Advanced: blockchain and AI in fraud.

Crypto investment fraud

The scale. In 2025, reports to the FBI's Internet Crime Complaint Center (IC3) recorded about US$7.2 billion lost to cryptocurrency investment fraud, from about 61,500 complaints, the largest single source of reported fraud losses in the United States. Complaints mentioning cryptocurrency in any way reported over US$11 billion in losses. These are reported losses: the IC3 notes its figures are a snapshot that may change, and many victims never report.

How it works. The FBI describes a common pattern:

1. First contact by text message, social media, an advert or a dating app, then a move to an encrypted messaging app.
2. A relationship or a "mentor" builds trust over time.
3. The victim is directed to a fake trading platform showing large, fake profits, and is often offered loans to invest more.
4. When the victim tries to withdraw, they are asked to pay "taxes" or "fees" first.
5. Victims are later targeted again by fake "recovery" services; the IC3 recorded US$1.4 billion in reported losses to recovery scams in 2025, which may include earlier losses.

The FBI attributes much of this to organised criminal enterprises largely based in Southeast Asia, which use victims of human trafficking as forced labour in scam compounds.

Getting ahead of the loss. Through Operation Level Up, launched in January 2024, the FBI uses investigative leads to identify people who are being defrauded and warn them. By its 2025 report it had notified more than 8,000 victims and estimated over US$500 million in avoided losses; in 2025, 78% of those notified did not know they were being scammed.

For banks and payment providers, the warning signs often appear before any crypto is bought: a customer with no history of crypto suddenly sending large sums to an exchange, cashing in savings or borrowing to do it, or paying "fees" to release supposed profits.

Rug pulls, manipulation and smart contract exploits

Rug pulls. In a 2022 case, the US Department of Justice described a rug pull as a scheme where the creator of a project solicits investment, then abruptly abandons it and keeps the investors' money. The US Treasury's 2023 risk assessment of decentralised finance (DeFi) explains common methods: launching a new token, promoting it, then suddenly withdrawing the pool of funds that lets people trade it so the price collapses; stopping investors from selling; or hiding a deliberate backdoor in the token's code.

In that 2022 case, two founders of an NFT project abandoned it within hours of selling out and moved about US$1.1 million through a series of transactions to hide its source, according to the charges. One of them later pleaded guilty to conspiracy to commit wire fraud and in 2025 was sentenced to probation.

Pump-and-dump and wash trading. The US Commodity Futures Trading Commission has warned that pump-and-dump schemes target thinly traded new tokens, are organised in online chat groups with countdowns to "buy" signals, and can be over in minutes, with the organisers selling first. In Operation Token Mirrors (2024), the FBI went further and created its own token to identify "market makers" willing to fake trading volume, known as wash trading. Prosecutors charged 18 people and companies; one market maker and its founder were sentenced in 2025, the founder to eight months in prison and the firm to forfeit about US$23 million and cease operating.

Smart contract and DeFi exploits. The Treasury assessment and an FBI warning from 2022 describe how attackers steal from DeFi services:

• Code exploits: finding a flaw in a smart contract's code, which other attackers or automated bots may copy within minutes.
• Flash loan attacks: borrowing a large sum and repaying it within one transaction, using the money in between to manipulate a contract's logic.
• Oracle manipulation: pushing up the price on the few markets a contract relies on for its price feed, then borrowing against the inflated value.
• Bridge attacks: targeting the services that move assets between blockchains, which often hold large pools of funds in one place.

The Treasury notes that several DeFi services were exploited even after claiming their code had been audited, because audits are not standardised.

A case still unresolved. In a well-known 2022 case, a trader used oracle manipulation to withdraw over US$100 million from a DeFi lending platform. A jury convicted him in 2024, but in May 2025 the judge vacated the convictions and entered an acquittal on the main fraud count. The government appealed. Courts are still working out how fraud law applies when the code itself allowed the exploit.

Wallet drainers, tracing and freezing

Wallet drainers and approval phishing. Europol's 2026 threat assessment describes cryptocurrency drainers as malware that tricks victims into connecting their wallet to a malicious smart contract and approving transactions that empty it at once, now offered as a criminal service. The FBI warned in 2025 of fake airdrops with links that connect wallets to malicious applications or ask for the secret recovery phrase. The FATF has also noted address poisoning, where criminals send tiny transactions from look-alike addresses hoping the victim later copies the wrong one.

Tracing: powerful but limited. Public blockchains are visible, which lets investigators follow funds. The Bank for International Settlements cautions that this is not a silver bullet: addresses are pseudonymous, some blockchains hide details, and linking an address to a person needs other evidence. The FATF's 2026 update adds that criminals obscure attribution through layers of self-hosted wallets, and that most surveyed jurisdictions rate person-to-person transfers as high risk.

