cryptocurrency fraud
,

A controller approves an urgent wire. Three hours later, the money has hopped through five wallets and landed at an overseas exchange. Most executives assume that is the end of the story. It is not.

The scale explains why this matters now. The FBI’s Internet Crime Complaint Center (IC3) logged 181,565 cryptocurrency-related complaints in 2025, with roughly $11.4 billion in reported losses, a 22% jump from 2024. Chainalysis estimates illicit addresses received $154 billion in 2025, and TRM Labs puts the figure at $158 billion. Cryptocurrency fraud is growing fast, but so is the investigator’s toolkit. Here is how tracing works, where it breaks down, and what your organization should do.

Why Cryptocurrency Fraud Is Easier to Trace Than You Think

Crypto is pseudonymous, not anonymous. Every transfer lives on a public ledger that cannot be quietly edited, so every cryptocurrency fraud scheme leaves a permanent map. What the ledger lacks is a name. Identity usually surfaces where crypto touches the regulated world: exchanges, payment processors, and stablecoin issuers that keep customer records.

That changes the question from “Can we see the money?” to “Where does it leave the blockchain?” The same logic applies to insider schemes. The ACFE’s Occupational Fraud 2026 study of 2,402 cases found organizations lose an estimated 5% of revenue to fraud, with a median loss of $104,000 per case, and it now includes a section on cryptocurrency schemes. Pair those findings with the device and log work in our guide to following the digital trail.

The Five Steps of a Blockchain Trace

Strong cryptocurrency fraud investigations follow a disciplined workflow:

  1. Preserve the evidence. Capture transaction hashes, wallet addresses, timestamps, platform records, and related emails or chats before anything disappears. Our post on how digital forensics recovers deleted evidence shows why early capture matters.
  2. Map the flow. Analysts follow funds hop by hop and build a graph of every transfer.
  3. Cluster addresses. Software groups addresses likely controlled by the same party. Careful examiners never lean on a single heuristic, because proximity is not proof of control.
  4. Find the chokepoints. Funds eventually reach exchanges, bridges, fiat on-ramps, or stablecoin issuers. These are the places where freezes and records requests become possible.
  5. Turn findings into legal action. Counsel uses subpoenas, production orders, and seizure warrants to obtain account-holder records and restrain assets.

Where Cryptocurrency Fraud Traces Get Difficult

Criminals know the playbook, so they try to break the trail with peel chains, decentralized exchange swaps, and cross-chain bridges. Funds in self-hosted wallets cannot be frozen on-chain, so investigators work toward the nearest intermediary instead.

Regulators see the same pressure. The FATF’s July 2026 update reports that 83% of surveyed jurisdictions now have Travel Rule laws, yet almost half of those have taken no related supervisory or enforcement action. It also notes that most on-chain illicit activity now involves stablecoins, and some criminal networks have built stablecoins designed to resist freezes. The data exists, but access depends on jurisdiction and speed.

What Real Cryptocurrency Fraud Cases Show

In October 2025, U.S. prosecutors filed a civil forfeiture complaint targeting about 127,271 bitcoin, valued near $15 billion, the largest forfeiture action in DOJ history. Prosecutors allege the funds were proceeds of “pig butchering” investment scams run from forced-labor compounds in Cambodia. Those are allegations, not findings of guilt.

A smaller case shows the same method at work. In February 2026, federal authorities in North Carolina seized more than $61 million in USDT tied to romance-based investment scams after investigators traced wallets and worked with the stablecoin issuer. In both cryptocurrency fraud cases, the winning formula was attribution plus speed plus a cooperating intermediary.

Your Cryptocurrency Fraud Action Plan Before and After a Loss

Before:

  • Add digital assets to your fraud risk assessment, and require callback verification for any payment change. Our business email compromise guide explains the pattern.
  • Invest in monitoring. The ACFE links proactive data monitoring to a 53% lower median loss, and our post on internal controls that actually work shows where to start.
  • Vet exchanges and vendors for KYC and Travel Rule compliance.

After:

  • Report to the IC3 immediately. In 2025, the FBI’s Recovery Asset Team ran 3,900 freeze actions against $1.164 billion in attempted theft and froze $679 million, a 58% success rate.
  • Preserve devices, logs, and chain of custody, and stop contacting the suspect.
  • Ignore “recovery” offers. IC3 received more than 10,500 recovery scam complaints in 2025, tied to an estimated $1.4 billion in losses.
  • Engage forensic investigators and counsel together, so the evidence holds up.

