Crypto Investigations Report 2026: Key Findings, Losses and Crime Trends

Intro

Between January 1 and October 13, 2026, AMLBot investigated more than 250 crypto crime cases. Reported losses in those cases total $291.6 million: $227.5 million in cases opened from January to September and $64.1 million in the first 13 days of October (preliminary). Unlike industry tallies built mainly from large public hacks, these figures come largely from AMLBot’s own investigations — many brought directly by victims, including individuals, businesses and exchanges, and many that never make headlines.

The statistics therefore describe the cases AMLBot investigated, not the whole global crypto crime market. This article covers the main results of the 33-page report; the full PDF is available for download below.

To download the full report, fill out the form below 👇

Key Findings from AMLBot’s 2026 Investigations

1. 250+ investigations and $291.6M in reported losses between January 1 and October 13, 2026.
2. People are the main target. Human-targeted attacks — phishing, wallet compromise, scams and social engineering — were 72% of cases from January to September.
3. Hacks are rarer but costlier. In Q3, hacks and exploits were 19% of cases but 40% of reported losses.
4. Totals up, typical loss down. Reported losses rose 41% from Q1 to Q3, while the median loss fell 49% from Q2 to Q3.
5. Asia: 10% of cases, 30% of losses among cases with a recorded country (January–September).
6. Individual users were targeted in 77% of cases between January 1 and October 13.
7. Speed works against recovery. Investigators saw stolen stablecoins converted quickly into assets issuers cannot freeze.

Crypto Crime Losses in 2026: What the Data Shows

Reported losses in AMLBot cases rose every quarter: $62.9 million in Q1, $75.9 million in Q2, and $88.7 million in Q3— up 21% from Q1 to Q2, 17% from Q2 to Q3, and 41% from Q1 to Q3. The three quarters add up to $227.5 million.

Why Totals Rose while the Typical Loss Fell

The median loss fell 49% from Q2 to Q3, from $223,000 to $113,000, even as the quarterly total climbed. A rising total with a falling median points to a handful of massive cases rather than bigger everyday losses. The median describes the middle case and is far less sensitive to outliers than the total; the report notes four cases above $15 million each, recorded in three regions (the Middle East, Asia and Europe). More money lost therefore does not mean each individual incident became pricier.

How This Compares with Public Industry Estimates

The report also places its numbers beside publicly reported industry estimates, which are not AMLBot data. Those estimates put hack losses alone above $1.17 billion in Q3 2026, with September the busiest month. They are built largely from big, publicly disclosed hacks.

AMLBot’s cases come mostly from affected individuals, businesses and exchanges, and record what was reported in each case rather than the headline value of an incident: the September 2026 Bitget breach, publicly reported at $387.5 million, is more than ten times AMLBot’s entire Q3 hack total of $35.9 million. The two views measure different things.

Most Common Crypto Attacks vs. Most Expensive Attacks

How often an attack occurs and how much it costs are different questions. Q3 2026 shows the gap clearly:

Phishing and Wallet Compromise: Frequent, but Small

Phishing and wallet compromise — wallet, device and seed-phrase compromise, phishing and address poisoning — was the largest single category in Q3, peaking in August. These attacks go straight at individuals, and they were the least costly per case, with a median of $85,000. In smaller incidents, AMLBot investigators observed stolen funds often being moved or converted within moments.

Hacks and Exploits: Few Cases, Outsized Losses

Hacks and exploits — exchange breaches, DeFi exploits and attacks on business or protocol infrastructure — had the highest median loss ($359,000). Their share of cases was 19% in Q1, 33% in Q2, and 19% in Q3 (23% for January–September). Within Q3 it swung from 7% in July to 18% in August and 36% in September, then held at 37% in the first 13 days of October, back at the Q2 level after an unusually low July. Monthly shares rest on a few cases and can move by several points. Part of September’s rise reflects a smaller caseload: total cases fell 26% from August to September as individual-user cases fell 29%.

Scams and Social Engineering: Matching Hacks in Dollars

Scams and social engineering — investment, OTC, chat-based, pig-butchering, and gambling scams — accounted for 40% of Q3 losses, the same share as hacks, with $35.2 million against $35.9 million. They did it with a smaller median loss ($107,000) but nearly twice as many cases (35% versus 19%).

