Scams

On March 23, 2026, the U.S. Department of the Treasury announced sanctions targeting a North Korea-linked network accused of using data-extortion tactics against businesses. The action covers six individuals and two companies tied to an alleged $800,000,000 fraud haul in 2024, including a Vietnam-based entity said to have converted illicit proceeds into crypto assets.

On March 19, 2026, FBI New York warned Tron users about a phishing scam using fake Tron (TRX) tokens that appear in wallets with embedded messages claiming the recipient is under investigation. The tokens push victims to external sites for “verification” to avoid an alleged asset freeze, but the FBI says it does not communicate this way or request personal data via blockchain messages.

Fabric Protocol's ROBO airdrop drew scrutiny after on-chain analysis suggested one entity coordinated more than 7,000 wallets to claim about 199 million ROBO tokens, or 40% of the distribution. The allocation was estimated at roughly $8m at launch, and the token debuted on 27 February. ROBO traded near $0.025 at press time and was up about 14% since launch, though its post-launch path has been volatile.

The U.S. Secret Service, the UK's National Crime Agency and Canadian law enforcement have launched Operation Atlantic to counter crypto scams such as approval phishing and pig butchering. The cross-border initiative works with exchanges and VASPs to analyze live blockchain data and contact at-risk wallet owners before funds are drained. Despite scammers receiving tens of billions of dollars in illicit crypto, recent analysis indicates that legal crypto activity is growing faster than criminal use.

In a statement on Monday, the U.S. Secret Service said it is leading Operation Atlantic with UK and Canadian agencies to target criminal groups behind crypto approval-phishing scams. The campaign focuses on identifying victims, recovering funds and educating the public, after such scams caused $83.85 million in losses across 106,106 victims in 2025, down sharply from $494 million in 2024.

A class action settlement will require Texas-based Mason Construction to compensate people whose personal data was compromised in a 2024 breach, with individual payouts ranging from $55 to $5,000. Eligible victims can claim reimbursement for fraud losses, replacement documents, credit services and time spent responding, with claims due by June 1 and a final court approval hearing scheduled for June 4.

Blockchain security firm CertiK reports that crypto ATM scams in the United States led to about $333.5 million in losses in 2025 as criminals exploited fast cash-to-crypto conversions with minimal verification. Older adults bore roughly 86% of these losses, while the FBI received over 12,000 related complaints from January to November 2025, a 33% increase from 2024. Organized criminal groups, including Asian syndicates, allegedly used social engineering, AI-enhanced scams, and large-scale laundering operations to move illicit funds.

Analysis covering the 90 days before and after the December 3 Ethereum Fusaka upgrade shows a sharp rise in address poisoning scams and dust transfers, especially in stablecoins. USDT transfers under $0.01 jumped 612% to 29.9 million, while USDC, ETH, and DAI dust activity also climbed, enabling large-scale attacks that have already caused tens of millions of dollars in losses. Researchers say lower fees now allow attackers to bombard high-value wallets with spoofed transactions, and recommend always checking full addresses instead of copying from history.

According to reports citing a forensic review of lobbyist Mauricio Novelli's phone, a draft agreement outlined a $5 million payment structure linked to Argentine President Javier Milei's promotion of the Libra token in February 2025. The note, dated Feb. 11, 2025, reportedly broke the sum into three tranches and referenced crypto entrepreneur Hayden Davis, while a second draft message from Feb. 16, 2025, appeared to script a crisis response after the Libra scandal erupted and the token later crashed after briefly hitting a $4 billion market cap.

An analysis by TRM Labs found that less than 1% of on-chain crypto activity in Australia between March 2025 and February 2026 involved illicit counterparties, even as local entities processed about $50 billion in transaction volume. Sanctions-related flows made up roughly 70% of identified illicit volume, while darknet markets, investment fraud, and illegal goods and services formed the next largest categories. Australia's framework requiring digital currency exchanges to register with the Australian Transaction Reports and Analysis Centre has coincided with a diversified crypto ecosystem and limited criminal exposure.