Crypto Investigations Report 2026
Intro
Between January 1 and October 13, 2026, AMLBot investigated more than 250 crypto crime incidents. Some were high-profile hacks and exploits that AMLBot traced on its own initiative or for exchanges, protocols and law enforcement; others were brought to AMLBot directly by victims. Together they carried $291.6 million in reported losses: $227.5 million from January to September and $64.1 million in cases opened in the first 13 days of October.
Unlike industry tallies built mainly from large public hacks, these figures come largely from victims themselves (individuals, businesses and exchanges), and many of their cases never make headlines. The result is a ground-level view of how crypto crime reaches people.
To download the full report, fill out the form below 👇
Key Findings — Crypto Investigations Report 2026
Key Findings — Crypto Investigations Report 2026
- On average, one hack does the damage of six phishing attacks. In Q3, hacks were 19% of cases but 40% of reported losses ($35.9 million).
- Two threats accounted for 80% of Q3 losses. Hacks ($35.9 million) and scams ($35.2 million) made up $71.1 million of the quarter's $88.7 million in reported losses.
- More money lost, smaller typical losses. Reported losses rose 41% from Q1 to Q3, reaching $88.7 million, while the median loss fell 49%, from $223,000 in Q2 to $113,000.
- Hacks rebounded to their Q2 level. After dipping to 7% of cases in July, hacks climbed to 36% in September, close to their Q2 share of 33%, and held at 37% into October.
- Reported losses reached $291.6 million by mid-October. Cases opened in the first 13 days of October added $64.1 million to the $227.5 million reported from January to September.
- Asia: 1 in 10 cases, nearly a third of losses. Asia accounted for 10% of January–September cases but 30% of reported losses with a recorded country.
- Individuals are hit most; institutions lose more per case. Individual users were targeted in 77% of cases and carried 51.6% of reported losses.
- For exchanges, the threat is hacks. Hacks and exploits made up 81% of cases involving exchanges and other custodial services.
- Hacks are not only an institutional problem. Individual users were the target in 40% of hacks and exploits.
- Bitcoin cases are fewer but bigger. Bitcoin, involved in 20% of cases, had the highest median loss of the four most-involved networks: $364,000.
- Launderers are racing the freeze. Investigators saw stolen stablecoins converted into BTC and ETH through decentralized exchanges and cross-chain routes, limiting issuers' ability to freeze funds.
- Scam networks are spreading beyond Southeast Asia, with operations reported in Sri Lanka, the UAE and parts of Africa.
FAQ
What Is the AMLBot Crypto Investigations Report 2026?
The AMLBot Crypto Investigations Report 2026 is based on more than 250 crypto crime cases AMLBot investigated between January 1 and October 13, 2026. These cases carried $291.6 million in reported losses. October 1–13 figures are preliminary.
How Much Was Lost in Crypto Crime Cases Investigated by AMLBot in 2026?
Cases AMLBot investigated in 2026 carried $291.6 million in reported losses: $227.5 million from January to September and $64.1 million in cases opened October 1–13. Reported losses were $62.9 million in Q1, $75.9 million in Q2 and $88.7 million in Q3.
What Was the Most Common Type of Crypto Crime in 2026?
Human-targeted attacks (phishing, wallet compromise, scams and social engineering) made up 72% of AMLBot cases from January to September 2026. In Q3, phishing and wallet compromise was the largest single category, at 40% of cases.
Which Crypto Attacks Caused the Largest Losses in 2026?
Hacks and exploits. In Q3 2026, they were 19% of AMLBot cases but 40% of reported losses ($35.9 million), and the average hack carried about six times the reported loss of a phishing or wallet-compromise case. The median hack was $359,000, against $85,000 for phishing and wallet compromise.
Why Did the Median Loss Fall While Total Losses Rose?
Reported losses rose 41% from Q1 to Q3 2026, while the median loss fell 49%, from $223,000 in Q2 to $113,000 in Q3. The pattern points to a handful of very large cases, not bigger everyday losses.
Who Are the Main Targets of Crypto Crime?
Individual users were the target in 77% of AMLBot cases and carried 51.6% of reported losses. Centralized exchanges were 7% of cases but 18.8% of reported losses, and hacks and exploits made up 81% of exchange cases. Individual users were also the target in 40% of hacks and exploits.
Which Blockchains Were Most Often Involved in Crypto Crime Cases?
Ethereum was involved in 36% of AMLBot cases and TRON in 33%, the two main networks for USDT transfers. Bitcoin appeared in 20% of cases but had the highest median loss of the four most-involved networks, at $364,000.
Which Regions Recorded the Most Crypto Crime Cases?
Europe accounted for 40% of January–September 2026 cases and 35% of reported losses. Asia was 10% of cases but 30% of losses, and the Middle East 9% of cases but 20% of losses. These shares show where incidents were recorded, not where offenders operate.
How Is Stolen Crypto Laundered in 2026?
AMLBot investigators saw stolen stablecoins quickly converted into native assets such as ETH and BTC, which no central issuer can freeze. Attackers combined established tools (cross-chain bridges, decentralized exchanges, privacy-focused assets and automated transactions) to move funds across multiple networks.
What Should Incident-Response Teams Do after a Crypto Theft?
The report recommends establishing contacts with issuers, exchanges, investigators and law enforcement before an incident, recording transaction hashes and addresses immediately, and filing freeze requests while funds are still within reach. Stolen stablecoins are often converted out of freezable tokens shortly after theft, so the window for an issuer freeze can close within hours.
Where Does the Data in the Report Come From?
The figures come largely from victims themselves (individuals, businesses and exchanges) and from public hacks AMLBot traced. Losses are the amounts affected parties reported when each investigation opened, and not all are independently verified. Because people who commission an investigation tend to have lost more, medians likely run higher than for victims overall.