Loading story…
The FBI said Americans lost more than $388 million to scams involving cryptocurrency kiosks in 2025, based on more than 13,400 complaints filed with the Internet Crime Complaint Center. The bureau said fraudsters commonly instruct victims to withdraw cash, visit a crypto ATM, and transfer funds to attacker-controlled wallets, with complaints rising 23% and losses increasing 58% from the prior year. People over 50 accounted for more than half of the complaints and reported over $302 million in losses, while Texas, Florida, and California together logged more than 3,300 complaints and about $112 million in estimated losses.
The warning comes as regulators and lawmakers intensify scrutiny of the crypto kiosk industry. Minnesota, Indiana, and Tennessee have moved to ban cryptocurrency kiosks statewide, and operators including Bitcoin Depot, CoinFlip, and Athena are facing growing legal and regulatory pressure; Bitcoin Depot has also filed for Chapter 11 bankruptcy, citing state bans and tighter rules. Federal officials said the kiosks are being used in scams including fake investments, tech support fraud, and romance scams, and urged the public to verify payment requests through official channels and avoid sending funds to online-only contacts or unknown parties.
Track how attackers are adapting to this technology.
5 events from the most recent confirmed update back to the earliest known activity.
Cybersecurity News summarized Cleafy's findings on DevilNFC, describing it as a newly identified Android malware family that uses fake banking security updates, Android Kiosk Mode, and NFC relay techniques to steal card data and PINs. The report said the malware targets banking customers in Europe and Latin America and appears more advanced than NFCMultiPay.
The FBI publicly warned that criminals are increasingly directing victims to cryptocurrency kiosks to transfer funds to attacker-controlled wallets, citing 2025 losses of more than $388 million. The bureau highlighted heavy impacts on older adults and high complaint volumes in states including Texas, Florida, and California.
Minnesota, Indiana, and Tennessee moved to ban cryptocurrency kiosks statewide as scrutiny of the industry increased over scam-related losses. Coverage also noted broader legal and regulatory pressure on operators including lawsuits and pending legislation.
Cleafy disclosed technical details on two Android NFC relay malware families, DevilNFC and NFCMultiPay, describing phishing-based delivery, PIN harvesting, and relay fraud targeting banking customers in Europe and Latin America. The report highlighted DevilNFC's kiosk-mode locking, dual-role APK design, Telegram and C2 exfiltration, and NFCMultiPay infrastructure and protocol variants.
The FBI said the Internet Crime Complaint Center received more than 13,400 complaints tied to cryptocurrency kiosk scams during 2025, with reported losses exceeding $388 million. Complaints rose 23% and losses rose 58% compared with 2024, with adults over 50 accounting for more than $302 million in losses.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
6 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcescworld.com
Open sourcehelpnetsecurity.com
Open sourcetherecord.media
Open sourcebleepingcomputer.com
Open sourcecleafy.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Minnesota has enacted a statewide ban on cryptocurrency ATMs after residents reported nearly **$1 million** in scam losses tied to the machines since 2023. State officials said fraudsters, often posing as law enforcement or other authorities, pressured victims into depositing cash at crypto kiosks and sending irreversible cryptocurrency payments, with older adults disproportionately affected. Authorities cited **70 reported cases** and more than **$540,000** lost in the last year alone. Governor **Tim Walz** signed the ban on May 4, and it took effect Saturday, requiring all existing crypto ATMs in the state to be removed by **December 31**. The move reflects growing concern over kiosk-enabled fraud, as officials said the machines were repeatedly used to facilitate scams that are difficult to reverse once funds are transferred.
Aug 1, 2026
The FBI’s Internet Crime Complaint Center reported more than **1,008,597** cybercrime complaints in 2025, with cyber-enabled fraud driving **$17.6 billion** in losses and accounting for **85%** of all reported losses. **Investment fraud** caused the most damage at **$8.6 billion**, followed by **business email compromise** at more than **$3 billion** and **tech support fraud** at **$2.1 billion**. Older adults were hit especially hard, with people aged 60 and above filing **201,266** complaints tied to about **$7.7 billion** in losses, while California, Texas, and Florida recorded the highest complaint volumes. Cryptocurrency-related crime was a major driver of the surge, with Americans reporting **$11.4 billion** in crypto scam losses across **181,565** complaints, up **22%** from the prior year. The FBI said many cryptocurrency investment scams are sophisticated, long-running schemes linked to organized criminal enterprises in Southeast Asia that use trafficked people as forced labor. The bureau also warned that ransomware remained a persistent threat, investigating more than **200** ransomware variants, actors, and enablers after identifying **63** new variants; ransomware complaints rose to **3,611** with more than **$32 million** in losses, and attacks affected **14 of 16** U.S. critical infrastructure sectors.
Jun 29, 2026
The FBI warned that criminals behind cryptocurrency investment scams are increasingly sending in-person couriers to collect cash from victims when banks or financial institutions block suspicious transfers. In these schemes, fraudsters typically contact targets through social media, dating platforms, or messaging apps, build trust through so-called **pig butchering** or **romance baiting**, and then direct them to fake investment platforms where money is stolen instead of invested. According to the FBI, scammers may claim a victim’s account has been flagged and arrange a cash handoff authenticated with a pre-arranged password or a specific U.S. dollar bill serial number. After the pickup, victims are shown fabricated gains in virtual wallets and pressured to send more money for bogus taxes or penalties. The bureau urged people to research crypto platforms, avoid sharing home addresses or meeting unknown individuals, watch for **love bombing** behavior, and report incidents with detailed evidence; the FBI’s 2025 Internet Crime Report said U.S. victims lost nearly **$21 billion** to cyber-enabled crime in 2025, including **$8.6 billion** tied to investment scams.
Jun 29, 2026