 2025, about £2.4 million a day, with crypto among the main types, according to City of London Police. The average loss was £25,612. Banks’ own figures, which cover only bank transfers, show investment scams at a record £221.5 million, up 40%.

Australia. Scam losses across all reporting bodies reached A$2.18 billion in 2025, with investment scams the costliest type at A$837.7 million. In reports to Scamwatch, cryptocurrency was the payment method with the highest losses: A$121.3 million, 36.2% of the total.

Canada. Canadians reported over 112,000 frauds and more than C$704 million in losses in 2025. The Canadian Anti-Fraud Centre names fake investment platforms among the frauds with the most impact.

European Union. Europol’s 2026 internet crime threat assessment names investment fraud, “especially crypto,” as one of the most common types of online fraud reported by member states.

Asia. See the UN estimates above: between $88.3 billion and $114.1 billion in scam losses in East and Southeast Asia, Australia and New Zealand in 2025.

The crackdown: seizures, freezes and new laws

The money is easier to trace than it used to be, and governments have started to act on that.

• US Scam Center Strike Force: set up in November 2025 to go after the Southeast Asian compounds, it had restrained $1,006,460,156.82 in crypto as of October 29, 2026.
• Prince Group: in October 2025, the Justice Department filed to forfeit about 127,271 BTC, then worth about $15 billion, from a Cambodian conglomerate accused of running forced-labor scam compounds. It’s the largest forfeiture action in the department’s history. The same day, the Treasury sanctioned 146 targets in the group, and FinCEN cut Huione Group, which it accuses of laundering scam proceeds, off from the US financial system.
• Freezes: stablecoin issuers and blockchains now often freeze stolen funds, sometimes within minutes. About $2.85 billion of the Binance loot was frozen or intercepted within six days, and CertiK counted $115.3 million frozen or returned in the first half of 2026.
• Crypto ATM laws: 35 states since 2023, and Indiana’s ban (see above).

None of this has dented the totals yet. Seizures are measured in single billions; the losses are measured in tens of billions every year.

How to avoid the scams that cost the most

The advice follows the money. Each point below matches one of the bigger loss figures on this page.

• Never invest through a platform or app that someone you met online recommends. Fake investment platforms are the costliest category in the US, the UK and Australia ($7.23 billion in the US alone).
• No real bank, agency or company asks you to pay through a crypto ATM. If someone tells you to move cash to a Bitcoin ATM “to keep it safe,” it’s a scam, full stop.
• Never share your seed phrase. Not with support staff, not with a wallet maker, not with anyone. The $282 million Trezor case started with a “support” call.
• Buy hardware wallets directly from the manufacturer, and keep the firmware current. The CryptoBilis implants came through a reseller, and the Coldcard thefts hit seeds generated on old firmware.
• Don’t pay anyone to recover stolen crypto. Upfront-fee recovery services are the second scam, $1.4 billion worth in 2025.
• Keep quiet about what you hold. Wrench attacks start with knowing who has crypto.

If it has already happened, report it quickly: in the US to the FBI’s IC3 and the FTC, in the UK to Report Fraud, in Australia to Scamwatch, in Canada to the Canadian Anti-Fraud Centre. Fast reports are how stolen funds get frozen.

For the human side of these schemes, see our guides to social engineering and deepfakes.

Methodology, sources and how to cite this page

Sources. We used primary sources first: the FBI’s IC3 annual report, FTC and FinCEN publications, Justice Department and Treasury releases, the UN, national fraud agencies, and the blockchain analytics and security firms’ own reports (Chainalysis, TRM Labs, Elliptic, CertiK, Scam Sniffer, Solidus Labs). Single incidents are sourced to the company, the protocol or an official statement where one exists, otherwise to reputable crypto and security press. Every figure was checked on its source on November 4, 2026.

Amounts. US dollars at the time of the incident, as reported. Where sources disagree, we give the range or say which figure we use. Recent incidents, Binance above all, may still be revised.

State analysis. Crypto losses and complaint counts per state come from the FBI’s 2025 IC3 report (pages 57–58). Population is the Census Bureau’s Vintage 2025 estimate for July 1, 2025. IC3 assigns a complaint to the victim’s state; one very large case can move a small state’s ranking. The 50 states and DC add up to $10.6 billion of the $11.37 billion national total. The rest isn’t assigned to a state in the table; US territories account for about $27 million of it.

Previous editions: Cryptocurrency Scams & Statistics in 2023 · Cryptocurrency Scams in 2022