Security1 publisher3 min readPublished
FinCEN tallies $12.7 billion in crypto scam losses across 33,000 reports from financial institutions
Treasury's study draws on reports from about 1,300 institutions filed between September 2023 and December 2025, and it says monthly volume grew almost 11 percent while each filer saw only one phase of a scam.
The Watch · Security desk

What happened
- FinCEN issued an alert to the financial industry alongside a study of more than 33,000 cyber fraud incident reports filed between September 2023 and December 2025.
- The study puts about $12.7 billion stolen from Americans in cryptocurrency investment scams, with victims in all 50 states and U.S. territories.
- It draws on filings from about 1,300 financial institutions and follows a 2023 Treasury alert on pig butchering scams.
- Traditional banks reported about $6.4 billion in potential fraud, usually spotting it when a customer wired money to a digital asset firm or to a scam-affiliated beneficiary.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- constraint A single institution cannot file a report that describes the scheme, because it only sees one phase of it. The government is collecting fragments and assembling the picture centrally, so the value of any one filing depends on volume.
- decision Fraud queues that prioritise elderly-customer alerts are tuned to a quarter of the reported population. Detection teams either broaden the trigger set or accept that most cases arrive unflagged.
- exposure Lending and retirement-account desks are now inside a typology that fraud teams treat as a payments problem. A declined personal loan and a second mortgage application are part of the pattern.
- precedent Suspicious activity filings are feeding sanctions targeting. Xinbi Guarantee shows the path from reported typology to designated platform, and scammers moved onto it quickly after Huione was taken down.
FinCEN said the filings helped federal investigators because of how little any one filer could see: institutions typically had visibility into only one phase of a scam's lifecycle [6]. Banks described the point at which they noticed anything, telling investigators they "often detected schemes when a victim sent funds to an [financial institution] in the digital asset sector to purchase digital assets, or when a customer sent a wire transfer to a scam-affiliated beneficiary, frequently referencing digital asset investments" [9].
September 2023 through December 2025 is 28 months, so 33,000 reports average about 1,180 a month [20]. FinCEN said it received nearly 11 percent more reports each month than the month prior [5]. Held for twelve months, that rate multiplies monthly volume by about 3.5 [22]. The agency ties the rising rate of suspected scam activity to schemes expanding beyond centers in Myanmar, Cambodia and Laos [4].
The sector figures do not reconcile to the headline number. Cryptocurrency firms identified about $5.5 billion in suspected scam activity [7]. More traditional banks reported about $6.4 billion in potential fraud [8]. That is $11.9 billion, roughly $800 million below the $12.7 billion the study attributes to cryptocurrency investment scams [21]. The two sets are labelled as suspected activity and potential fraud, and they are two vantage points on overlapping flows.
Age-based triage reaches a quarter of this victim pool. Adults over 60 accounted for about 25 percent of all reports and were not overrepresented in the victim pool, which FinCEN reads as other age groups being scammed at similar rates [10].
Some of the strongest tells sit outside payments. Victims submitted applications for loans and second mortgages as part of their participation in a scam [11]. One victim withdrew almost $150,000 from his retirement account, took out a personal loan and took out lines of credit on his home to send funds to a scammer, and was denied personal loans twice, saying he needed the money to invest in a venture touted by his digital romantic partner [12]. The report also cited a filing from the digital asset sector: "[A financial institution] involved in the digital assets sector reported an older adult victim transferred nearly $640,000 from her retirement fund to send to a suspected scammer in connection with an apparent digital asset investment scheme" [13].
Most filings named Ethereum, Tether and USD Coin, at least 18 other coins appeared, and FinCEN said scammers almost always exchanged stolen funds for USDT [14]. Most victims worked out what had happened only when they were asked to pay a fee to get their money back, and investigators found cases where the scammers returned posing as an asset recovery service [15].
"The transnational criminal organizations behind these scams exploit both emerging technologies and human vulnerabilities, resulting in devastating financial losses for innocent American victims," Treasury official Gene Lange said [16]. Treasury wants institutions to be more vigilant in spotting and reporting schemes run by overseas scam centers [19]. As described, the alert carries no new filing requirement and no deadline.
Where the filings do land is enforcement. Days after the report, the US government took action against Xinbi Guarantee, a Telegram-based illicit marketplace that helped scammers launder billions [17]. Ari Redbord, global head of policy at TRM Labs, said Xinbi was sanctioned because it became the go-to platform for Southeast Asia scam compounds after the earlier US takedown of Huione, and that more than $36 billion was laundered on it [18].
What to watch
- Whether designations follow Xinbi Guarantee, and how quickly successor marketplaces show up in filings.
- Whether the near-11% month-over-month growth in reports continues through 2026 or flattens as filer awareness catches up with the 2023 alert.
- Whether BSA examiners begin citing the study's typologies. That would convert an alert into a supervisory expectation.