Take the First Step Before the Funds Move

Cryptocurrency fraud is fast, but the blockchain remembers everything. The organizations that recover value are the ones that document early, report quickly, and work with qualified investigators. If you suspect a loss, contact the Fraud & Order team for a confidential conversation about your options.

Frequently Asked Questions

1. Can stolen cryptocurrency really be traced?

Yes. Every transaction is recorded on a public ledger, so investigators can follow funds from wallet to wallet. Names usually emerge from exchange or issuer records, which require legal process.

2. Can we get our money back after cryptocurrency fraud?

Sometimes. Recovery depends on how fast you act and where the funds land, and nothing is guaranteed. Recent FBI freeze actions succeeded in 58% of attempted thefts, which is why speed matters.

3. How quickly should we act after cryptocurrency fraud?

Within hours if possible. Freezes work best before funds move through bridges, swaps, or cash-out channels.

4. What evidence should we preserve?

For any cryptocurrency fraud claim, keep transaction hashes, wallet addresses, bank wire records, screenshots, emails, chats, and device logs. Do not wipe or reset devices, because that can destroy the trail.

5. Do mixers and bridges make tracing impossible?

No, but they add work. Investigators follow cross-chain movements and use flow analysis, though some traces end with probabilities instead of certainty.

6. Should we hire a forensic examiner or a lawyer first?

Both, ideally at the same time. The examiner builds the trace, and counsel handles legal process and privilege. Learn more about our corporate crime investigation services.

References

  1. FBI Internet Crime Complaint Center. (2026). 2025 Internet Crime Report. https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
  2. The Block. (2026). FBI says crypto-related fraud losses hit record $11.4 billion in 2025. https://www.theblock.co/amp/post/397134/fbi-says-crypto-related-fraud-losses-hit-record-11-4-billion-in-2025-with-seniors-bearing-the-brunt
  3. The Block / Chainalysis. (2026). Crypto crime topped $150 billion in 2025 as state-backed actors scaled onchain. https://www.theblock.co/post/384753/crypto-crime-150-billion-usd-2025-state-actors-scale-onchain-chainalysis
  4. TRM Labs. (2026). 2026 Crypto Crime Report. https://www.trmlabs.com/reports-and-whitepapers/2026-crypto-crime-report
  5. Association of Certified Fraud Examiners. (2026). Occupational Fraud 2026: A Report to the Nations. https://acfe.com/RTTN
  6. Hogan Lovells, Regulation Tomorrow. (2026). FATF publishes targeted update on implementation of the FATF standards on virtual assets and VASPs. https://www.regulationtomorrow.com/2026/07/fatf-publishes-targeted-update-on-implementation-of-the-fatf-standards-on-virtual-assets-and-virtual-asset-service-providers/
  7. Baker McKenzie. (2025). Department of Justice seizes about $15 billion in bitcoin relating to pig butchering scheme. https://blockchain.bakermckenzie.com/2025/10/17/department-of-justice-seizes-about-15-billion-in-bitcoin-relating-to-pig-butchering-scheme/
  8. Cointelegraph. (2026). How US investigators traced $61M in crypto tied to romance scams across wallets. https://cointelegraph.com/features/how-us-investigators-traced-61m-in-crypto-tied-to-romance-scams-across-wallets
  9. Elliptic. (n.d.). Asset freezes, seizures, and forfeiture procedures in cryptocurrency investigations. https://www.elliptic.co/corpus/gen-3863/law/asset-freezes-seizures-and-forfeiture-procedures-in-cryptocurrency-investigations.html
  10. ASIS International, Security Management. (2026). Half of 2025 U.S. fraud losses were linked to cryptocurrency scams. https://www.asisonline.org/security-management-magazine/latest-news/today-in-security/2026/april/cryptocurrency-scams/

Disclaimer

This article is for informational purposes only and is not legal, financial, or professional advice. Reading it does not create a client relationship with Fraud & Order. Every situation is different, so consult qualified legal, forensic, and financial professionals about your circumstances. For questions about FraudOrder services, visit https://fraudorder.co/