Crypto scammers stole a record $14bn in 2025

Losses from voice and identity impersonation schemes surged 1,400%.

Funds stolen via cryptocurrency scams reached a record $14 billion in 2025. With data still arriving, the tally could exceed $17 billion, Chainalysis analysts said. 

In our latest 2026 Crypto Crime Report chapter, we examine how crypto scams reached $17 billion in 2025, driven by sophisticated operations using AI, phishing-as-a-service tools, and professional money laundering networks. Our analysis reveals that impersonation scams grew 1400%… pic.twitter.com/ioiVFu4OJv

— Chainalysis (@chainalysis) January 13, 2026

The previous year’s haul stood at $9.9 billion, later revised up to $12 billion. 

Average victim losses jumped 253% — from $782 to $2,764. 

The main threat 

The dominant vector was social-engineering and AI-enabled attacks, notably voice and identity impersonation, where losses surged by 1,400%.

The average payment in this segment rose by more than 600%.

In these schemes, criminals pose as legitimate organisations or authority figures to manipulate victims. 

As an example, analysts cited the mass E‑ZPass phishing campaign run by the Chinese-language group Darcula (also known as Smishing Triad). The operation targeted Americans who use the electronic tolling system. 

Cybercriminals used a phishing-as-a-service model to blast out SMS messages spoofing toll-collection agencies (primarily E‑ZPass) in at least eight US states.

At the core of the attacks was software from vendor Lighthouse, which offers criminals ready-made phishing “builders” with hundreds of clone-site templates, domain-configuration tools and masking features.

According to a lawsuit by Google, in one wave alone the scammers sent up to 330,000 SMS messages per day. Over three years they took $1 billion, deceiving at least 1 million people across 121 countries. 

Lighthouse itself received more than 7,000 deposits and accumulated over $1.5 million in cryptocurrency.

Another incident involved the exchange Coinbase. In December 2025, Brooklyn prosecutors charged 23-year-old Ronald Spector with nearly $16 million in fraud by impersonating the platform’s customer support. 

Artificial intelligence 

AI-driven scam operations generated 4.5 times more revenue than traditional schemes, Chainalysis noted. On average, these “more advanced” scammers net $3.2 million from a single attack, compared with $719,000 without AI tools. 

AI-linked operations are considered the most efficient:  

• higher daily revenue — an average of $4,838 versus $518;
• more transactions — an average of 35.1 versus 3.89 transfers per day. 

Record seizures 

2025 was also a record year for law-enforcement activity. Authorities carried out two major operations: 

1. The UK’s Metropolitan Police concluded a cryptocurrency money-laundering case that led to the world’s largest crypto seizure — more than 61,000 BTC (about £5 billion). The funds were confiscated from Chinese national Zhimin Qian (Yadi Zhang), who organised in China a multi‑billion‑pound investment fraud that victimised over 128,000 people between 2014 and 2017. Qian was sentenced to 11 years and eight months for possessing and transferring criminal property; her accomplice, Seng Hok Ling, received nearly five years for aiding the laundering.
2. The US Department of Justice charged Chen Zhi, chairman of Prince Group, with running Cambodian forced‑labour compounds that underpinned large‑scale crypto fraud. In addition to criminal proceedings, US authorities seized more than $15 billion in illicit proceeds. 

Southeast Asia 

Chainalysis stressed that crypto fraud in East and Southeast Asia has become a resilient ecosystem that continually adapts to government pressure and keeps expanding globally.

According to experts, Asian scammers have also reached American retirees. Data from AARP and the FBI show that in 2024 alone Americans aged 60 lost almost $4.9 billion — more than any other age group. 

Authorities say $2.8 billion of those losses were tied to crypto schemes.

Crypto ATMs have become a key tool. Under the guise of an emergency — a ransom for a relative, payment of a fictitious fine or taxes — scammers coach victims to withdraw large sums of cash and convert them into digital assets at the nearest ATM.

As soon as the cash is deposited, the funds are sent instantly to addresses controlled by the criminals.

Chainalysis found that all the money involved in such schemes ultimately ends up in wallets linked to Chinese money‑laundering networks (CMLN) and services in Southeast Asia. 

CMLN activity is rising: in the first quarter of 2022 less than 1% of funds flowed through them; by 2025 the share had jumped to 10%. Analysts linked this shift to declining use of centralised exchanges, which are increasingly blocking suspicious transactions. 

In late December, Chainalysis experts estimated 2025 hack-related losses at $3.4 billion. More than $2 billion was attributed to North Korean hackers.