This is the GACS annual state of the crypto-scam economy. It is built from three sources: the GACS public blacklist (250,000+ verified scam entities — wallets, domains, phone numbers, broker names), victim reports submitted through gacs.app across 40+ countries, and on-chain tracing of the largest deposit-funnel wallets feeding pig-butchering, fake-broker, and recovery-scam operations.
Press, researchers, and educators are welcome to cite any figure in this report. Methodology notes are at the bottom; the underlying anonymized dataset is queryable at gacs.app/data.
The headline numbers
- $75B+ stolen via pig-butchering since 2020 — making it the single largest crypto-fraud category in history, larger than all exchange hacks and ransomware combined over the same period.
- $1T+ in total global scam losses in 2025, of which an estimated 38% are crypto-denominated at the moment of theft (even when the victim's first dollar was fiat).
- 250,000+ verified scam entities in the GACS blacklist at the time of writing, growing by roughly 9,400 new entities per month.
- 64% of all new pig-butchering deposit wallets in 2025 received USDT on the Tron (TRC-20) network. Ethereum mainnet has fallen to ~14%. Solana has risen sharply, now at ~11%.
- The median victim loses $54,000. The mean is $187,000 — pulled up by a long tail of life-savings losses above $1M.
- Median time from first scammer contact to first deposit: 17 days. From first deposit to total loss: 41 days.
- Median victim age: 47. This is *not* an elderly-person scam. Knowledge workers aged 35–60 are the modal victim.
- 76% of victims are men. Among romance-investment hybrids (the fastest-growing sub-category) the gender ratio inverts to 58% women.
- Less than 4% of stolen funds are ever recovered. Of the recoveries that do happen, 92% occur within the first 72 hours of the loss being reported to the right agency.
The 14 patterns that explain almost everything
Across hundreds of thousands of reports, the global scam economy resolves to 14 distinct operational patterns. Every individual scam most readers will encounter is a variation of one of these, or a hybrid of two.
### 1. Pig butchering (Shā Zhū Pán)
Long-con investment fraud. Romantic or business pretense, weeks of grooming, fake trading platform, fake profits, "tax" exit trap. Still the single largest category by USD stolen. Operations are largely run from compounds in Cambodia, Myanmar (Shwe Kokko, KK Park), Laos (Golden Triangle SEZ), and the Philippines, staffed by trafficked workers from across Asia. The U.S., U.K., Germany, Australia, and Singapore are the top victim countries by dollar volume.
### 2. Fake brokers and cloned exchanges
Slick websites and apps that mimic real regulated brokers (or clone Binance, Coinbase, Kraken). Often advertised through Google Ads on competitor brand searches. Median time between domain registration and first victim deposit: 23 days. Highest concentration of operators: Israel/EU border regions, Eastern Europe, and an emerging cluster in Dubai-registered shell entities.
### 3. Recovery scams (the second slaughter)
Operators who target *already-victimized* users with offers to "recover" lost funds for a retainer. Almost always run by the same network that ran the original scam (data from the original platform is recycled or sold). GACS sees an average of 3.4 recovery-scam contacts per victim within 12 months of the first loss. Total dollar volume of recovery scams in 2025: $2.1B, virtually all of it pure loss.
### 4. Romance scams (pure variant)
Long-term emotional manipulation ending in direct money requests rather than fake-platform investment. Now frequently AI-augmented: deepfake video calls, voice-cloned voicemails, AI-generated photo sets. Median victim age skews older (54) and female (61%). Tinder, Hinge, Facebook Dating, and increasingly Instagram DMs are the top entry vectors.
### 5. Wrong-number / "Hi, is this Linda?" texts
The cheapest, highest-volume top-of-funnel for pig-butchering. Bulk SMS to scraped phone lists. Conversion to a sustained chat: roughly 0.4%. Conversion from chat to first deposit: roughly 6% of those chats. Total funnel: ~1 in 4,200 raw texts results in a paying victim — economically viable at SMS prices of $0.001 per message.
### 6. Approval phishing & wallet drainers
Drainers like Inferno, Pink, Angel, and successor kits trick users into signing setApprovalForAll or Permit2 transactions that empty wallets in a single follow-up sweep. Distributed primarily via fake airdrop sites, hijacked X accounts, and search ads on token names. 2025 drainer revenue: ~$610M, down slightly from 2024 due to better wallet UX warnings. The single largest day in drainer history was a hijacked verified X account in March 2025 — $24M drained in 9 hours.
### 7. Address poisoning
Attackers send dust transactions from wallet addresses that share the first and last four characters of an address the victim has paid before. Users copy from history, send to the lookalike. Median per-incident loss: $11,400. Total 2025 losses estimated at $190M, almost all from sophisticated DeFi users — this scam disproportionately hits *experienced* crypto users.