“One Hack Does the Damage of Six Phishing Attacks”

This headline compares average losses per case in Q3: the average hack was roughly six times the average phishing or wallet-compromise case. On medians the gap is smaller but still large — the median hack ($359,000) was about 4.2 times the median phishing case ($85,000). Both comparisons describe AMLBot’s Q3 caseload only.

Who Is Targeted by Crypto Crime?

AMLBot’s case data records who was targeted. Between January 1 and October 13, 2026, individual users were the target in 77% of cases and accounted for $150.5 million, or 51.6% of reported losses, with a median loss of $151,000.

Europe was the center of gravity for AMLBot’s investigations in January–September 2026, with 40% of cases and 35% of reported losses. The Americas accounted for 17% of cases and 10% of losses. Asia stood out the other way: just 10% of cases but 30% of losses. The Middle East had 9% of cases and 20% of losses.

Two warnings matter. First, these shares reflect where cases were recorded, not where criminals operate. Second, loss shares are calculated only for cases with a recorded country, which excludes about 17% of January–September reported losses from this chart, and are rounded to the nearest 5%. The report does not attribute Europe’s lead in case counts to one cause. A region with few cases can see its loss share move sharply when a few huge cases land there, which is consistent with the four cases above $15 million recorded in the Middle East, Asia and Europe. However, the report does not draw that link directly.

Which Blockchains Are Most Frequently Involved?

Ethereum was involved in 36% of cases and TRON in 33% — the two main networks for USDT transfers — and Ethereum cases carried the largest total, $135.3 million. Bitcoin appeared in 20% of cases yet had the highest median loss of the four most-involved networks ($364,000): fewer cases, but bigger ones. BNB Chain was involved in only 8% of cases, but those cases carried $56.7 million in reported losses.

Many cases cross networks: where a chain was recorded, cases involved 1.4 chains on average, and the chain was not recorded in 17% of cases. The report also tallies fraud types separately from attack categories: phishing was the most common (23% of cases), followed by hacks in the narrower fraud-type sense (21%) and investment scams (20%), with wallet compromise, OTC scams, device compromise, pig-butchering, address poisoning and physical coercion (“wrench”) attacks behind them.

How Stolen Cryptocurrency Is Laundered in 2026

This section draws on the observations of AMLBot’s Investigation Intelligence Team, based on tracing work in live cases. They are firsthand investigator observations, not statistics on the wider industry. The core finding: attackers combine established tools — cross-chain bridges, decentralized exchanges, privacy-focused assets and automated transactions — and the emphasis is on speed and coordination, not novelty.

“Criminals are not constantly inventing new ways to hide funds. They are increasingly trying to move funds through a relatively small number of established, fast conversion routes and, when the amounts are large, layering those routes across many chains. Speed and automation are becoming more important than sheer complexity.” — Slava Demchuk, CEO, AMLBot.

Rapid Conversion of Stolen Stablecoins

One pattern stood out: stolen stablecoins were quickly converted into native assets such as ETH and BTC, which no central issuer can freeze. Issuers such as Tether routinely freeze assets tied to suspected illicit activity, so converting into non-freezable assets removes that risk for attackers — and cross-chain bridges and decentralized exchanges let them do it without touching a centralized exchange. Often the first stage of laundering is simply moving assets off their original token and network, and how quickly that happens can decide whether an issuer freeze is still possible. That is why investigation speed is critical. For data on how issuer freezes work in practice, see AMLBot’s Analysis of USDT and USDC Freezes, 2023–2025. Freezes are not always final. On October 9, Tether froze $1.45 million in USDT held in THORChain vaults on TRON, then reversed the freeze about three hours later — an example of how timing, legal authority and operational realities all shape whether an intervention holds. 

Cross-Chain Bridges, DEXs and Privacy Tools 

The laundering toolkit has barely changed: cross-chain bridges, decentralized exchanges, mixers, privacy protocols and privacy-focused assets. What has changed is how they are combined. In AMLBot cases, attackers moved funds through chains of asset swaps, intermediary wallets and blockchain networks, leaving fragmented trails that can only be rebuilt with multi-chain analysis. The complexity comes from execution, not invention.

