{"id":93095,"date":"2026-01-13T17:29:42","date_gmt":"2026-01-13T14:29:42","guid":{"rendered":"https:\/\/forklog.com\/en\/?p=93095"},"modified":"2026-01-13T17:31:34","modified_gmt":"2026-01-13T14:31:34","slug":"crypto-scammers-stole-a-record-14bn-in-2025","status":"publish","type":"post","link":"https:\/\/forklog.com\/en\/crypto-scammers-stole-a-record-14bn-in-2025\/","title":{"rendered":"Crypto scammers stole a record $14bn in 2025"},"content":{"rendered":"<p>Funds stolen via cryptocurrency scams reached a record $14 billion in 2025. With data still arriving, the tally could exceed $17 billion, Chainalysis analysts said.\u00a0<\/p>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"en\" dir=\"ltr\">In our latest 2026 Crypto Crime Report chapter, we examine how crypto scams reached $17 billion in 2025, driven by sophisticated operations using AI, phishing-as-a-service tools, and professional money laundering networks. Our analysis reveals that impersonation scams grew 1400%\u2026 <a href=\"https:\/\/t.co\/ioiVFu4OJv\">pic.twitter.com\/ioiVFu4OJv<\/a><\/p>\n<p>\u2014 Chainalysis (@chainalysis) <a href=\"https:\/\/twitter.com\/chainalysis\/status\/2011055151558054393?ref_src=twsrc%5Etfw\">January 13, 2026<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>The previous year\u2019s haul stood at $9.9 billion, later revised up to $12 billion.\u00a0<\/p>\n<p>Average victim losses jumped 253% \u2014 from $782 to $2,764.\u00a0<\/p>\n<h2 class=\"wp-block-heading\">The main threat\u00a0<\/h2>\n<p>The dominant vector was social-engineering and AI-enabled attacks, notably voice and identity impersonation, where losses surged by 1,400%.<\/p>\n<p>The average payment in this segment rose by more than 600%.<\/p>\n<p>In these schemes, criminals pose as legitimate organisations or authority figures to manipulate victims.\u00a0<\/p>\n<p>As an example, analysts cited the mass E\u2011ZPass phishing campaign run by the Chinese-language group Darcula (also known as Smishing Triad). The operation targeted Americans who use the electronic tolling system.\u00a0<\/p>\n<p>Cybercriminals used a phishing-as-a-service model to blast out SMS messages spoofing toll-collection agencies (primarily E\u2011ZPass) in at least eight US states.<\/p>\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"725\" src=\"https:\/\/forklog.com\/wp-content\/uploads\/img-ae0b42027e4ed5bb-3530146536975771-1024x725.png\" alt=\"image\" class=\"wp-image-273263\" srcset=\"https:\/\/forklog.com\/wp-content\/uploads\/img-ae0b42027e4ed5bb-3530146536975771-1024x725.png 1024w, https:\/\/forklog.com\/wp-content\/uploads\/img-ae0b42027e4ed5bb-3530146536975771-300x213.png 300w, https:\/\/forklog.com\/wp-content\/uploads\/img-ae0b42027e4ed5bb-3530146536975771-768x544.png 768w, https:\/\/forklog.com\/wp-content\/uploads\/img-ae0b42027e4ed5bb-3530146536975771-1536x1088.png 1536w, https:\/\/forklog.com\/wp-content\/uploads\/img-ae0b42027e4ed5bb-3530146536975771.png 1920w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\">Example of a fraudulent message. Source: Chainalysis.\u00a0<\/figcaption><\/figure>\n<p>At the core of the attacks was software from vendor Lighthouse, which offers criminals ready-made phishing \u201cbuilders\u201d with hundreds of clone-site templates, domain-configuration tools and masking features.<\/p>\n<p>According to a lawsuit by Google, in one wave alone the scammers sent up to 330,000 SMS messages per day. Over three years they took $1 billion, deceiving at least 1 million people across 121 countries.\u00a0<\/p>\n<p>Lighthouse itself received more than 7,000 deposits and accumulated over $1.5 million in cryptocurrency.<\/p>\n<p>Another incident involved the exchange Coinbase. In December 2025, Brooklyn prosecutors charged 23-year-old Ronald Spector with nearly $16 million in fraud by impersonating the platform\u2019s customer support.\u00a0<\/p>\n<h2 class=\"wp-block-heading\">Artificial intelligence\u00a0<\/h2>\n<p>AI-driven scam operations generated 4.5 times more revenue than traditional schemes, Chainalysis noted. On average, these \u201cmore advanced\u201d scammers net $3.2 million from a single attack, compared with $719,000 without AI tools.\u00a0<\/p>\n<p>AI-linked operations are considered the most efficient:\u00a0\u00a0<\/p>\n<ul class=\"wp-block-list\">\n<li>higher daily revenue \u2014 an average of $4,838 versus $518;<\/li>\n<li>more transactions \u2014 an average of 35.1 versus 3.89 transfers per day.\u00a0<\/li>\n<\/ul>\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"829\" src=\"https:\/\/forklog.com\/wp-content\/uploads\/img-091fda0e2052a779-3530164349286376-1024x829.png\" alt=\"image\" class=\"wp-image-273264\" srcset=\"https:\/\/forklog.com\/wp-content\/uploads\/img-091fda0e2052a779-3530164349286376-1024x829.png 1024w, https:\/\/forklog.com\/wp-content\/uploads\/img-091fda0e2052a779-3530164349286376-300x243.png 300w, https:\/\/forklog.com\/wp-content\/uploads\/img-091fda0e2052a779-3530164349286376-768x622.png 768w, https:\/\/forklog.com\/wp-content\/uploads\/img-091fda0e2052a779-3530164349286376-1536x1243.png 1536w, https:\/\/forklog.com\/wp-content\/uploads\/img-091fda0e2052a779-3530164349286376.png 1920w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\">Effectiveness of scams with and without AI. Source: Chainalysis.