Freezing stablecoins. Some stablecoin issuers can freeze tokens in their contracts. The FATF notes that issuers decide differently and need substantive evidence. US authorities have seized large sums this way:

• in 2023, nearly US$9 million in a stablecoin linked to a scam organisation that targeted over 70 victims, traced through dozens of addresses and chain hopping;
• in 2025, a civil forfeiture action against more than US$225 million linked to crypto investment scams, described as the largest such seizure in US Secret Service history, using blockchain analysis.

In October 2025, US prosecutors filed a civil forfeiture complaint over about 127,271 bitcoin, then worth about US$15 billion, alongside an indictment of the alleged head of a group accused of running forced-labour scam compounds in Cambodia. The defendant had not been tried.

Criminals adapt. The FATF reported in 2026 that, after an issuer froze over US$29 million, a group linked to scam activity launched its own stablecoin marketed as immune to freezing. Institutions cannot rely on issuer freezes alone.

Shared ledgers and AI as defences

Shared ledgers. The FATF's 2021 report on new technologies found distributed ledger technology less widely adopted for anti-money laundering than other tools. It said a shared ledger across institutions could greatly increase monitoring possibilities, with appropriate safeguards, and noted financial institutions in China using it to share watch lists and red flags. The BIS's Project Mandala (2024) tested "compliance by design" for cross-border payments, producing proofs that a payment meets rules such as sanctions screening without revealing the underlying customer data. It was an experiment, and it addressed compliance rather than fraud directly.

Machine learning across institutions. The BIS's Project Aurora (2023) did not use a blockchain. It tested machine learning and privacy-enhancing technologies on synthetic payment data, comparing institutions working alone, a national view and a cross-border view. In that experiment:

• rule-based monitoring found at most about 25% of the money laundering networks when each institution looked only at its own data;
• machine learning models found more than twice as many, and a graph neural network found about 80% with a cross-border view;
• most supervised models produced substantially fewer false positives than the rule-based benchmark.

These are results on synthetic data with models that were not fine-tuned, not a promise for live systems. They show why pooled data and network analysis matter, and why legal routes for sharing are important.

Governance. Aurora's authors warn that opaque "black box" models risk unfair or discriminatory results, and call for model governance, an inventory, ongoing evaluation and a balance between performance and explainability. The FATF says institutions must be able to "explain, and remain responsible for" their tools, and that human input remains very important.

The EU AI Act. AI used to assess creditworthiness is classed as high-risk, but the Act exempts AI used to detect financial fraud from that category, and its recitals say fraud detection in financial services should not be treated as high-risk. That does not leave fraud AI unregulated: data protection law, sector rules and other parts of the Act can still apply.

AI-enabled fraud, and what to do

Criminals are adopting AI. Europol's 2026 threat assessment says online fraud is the fastest-growing area of organised crime, and that criminal use of agentic AI, systems that can carry out tasks with little human involvement, is set to raise the threat to new levels. It describes voice chatbots screening potential victims at industrial scale, and criminals using jailbroken AI models to write code and call-centre scripts. The FATF's 2026 update reports fake profiles and deepfake job interviews used to make victims install malware or grant wallet access, and warns that AI coding tools may help attackers find smart contract weaknesses and write exploits. The FBI's 2025 report recorded over US$890 million in reported losses in complaints that mentioned AI, and notes that many victims do not realise AI was involved.

What institutions can do:

• Watch the money path into crypto: sudden first-time transfers to exchanges, savings cashed in, loans taken to invest, and "fee" payments to release profits.
• Warn at the right moment, with specific messages about investment and recovery scams.
• Act fast on freezes and recalls, and cooperate with exchanges, stablecoin issuers and law enforcement.
• Check smart contract risk before engaging with DeFi services: independent audits, monitoring and incident response plans, as the FBI recommends, remembering that an audit is not a guarantee.
• Govern your own AI: explainable, monitored, with human review of significant decisions.
• Build investigative skills for AI-enabled fraud, as the FATF urges authorities to do.

In Kenya: the Virtual Asset Service Providers Act, 2025, in force from 4 November 2025, requires licensed providers to act with integrity, prohibits them from offering mixing or other anonymity-enhancing services and from misleading clients, and bars issuing or promoting a virtual asset offering without regulatory approval; offences carry fines of up to KSh 10 million and up to five years in prison for individuals. The Computer Misuse and Cybercrimes Act makes computer fraud an offence punishable by a fine of up to KSh 20 million and up to ten years in prison. In September 2026 the Capital Markets Authority cautioned the public against investment schemes, several crypto-branded, operating unlawfully, and urged victims to report to the Directorate of Criminal Investigations. The Central Bank's 2015 caution on virtual currencies predates the 2025 Act. Check the current law and any regulations made under the Act.

Your certificate of completion

Enter your name as you want it to appear, then save the certificate as a PDF. In the print window, choose Save as PDF. A certificate is issued once per completion of the course.

Saolix does not record who takes this course, so it cannot verify these certificates. The certificate confirms completion of a free self-paced course and is not an accredited qualification.