International Law Enforcement Freezes $12 Million and Identifies 20 K Victims in Crypto Approval‑Phishing Scam
What Happened — An international operation led by the UK National Crime Agency (Operation Atlantic) coordinated investigators from the US, UK and Canada to dismantle cryptocurrency‑based approval‑phishing scams. The effort froze more than $12 million in illicit funds and identified over 20,000 victims, while uncovering an additional $45 million in suspected fraud losses worldwide.
Why It Matters for TPRM —
- Crypto‑related fraud now accounts for $7.2 billion of the $11.3 billion total fraud losses reported by the FBI, highlighting a systemic risk to any third‑party that processes or stores digital assets.
- The operation demonstrates that private‑sector partners (exchanges, wallet providers, KYC services) are critical points of failure; weaknesses there can expose your organization’s customers to massive financial loss.
- Ongoing, cross‑border phishing campaigns suggest continuous threat pressure; vendors must maintain real‑time monitoring and rapid response capabilities.
Who Is Affected — Financial services, crypto‑exchange platforms, digital‑asset custodians, fintech SaaS providers, and any organization that integrates cryptocurrency payments or wallet services.
Recommended Actions —
- Review contracts with crypto‑payment processors and custodial services for mandatory anti‑phishing controls and incident‑response clauses.
- Verify that vendors employ real‑time transaction monitoring, AML/KYC verification, and multi‑factor authentication for wallet approvals.
- Conduct a risk assessment of approval‑phishing exposure across your supply chain and require evidence of phishing‑resilience testing.
Technical Notes — The scams leveraged approval‑phishing: attackers sent convincing messages that prompted victims to approve a cryptocurrency transfer, effectively handing over wallet control. No specific CVE or software vulnerability was disclosed; the vector is purely social engineering. Victim data included wallet addresses, transaction IDs, and personal identifiers collected during the phishing process. Source: Help Net Security