### 8. Telegram / WhatsApp investment groups
"Mentor" group with one real victim, dozens of bot sockpuppets, paid actors as "whales", and a single assistant handling onboarding. Funnels into either pig-butchering platforms (Cat 1) or pump-and-dump token launches (Cat 11). WhatsApp overtook Telegram as the top vector in mid-2025. Average group size: 187 numbers. Average successful conversion: 4.1 paying victims per group.
### 9. Job offer / task scams
"Easy remote work — review hotels and earn $100/day." Victim is onboarded to a fake task platform, completes small tasks, sees small balance grow, is asked to "deposit to unlock higher-tier tasks." Same exit-trap mechanics as pig-butchering. The fastest-growing category in 2025 (+340% YoY by report volume), now the dominant scam targeting victims aged 22–34 globally.
### 10. Fake giveaways and impersonation
"Elon Musk doubles your ETH", verified-X-account hijacks promoting fake token drops, fake celebrity Instagram accounts. Mechanically simple, persistent because of constant social-media verification failures. Total 2025 volume: $420M, dropping slowly as X's verification trust collapses.
### 11. Pump and dumps / coordinated rugs
Pre-mined token, coordinated launch, paid influencer push, exit liquidity from retail. The Solana memecoin ecosystem accounted for ~71% of all rug-pulled USD value in 2025. Average lifespan from launch to rug: 47 hours. Average victim loss per rug: $1,840 — small individually, vast in aggregate ($2.8B in 2025).
### 12. Tech support / "your wallet is compromised"
Fake browser pop-ups, fake Coinbase / MetaMask support calls, often via Google Ads on "metamask support" queries. Target demographic skews older. The fastest path to a total wallet drain — median time from first contact to drain: 38 minutes.
### 13. SIM swap / account takeover
Carrier-side phone-number theft to bypass SMS 2FA. Highest-impact category per incident: median loss $164,000. Concentrated against high-net-worth crypto holders. Mitigation is straightforward (hardware 2FA, carrier port-out PIN) but adoption is still under 30% even among self-custody users.
### 14. State-sponsored DPRK operations
The Lazarus Group and successor units stole ~$1.7B in 2025, primarily through cross-chain bridge exploits, exchange compromises, and increasingly social-engineering of crypto-firm employees (fake job offers via LinkedIn, malware-laden "test assignments"). Distinct from retail scams in that the target is *infrastructure*, not individuals — but the laundered funds eventually exit through retail-facing OTC desks, contaminating the broader ecosystem.
What's growing fastest
Year-over-year growth rates for major categories (2025 vs 2024, by report volume):
- Job/task scams: +340%
- AI voice cloning family scams: +260%
- WhatsApp investment groups: +180% (Telegram: -22%)
- USDT-TRC20 deposit wallets: +71%
- Solana-denominated scams: +220%
- Recovery scams: +94%
- Romance-investment hybrids with deepfake video: +410%
- Approval phishing: -8% (the only category in measurable decline, attributed to wallet UX improvements)
Where the money goes
Tracing the largest 1,000 pig-butchering deposit funnels in our dataset:
- 48% flows to OTC desks in Hong Kong, Dubai, and selected Eastern European jurisdictions within 30 days of victim deposit.
- 22% routes through Tron-native mixers and OFAC-sanctioned services (Garantex remains the largest single off-ramp by volume despite sanctions).
- 14% terminates at exchanges that enforce no meaningful KYC, primarily a small group of offshore platforms.
- 9% is converted to physical assets — gold, real estate, luxury vehicles — typically in Southeast Asia or the Gulf.
- 7% remains observably idle in cold wallets controlled by upstream operators, often for years.
The implication for victims: funds become practically unrecoverable within 48–72 hours of deposit. Speed of reporting is the single largest predictor of recovery.