Monero (XMR) and Zcash (ZEC) both appeared in the laundering infrastructure AMLBot’s investigators encountered. They differ: Monero is private by default, while Zcash supports both transparent and shielded transactions, so buying ZEC hides nothing on its own — privacy depends on whether shielded transactions are used afterward. Zcash also offers more routing options because it works with certain decentralized and cross-chain services such as THORChain and NEAR Intents, depending on integrations and available liquidity. Easier cross-chain access may widen laundering options, but AMLBot’s cases show no measurable increase in Zcash-related crime.

Small Thefts Move Fast, Large Thefts Move Long

The size of a theft shapes how the money moves. In smaller incidents, attackers typically move or convert stolen assets almost immediately, leaving little time to intervene. Larger thefts tend to unfold over weeks or months, with funds spread across many wallets, networks and intermediary services as attackers work around liquidity limits and add layers of obfuscation. The pattern is not universal, but it means investigators must plan for the first minutes and hours as well as the long tail that follows.

Automation in Crypto Laundering

Investigators saw tightly coordinated transaction sequences in cases involving cross-chain laundering infrastructure. Scripts and automated tools can fire off multiple transfers and swaps within seconds, but speed cuts both ways: automation can also amplify routing and configuration mistakes. In one September investigation, AMLBot’s tracing found two transactions executed seconds apart that appear to have confused Chainflip deposit channels for Ethereum and Arbitrum, leaving about $700,000 in stolen assets stuck or inaccessible. The pattern is consistent with automated execution, although tracing evidence alone cannot confirm that bots were involved.

Separately, Bitget reported that about $387.5 million was taken from its hot and warm wallets in a breach detected on September 24, and the exchange’s CEO attributed it to North Korean actors. That figure and attribution come from public statements by Bitget, not from AMLBot’s case data.

The Geographic Expansion of Scam Networks 

AMLBot investigators report organized scam networks expanding beyond their traditional Southeast Asian hubs, with operations reported in Sri Lanka, the UAE and parts of Africa; recent enforcement actions point to the same spread. For investigators the infrastructure matters more than the location: dismantling a physical scam site does not necessarily stop the crypto wallets, OTC intermediaries and cross-border laundering networks behind it.

The lesson across all five patterns: the first minutes and hours matter most. Recovering funds increasingly depends on spotting stolen assets early, rebuilding flows across multiple networks and moving quickly with the right service providers.

Early October 2026: What the Latest Cases Suggest

The first 13 days of October offer an early read on whether September’s shift held. It largely did. All figures below are preliminary and cover a partial month.

Total reported losses were $64.1 million and the median loss was $250,000—more than double Q3’s $113,000. The hack share held at 37%, in line with September (36%) and Q2 (33%). Most of the human-targeted losses came from a handful of large OTC-fraud cases: OTC scams were a small share of cases but produced most of those losses, which reflects a few massive cases rather than an industry-wide rise in OTC fraud. Together, hacks and OTC fraud made up the large majority of early-October losses.

These trends continued from September, but a 13-day window rests on few cases and some attacks are older, so firm conclusions about October must wait for a full month of data.

What Individuals, Exchanges and Investigation Teams Should Do

Each pattern in the report points to a practical step. None of these guarantees that funds can be frozen or recovered.

For Individuals

• Phishing and wallet compromise were the most common attacks in Q3 (40% of cases). Verify every URL, address and counterparty through an independent channel.
• Never enter or share a seed phrase.
• Revoke token approvals you no longer use, and keep long-term savings on a hardware wallet that never connects to unfamiliar apps.

For OTC and Investment Transactions

• A handful of OTC-fraud cases drove most human-targeted losses in early October. Confirm the other party’s identity and settlement terms through trusted channels.
• Use escrow or simultaneous delivery, and never pre-fund an unverified counterparty.

For Exchanges and Crypto Businesses

• Hacks drove 40% of Q3 reported losses. Protect privileged keys with multisig or MPC and audit third-party access.
• Keep hot-wallet balances to operational needs and enforce withdrawal limits with real-time anomaly alerts.
• Monitor suspicious transactions continuously. AMLBot Transaction Monitoring is one way to do it.

For Incident-Response Teams

• Stolen stablecoins were often converted out of freezable tokens shortly after theft, so the window for an issuer freeze can close within hours.
• Record transaction hashes (TxIDs) and addresses immediately, and trace assets quickly — AI Autotrace supports self-service tracing.
• Establish contacts with issuers, exchanges, investigators and law enforcement before an incident, and file freeze requests while funds are still within reach.

