This report is based exclusively on AMLBot’s internal investigation cases. It does not rely on public estimates, self-reported losses, or secondary datasets.

Summary

This report is based on the analysis of 2,500+ real crypto crime investigations conducted by AMLBot across 2025, covering fraud, theft, hacks, and post-incident tracing cases across multiple blockchains and services. Rather than focusing on isolated incidents or public breach disclosures, the study examines how crypto attacks actually unfold in practice — from the initial attack vector to post-incident fund movement, freezing, and recovery attempts.

The analysis maps 15 distinct fraud and theft categories, classified by dominant attack vector, and compares:

• case frequency versus financial impact, highlighting the divergence between how often incidents occur and where losses concentrate,
• high-volume retail-driven schemes versus low-frequency, institution-scale events, including rare but catastrophic CEX breaches,
• purely technical exploits versus access- and trust-driven compromise, showing how many incidents labeled as “technical” originate at the human or operational layer,
• and post-incident outcomes, focusing on how freezing, tracing, and counterparty coordination shape loss containment and recovery potential in real investigations.

The findings show that modern crypto crime has entered a sustained operational phase, where losses are driven less by isolated vulnerabilities and more by persistent exploitation of trust, access, and process gaps. In addition, recovery outcomes depend not on guarantees, but on timing, visibility, and the ability to act before stolen assets disperse beyond control.

To download the full report, fill out the form below 👇

It is important to note that dataset is built on real post-incident investigations. In most cases, individuals and businesses approached AMLBot after an incident had already occurred. These cases were investigated using Tracer, as the primary on-chain investigation tool, allowing analysts to reconstruct fund movement, identify laundering patterns, and understand how attacks evolved after the initial breach.

Report Preview

-AMLBot Team

Follow AMLBot:
🔗 Website
🔗 Telegram
🔗 Support Team
🔗 LinkedIn

Request Early Access