The geography
Top 10 victim countries by total USD lost in 2025 (estimated):
- United States — $14.2B
- United Kingdom — $4.8B
- Germany — $3.6B
- Australia — $3.1B
- Canada — $2.4B
- Singapore — $1.9B
- Netherlands — $1.4B
- France — $1.3B
- Switzerland — $1.1B
- Japan — $0.9B
Top operational origins (based on infrastructure, language artifacts, and law-enforcement attribution):
- Cambodia (Sihanoukville, Bavet) — pig butchering
- Myanmar (KK Park, Shwe Kokko) — pig butchering, job scams
- Laos (Bokeo SEZ) — pig butchering
- Philippines (Manila, Pampanga) — POGO-adjacent operations
- Israel/EU — fake broker rings (the legacy "binary options" ecosystem)
- Russia/Eastern Europe — drainers, ransomware-adjacent fraud
- Nigeria/Ghana — romance scams (traditional, evolving toward crypto)
What actually works (and what doesn't)
From our victim follow-up surveys (n=11,400 in 2025), interventions ranked by self-reported effectiveness:
Works: 1. Reporting to the receiving exchange's compliance team within 24 hours — partial fund freeze achieved in 11% of cases. 2. Bank wire recall within 72 hours — partial recovery in 8% of cases. 3. Casualty/theft tax deduction — recovers 20–40% of loss for most filers in jurisdictions where allowed (US, UK, Canada, Australia). 4. Family safe-word protocol (preventive) — prevented loss in 94% of attempted voice-cloning calls in households that had set one up. 5. Pre-transaction wallet/URL checks (preventive) — reduces successful scam contact-to-deposit conversion by ~73%.
Does not work: 1. Paying any "recovery agent" — net loss in 100% of cases tracked. 2. "Negotiating" with the scammer once the slaughter has begun — zero recoveries in 14,000+ reported attempts. 3. Posting wallet addresses publicly hoping the receiving exchange "notices" — exchanges only act on direct compliance-channel reports. 4. Filing only with local police without also filing with the national fraud agency — local police almost never have jurisdiction; national agencies do.
The five recommendations
For policymakers, regulators, exchanges, and platforms reading this:
- Mandate STIR/SHAKEN-equivalent call verification in every major telecom market. The wrong-number text funnel collapses without it.
- Require KYC parity at the OTC-desk layer, not just at user-facing exchanges. Most stolen funds currently exit through under-regulated OTC channels.
- Set a 24-hour mandatory freeze window for flagged inbound deposits at major exchanges, on the model of bank wire recall rules.
- Fund national fraud agencies at parity with traditional crimes-of-violence agencies. Most national fraud bodies are an order of magnitude underfunded relative to the dollar volume of crime they cover.
- Treat AI voice cloning as a regulated dual-use technology. Watermarking and provenance standards at the model level are technically feasible and would close the highest-growth attack surface in this report.
For individuals:
- WhatsApp → Settings → Privacy → Groups → My Contacts. Closes 80% of WhatsApp scam group cold-adds.
- Set a family safe word today. Tell every family member. Closes the AI voice-cloning vector.
- Bookmark exchange URLs. Never type, never search. Closes the cloned-exchange vector.
- Run every URL and wallet through a free check (GACS Safe Scanner, Wallet Checker) before any action over $100. Four seconds, closes most of the remaining vectors.
- If something has already happened: stop sending. Don't pay the "tax." Don't pay a "recovery agent." Report within 24 hours.
Methodology
The GACS blacklist is built from three sources: (1) verified victim reports submitted through gacs.app, cross-validated against on-chain evidence where applicable; (2) public regulator warning lists from the FCA (UK), SEC and CFTC (US), ASIC (Australia), CNMV (Spain), CSSF (Luxembourg), AMF (France), BaFin (Germany), MAS (Singapore), and 30+ peer agencies; (3) reputable open-source scam databases with which GACS exchanges data, including aggregated feeds from CertiK, Chainabuse, and the Global Anti-Scam Organization.
Loss figures combine victim self-report (with the well-known under-reporting bias adjusted using the FTC's 2023 underreporting study, which estimated that fewer than 5% of fraud incidents are reported to authorities) with aggregate Chainalysis, TRM Labs, and Elliptic published estimates. Where ranges existed, midpoint estimates are used unless otherwise stated.
Growth rates use a constant-cohort methodology: only category definitions stable across both 2024 and 2025 datasets are compared. Geographic attribution at the operational level uses a combination of language artifacts in scam scripts, infrastructure registration data, and published law-enforcement attribution; it is necessarily probabilistic.
How to cite this report
GACS (2026). *State of Crypto Scams 2026.* Global Anti-Crime & Safety. https://gacs.app/blog/state-of-crypto-scams-2026
Press inquiries: hello@gacs.app. We provide quotes, additional cuts of the data, and country-specific figures on request. Researchers can query the anonymized underlying dataset at gacs.app/data.
The dataset is alive
This report will be re-issued annually. The underlying blacklist updates continuously — every victim who files a report at gacs.app/report adds another entity, another wallet, another phone number that the next person searching it will see flagged. The total cost of running and publishing this data is zero to the victim and zero to the public. That is intentional.
If you found this report useful: link to it, cite it, share it with your fraud team or your regulator. The single most important variable in collapsing this $1T economy is whether the data is in the hands of the people about to be its next victim.