Research Methodology and Limitations

• Period. Data covers more than 250 cases AMLBot investigated between January 1 and October 13, 2026, with January 1–September 30 as the main period and October 1–13 as a separate, preliminary update. This is not full-year 2026 data.
• What counts as a case. Incidents investigated by AMLBot’s team: publicly known hacks and exploits AMLBot traced on its initiative or on behalf of exchanges, protocols and law enforcement, and incidents brought by affected parties. Cases are grouped by the month the investigation opened, not necessarily the month of the attack; some concern earlier years.
• Reported losses. The amount affected parties reported when the investigation opened or, for public hacks AMLBot traced, the amount in AMLBot’s case file, which may differ from the incident’s headline value. Not all are independently verified, and they should not be read as confirmed or unrecoverable losses. Cases without a usable USD amount are excluded from dollar-based calculations.
• Selection effect. Many cases come from parties who engaged an investigator, so the sample is not random, is not representative of the whole crypto market and likely over-represents larger losses. Medians likely run higher than for victims overall.
• Public hacks. Industry hack tallies are built from large, publicly disclosed incidents and can differ greatly from AMLBot’s case records.
• Rounding and small samples. Percentages are rounded to the nearest whole percent (regional loss shares to the nearest 5%; target-category loss shares to one decimal). Categories with fewer than five cases in a period are merged or not broken out, and monthly and October shares are directional.
• Investigator observations on asset conversion, privacy tokens, automation and transfer speed derive from tracing work and illustrative cases, not from statistical samples.
• Comparison with other AMLBot reports. This report has a different scope and methodology from AMLBot’s earlier Crypto Crime Report 2025–2026 (2,500+ investigations); the two samples should not be compared directly.

Case data come from AMLBot investigation records, aggregated so that no individual case, client or counterparty can be identified. Industry comparisons use publicly reported estimates; Bitget breach figures come from the exchange’s public statements.

Final Takeaways

• Crimes against individuals are dominated by the number of investigations: 77% of cases between January 1 and October 13.
• Hacks and exploits cause disproportionate losses: 19% of Q3 cases, 40% of Q3 reported losses.
• Laundering relies on speed, asset conversion and movement across networks, not on new techniques.
• Early detection and investigation are critical to any chance of limiting the further movement of stolen assets.

Download the Full Crypto Investigations Report 2026

The 33-page PDF includes every table and figure, the complete methodology and definitions, and the full set of investigator observations.

About AMLBot

AMLBot is an all-in-one crypto compliance platform operating since 2019, covering AML wallet screening, real-time transaction monitoring (KYT), KYC/KYB verification, blockchain investigations, and crypto asset recovery through a single platform and API. It works with more than 1,000 crypto businesses worldwide, alongside financial institutions and law-enforcement agencies.

FAQ

What is the AMLBot Crypto Investigations Report 2026?

It is a research report based on AMLBot’s own investigation records. It covers more than 250 crypto crime cases opened between January 1 and October 13, 2026, with October 1–13 treated as a preliminary update. The full 33-page PDF is available for download.

How Many Crypto Crime Cases Did AMLBot Investigate in 2026?

More than 250 cases between January 1 and October 13, 2026, with $291.6 million in reported losses. The data does not represent all crypto crime worldwide and is not a full-year 2026 figure.

What Were the Most Common Crypto Attacks in 2026?

Human-targeted attacks — phishing, wallet compromise, scams and social engineering — made up 72% of January–September cases. In Q3, phishing and wallet compromise were the largest single categories at 40% of cases.

Which Crypto Attacks Caused the Largest Financial Losses?

In Q3 2026, hacks and exploits and scams and social engineering each accounted for 40% of reported losses. Hacks did so with only 19% of cases and the highest median loss ($359K).

How Do Criminals Launder Stolen Cryptocurrency?

AMLBot investigators saw established tools — cross-chain bridges, decentralized exchanges, privacy-focused assets and automated transactions — used with speed and coordination. Stolen stablecoins were often converted quickly into assets such as ETH or BTC that no central issuer can freeze.

How Does AMLBot Collect and Verify Its Investigation Data?

Figures come from AMLBot case records, aggregated so that no individual case, client or counterparty can be identified. Losses are amounts reported by affected parties (or, for public hacks AMLBot traced, the amount in AMLBot’s case file) and are not all independently verified.