Loading story…
Law enforcement agencies in the U.S., U.K., and Canada launched Operation Atlantic to disrupt cryptocurrency fraud schemes based on approval phishing, in which victims are tricked into authorizing malicious wallet permissions through fake alerts, pop-ups, or spoofed service messages. Once a victim approves access, attackers can drain assets from the wallet, and recovery is difficult because blockchain transactions are generally irreversible. Authorities said the campaign responds to a broader rise in crypto-enabled fraud, with Chainalysis estimating at least $14 billion in on-chain scam revenue in 2025 and warning the total could rise as more illicit wallets are identified.
The operation builds on earlier anti-fraud efforts including Project Atlas, which identified more than 2,000 compromised wallets across 14 countries, disrupted roughly $70 million in potential fraud, and froze about $24 million in stolen cryptocurrency. The same threat pattern is reflected in phishing lures impersonating platforms such as OpenSea, where fake offer alerts, account verification notices, and token airdrop messages attempt to push users into connecting wallets to malicious sites. Those examples illustrate the social-engineering tactics now commonly used in approval-phishing campaigns, alongside increasingly sophisticated content and phishing-as-a-service infrastructure.
Track how attackers are adapting to this technology.
5 events from the most recent confirmed update back to the earliest known activity.
Authorities said Operation Atlantic identified more than 20,000 cryptocurrency fraud victims across Canada, the United Kingdom, and the United States. Investigators also froze over $12 million in suspected criminal proceeds and linked more than $45 million in stolen cryptocurrency to approval-phishing schemes worldwide.
As part of Operation Atlantic, officials including the U.S. Secret Service and the U.K. National Crime Agency urged crypto users to verify sources, enable multi-factor authentication, monitor account activity, avoid unsolicited investment offers, and use tools such as Etherscan and Revoke.cash. The guidance emphasized that approval-phishing scams are growing more sophisticated and that early action can help users secure their assets.
Law enforcement agencies in the United States, United Kingdom, and Canada launched Operation Atlantic to disrupt crypto approval-phishing scams that trick users into granting malicious wallet permissions. Authorities said the initiative would help identify victims, secure compromised wallets, trace stolen assets, and improve public awareness in coordination with private-sector partners.
Prior anti-fraud effort Project Atlas identified more than 2,000 compromised wallets across 14 countries and disrupted about $70 million in potential fraud tied to crypto scams. This earlier operation is cited as a precursor to later international enforcement activity against approval-phishing schemes.
A warning was published about phishing emails impersonating OpenSea, using lures such as fake NFT offers, transaction errors, account verification requests, and token airdrop claims to trick users into connecting wallets to malicious sites. The guidance said legitimate OpenSea emails come from official domains and do not ask users to download software, open attachments, or sign wallet transactions through email links.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
6 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcehelpnetsecurity.com
Open sourcebleepingcomputer.com
Open sourcescworld.com
Open sourcecoindesk.com
Open sourceonlinethreatalerts.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Chainalysis reported that **cryptocurrency scams and fraud generated an estimated $17B in victim losses in 2025**, making it the largest year on record in its tracking, with at least **$14B observed on-chain** and expectations that totals will rise as additional illicit addresses are identified. The report attributes the increase to the continued industrialization of scam operations and infrastructure, including *phishing-as-a-service*, AI-generated deepfakes, and professional money-laundering networks, alongside major scam categories such as **pig butchering/romance scams** and HYIP-style schemes. Chainalysis also assessed that scam efficiency increased materially, citing a **253% YoY rise in average scam payment** (from **$782 in 2024** to **$2,764 in 2025**) and noting that **AI-enabled scams** can be significantly more profitable than traditional approaches. A key driver highlighted was the rapid growth of **impersonation scams**, which Chainalysis said rose roughly **1,400% YoY**, with average payments to those clusters up more than **600%**. One example cited was an **E‑ZPass-themed smishing campaign** that used fake toll-payment texts and lookalike sites to deceive victims; Chainalysis linked this activity to the Chinese-speaking group **“Darcula” / “Smishing Triad,”** and referenced reporting and legal action describing tooling and templates used to scale these lures. Separately, reporting on **AI deepfake impersonation** shows similar social-engineering dynamics outside of “crypto-only” contexts, including deepfakes impersonating religious figures to solicit donations and promote fraudulent crypto-related offers, reinforcing the report’s broader finding that **AI-assisted impersonation** is increasing the reach and credibility of scams.
Jun 29, 2026
INTERPOL and industry reporting warn that transnational fraud networks are becoming more sophisticated and more profitable by combining **AI-enabled deception**, crypto abuse, and organized scam-center operations. INTERPOL’s 2026 Global Financial Fraud Threat Assessment says AI-enhanced fraud is **4.5 times** more profitable than traditional methods and links financial fraud to broader criminal ecosystems including cybercrime, human trafficking, and terrorist financing. Researchers and investigators described tools such as **ProKYC** that can forge identity documents, generate deepfaked liveness checks, create selfie-with-ID images, and tailor verification artifacts to defeat KYC controls, while a cybercrime forum vendor separately advertised fraudulently verified accounts on exchanges including `Bitget`, `Bitvavo`, and `Kraken` with European IBAN and SEPA capabilities, underscoring how criminals are abusing rather than breaching financial platforms. Authorities are responding with wider enforcement actions against the infrastructure behind these scams. In India, Goa police arrested seven suspects, questioned 24 others, raided more than 40 locations across 11 states, and identified **313 suspected mule accounts** in an investigation spanning investment scams, sextortion, parcel fraud, fake hotel bookings, and so-called digital arrest schemes. In Cambodia, officials said raids across at least five provinces led to more than **1,000 arrests** tied to cybercrime and online scam compounds, part of a broader regional crackdown on an industry the UN says generates billions of dollars annually and has been linked to trafficked workers and abuse. INTERPOL said fraud-related Notices and Diffusions have risen **54% since 2024**, with support in more than **1,500** transnational fraud cases involving **$1.1 billion** in losses, and it is launching **Operation Shadow Storm** to target scam-centre-linked fraud, cybercrime, and human trafficking.
Aug 12, 2026
Rapid7 uncovered an active cryptocurrency fraud operation, tracked as **Operation ASTERIX**, after finding an exposed attacker server containing phone-number datasets, account-validation tools, phishing panels, Asterisk-based dialing infrastructure, and counterfeit wallet applications impersonating **Trezor**, **Ledger**, and **Exodus**. The campaign validated more than 100,000 phone numbers against cryptocurrency services including **Crypto.com** and **Kraken**, enriched confirmed leads with personal details, and then used coordinated phishing emails and vishing calls to direct victims to fake wallet software or recovery-phrase entry pages. The malware and infrastructure were built to steal wallet seed phrases and other victim data, with artifacts showing Telegram bot exfiltration, deceptive domains, trojanized installers, and macOS persistence via LaunchAgents. Rapid7 said the fake Trezor malware used Electron, process replacement, hidden windows, and local logging, while a trojanized **Claude Code** installer secretly deployed a fake **Ledger Live** payload alongside the legitimate tool to reduce suspicion. Recovered logs also showed the operator relied heavily on AI coding assistants including **GitHub Copilot**, **Claude Code**, and **Kimi** to develop, obfuscate, and host components of the scam infrastructure.
Aug 18, 2026