Register
Sign in
Menu
.jpg)
.jpg)
Digital asset investment scams are not only on-chain crimes. They are confidence schemes that begin with social engineering, move through conventional financial services and may end with digital assets transferred to scammer-controlled wallets.
FinCEN’s August 2026 Financial Trend Analysis reviewed 33,904 BSA reports filed between September 8, 2023, and December 31, 2025. The reports described approximately $12.7 billion in suspected digital asset investment scam-related financial activity. Around 1,300 financial institutions filed reports during the period.
That figure needs context. It is not a confirmed estimate of victims’ losses. FinCEN notes that reported amounts can include attempted or unpaid transactions, transfers between accounts, cumulative activity, duplicate reporting and both incoming and outgoing funds. A single report may also cover continuing activity or expand on earlier reporting. The number is best understood as a measure of suspicious activity reported to FinCEN, not a complete accounting of money lost.
The report’s value is in the patterns it brings together: who reported activity, where victims’ money came from, how funds entered digital assets and what happened as the proceeds moved onward.
The reported scams often begin with an unsolicited message, a “wrong number” text or contact through social media, dating or messaging platforms. A scammer builds trust through a false persona, then introduces an investment opportunity. Fake websites, mobile apps or fabricated account balances make the investment appear legitimate.
The victim may then be directed to transfer money through one of two broad routes:
That distinction matters. In the first path, the victim may retain control of funds at the exchange until they initiate an outbound transfer. The exchange may see the purchase and withdrawal, while the bank sees the payment used to fund the purchase. In the second path, the bank may see the wire or ACH transfer, but not a digital asset purchased by the victim at all.
The financial behavior can change as the scam progresses. Some victims reportedly moved money from checking or savings accounts to retirement funds, sold investments, took out personal loans or borrowed against their homes. Some also sought money from friends and family. A payment that appears unusual may therefore be one step in a longer sequence of manipulation.
FinCEN’s reporting breakdown shows how different institutions encounter different parts of a scam.
Money services businesses, predominantly those in the digital asset sector, filed 18,568 reports or about 55% of the total. They reported more than $5.5 billion in suspected scam-related activity. Depository institutions filed 13,810 reports, about 41% of the total and reported approximately $6.4 billion. Securities and futures firms filed 1,504 reports involving more than $784 million.
The pattern is significant: money services businesses filed more reports, while banks reported the largest dollar amount. MSBs often described victims sending digital assets to scammer-associated addresses. Banks often identified transfers to digital asset services, wires to scam-linked beneficiaries, large withdrawals or customers borrowing and liquidating assets to continue investing.
No single institution necessarily sees the full path. A bank may see the funding source but not the wallet activity. An exchange may see the purchase and withdrawal but not the victim’s loan or relationship with the scammer. An investigator may have multiple victim reports or a related wallet but not the financial institution’s customer context.
This is why a wallet match should be treated as a lead to evaluate, not proof of who controls the wallet or why a transaction occurred. The connection becomes more useful when an analyst can assess it alongside transaction details, customer history, victim reporting and verified investigative context.
The report identifies at least 22 digital assets used to receive or transfer suspected scam proceeds. Ethereum, Tether (USDT) and USD Coin (USDC) appeared frequently in BSA filings. FinCEN’s analysis also found that, regardless of the asset used at the beginning of the investment, proceeds were often converted into stablecoins, almost exclusively USDT.
FinCEN also observed that scammers reused wallet addresses to collect funds from multiple victims. Those shared addresses can help connect separate victim reports and identify possible consolidation points. The report says proceeds could then move to DeFi protocols or foreign-based digital asset exchanges.
For investigators, address reuse can be a useful pivot. It can link activity reported by different institutions or victims and help prioritize further tracing. However, it does not establish that every sender is part of the same organization or that a particular person controls the address. Analysts still need corroboration and context.
Not necessarily. FinCEN reports average month-over-month increases of 10.9% in the number of reports and 18% in the reported financial activity amount during the review period. It also notes that the trends were uneven. In December 2025, for example, FinCEN received 2,482 reports involving more than $833.5 million in reported activity.
FinCEN cautions that growth in reporting may partly reflect more institutions using the key term associated with its September 2023 alert. The filing date, rather than the date of the underlying activity, determined which reports were included. The figures therefore do not establish that the number of scams increased at the same rate.
For compliance and investigative teams, the practical point is to distinguish reporting trends from crime prevalence and confirmed losses. That distinction makes analysis more defensible and helps keep public claims grounded in what the data actually shows.
First, review the full payment path. A victim’s bank transfer, exchange purchase and wallet withdrawal may appear in different systems but each can add context to the same case.
Second, look for patterns across reports. Repeated transfers to the same wallet, similar funding behavior or a series of escalating withdrawals may connect activity that would otherwise appear isolated.
Third, engage early when a victim may still be sending funds. FinCEN reports that institutions often learned about a scam after substantial money had moved. In a smaller number of reports, institutions dissuaded a victim or recalled funds with the help of a cooperative third-party institution before the proceeds moved further. The report also describes FinCEN’s Rapid Response Program, which helps coordinate with U.S. law enforcement and foreign financial intelligence units to interdict and recover funds.
Finally, keep the decision with the institution or investigator. A suspicious payment, a shared wallet or a law enforcement signal can help focus a review. None should automatically determine whether to block a payment, restrict an account or treat a person as a suspect.
Deconfliction helps authorized participants identify when a wallet or related identifier may already be relevant to a law enforcement matter. That can give a financial institution a way to evaluate whether verified investigative intelligence exists alongside its own monitoring, fraud controls and blockchain analytics.
Deconfliction does not trace transactions or replace blockchain analytics. A match indicates potential investigative overlap, not criminality. It does not automatically disclose a case file, customer information or investigative narrative. Participants retain responsibility for their decisions and legal obligations.
Deconflict’s Signal surfaces relevant law enforcement intelligence within existing review workflows. When further coordination is appropriate, Nexus supports secure communication between verified participants. The purpose is to add context for human review, not replace an institution’s judgment or existing controls.
FinCEN’s report makes one point clear: digital asset investment scams move across people, payment methods, institutions, and wallets. Connecting those pieces can help investigators and financial institutions see more of the case before the next transfer occurs.
Read the full FinCEN analysis. Learn more about crypto deconfliction.
They are confidence schemes in which scammers build trust through a false identity or relationship, then persuade a victim to transfer money to a fraudulent investment opportunity involving digital assets.
FinCEN analyzed 33,904 BSA reports involving approximately $12.7 billion in suspected scam-related financial activity filed between September 2023 and December 2025. This amount is not a confirmed estimate of victim losses.
No. Some victims buy digital assets through an exchange and send them to a scammer-controlled wallet. Others send fiat by wire or ACH to a scam-linked account without ever taking control of digital assets.
FinCEN’s analysis frequently identified Ethereum, USDT, and USDC. It also found that proceeds were often converted to stablecoins, almost exclusively USDT.
No. A wallet match can help connect reports or identify a lead for review but it does not establish who controls the wallet or whether a person committed a crime. Investigators and institutions need to assess the match with corroborating evidence and context.