\u00a0\u00a0<\/figcaption><\/figure>\n<h2 class=\"wp-block-heading\">Record seizures\u00a0<\/h2>\n<p>2025 was also a record year for law-enforcement activity. Authorities carried out two major operations:\u00a0<\/p>\n<ol class=\"wp-block-list\">\n<li>The UK\u2019s Metropolitan Police concluded a cryptocurrency money-laundering case that led to the world\u2019s largest crypto seizure \u2014 more than 61,000 BTC (about \u00a35 billion). The funds were confiscated from Chinese national Zhimin Qian (Yadi Zhang), who <a href=\"https:\/\/forklog.com\/en\/news\/british-woman-convicted-of-laundering-6-billion-in-bitcoin\">organised<\/a> in China a multi\u2011billion\u2011pound investment fraud that victimised over 128,000 people between 2014 and 2017. Qian was sentenced to 11 years and eight months for possessing and transferring criminal property; her accomplice, Seng Hok Ling, received nearly five years for aiding the laundering.<\/li>\n<li>The US Department of Justice charged Chen Zhi, chairman of <a href=\"https:\/\/forklog.com\/en\/news\/china-accuses-us-of-seizing-over-127000-btc\">Prince Group<\/a>, with running Cambodian forced\u2011labour compounds that underpinned large\u2011scale crypto fraud. In addition to criminal proceedings, US authorities seized more than $15 billion in illicit proceeds.\u00a0<\/li>\n<\/ol>\n<h2 class=\"wp-block-heading\">Southeast Asia\u00a0<\/h2>\n<p>Chainalysis stressed that crypto fraud in East and Southeast Asia has become a resilient ecosystem that continually adapts to government pressure and keeps expanding globally.<\/p>\n<p>According to experts, Asian scammers have also reached American retirees. Data from <span data-descr=\"The largest US non-profit, nonpartisan organisation for people over 50\" class=\"old_tooltip\">AARP<\/span> and the <span data-descr=\"Federal Bureau of Investigation\" class=\"old_tooltip\">FBI<\/span> show that in 2024 alone Americans aged 60 lost almost $4.9 billion \u2014 more than any other age group.\u00a0<\/p>\n<p>Authorities say $2.8 billion of those losses were tied to crypto schemes.<\/p>\n<p>Crypto ATMs have become a key tool. Under the guise of an emergency \u2014 a ransom for a relative, payment of a fictitious fine or taxes \u2014 scammers coach victims to withdraw large sums of cash and convert them into digital assets at the nearest ATM.<\/p>\n<p>As soon as the cash is deposited, the funds are sent instantly to addresses controlled by the criminals.<\/p>\n<p>Chainalysis found that all the money involved in such schemes ultimately ends up in wallets linked to Chinese money\u2011laundering networks (CMLN) and services in Southeast Asia.\u00a0<\/p>\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"663\" src=\"https:\/\/forklog.com\/wp-content\/uploads\/img-88320d08e393ad21-3530180538810322-1024x663.png\" alt=\"image\" class=\"wp-image-273265\" srcset=\"https:\/\/forklog.com\/wp-content\/uploads\/img-88320d08e393ad21-3530180538810322-1024x663.png 1024w, https:\/\/forklog.com\/wp-content\/uploads\/img-88320d08e393ad21-3530180538810322-300x194.png 300w, https:\/\/forklog.com\/wp-content\/uploads\/img-88320d08e393ad21-3530180538810322-768x498.png 768w, https:\/\/forklog.com\/wp-content\/uploads\/img-88320d08e393ad21-3530180538810322-1536x995.png 1536w, https:\/\/forklog.com\/wp-content\/uploads\/img-88320d08e393ad21-3530180538810322.png 1920w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\">Source: Chainalysis.\u00a0<\/figcaption><\/figure>\n<p>CMLN activity is rising: in the first quarter of 2022 less than 1% of funds flowed through them; by 2025 the share had jumped to 10%. Analysts linked this shift to declining use of centralised exchanges, which are increasingly blocking suspicious transactions.\u00a0<\/p>\n<p>In late December, Chainalysis experts <a href=\"https:\/\/forklog.com\/en\/news\/losses-from-crypto-hacks-reached-3-4bn-in-2025\">estimated<\/a> 2025 hack-related losses at $3.4 billion. More than $2 billion was attributed to North Korean hackers.\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Funds stolen via crypto scams hit a record $14 billion in 2025, according to Chainalysis.<\/p>\n","protected":false},"author":1,"featured_media":93096,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"select":"1","news_style_id":"1","cryptorium_level":"","_short_excerpt_text":"Losses from voice and identity impersonation schemes surged 1,400%.","creation_source":"","_metatest_mainpost_news_update":false,"footnotes":""},"categories":[3],"tags":[871,274,1246],"class_list":["post-93095","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news-and-analysis","tag-asia","tag-chainalysis","tag-scammers"],"aioseo_notices":[],"amp_enabled":true,"views":"191","promo_type":"1","layout_type":"1","short_excerpt":"Losses from voice and identity impersonation schemes surged 1,400%.","is_update":"","_links":{"self":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/93095","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/comments?post=93095"}],"version-history":[{"count":1,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/93095\/revisions"}],"predecessor-version":[{"id":93097,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/93095\/revisions\/93097"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media\/93096"}],"wp:attachment":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media?parent=93095"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/categories?post=93095"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/tags?post=93095"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}