On September 3, the Treasury's Financial Crimes Enforcement Network published an analysis with a number that deserves more attention than it got: nearly $13 billion in financial activity tied to suspected digital-asset investment scams, drawn from 33,904 Bank Secrecy Act reports filed by U.S. financial institutions between September 2023 and the end of 2025. The activity touched all 50 states and several U.S. territories.

It's worth sitting with what this number is, and isn't. It's not a hack. Nothing here involves a smart-contract exploit, a bridge vulnerability, or a hardware-wallet firmware bug — the categories that dominate ChainBrief's security coverage and most crypto headlines generally. This is people being deceived by other people, at a scale that dwarfs the technical failures.

The playbook

FinCEN's report groups the activity into three overlapping scam types: "pig butchering" schemes, where a scammer builds a long-term relationship (often romantic) before introducing a fraudulent investment platform; "romance baiting," the relationship-first variant; and more generic cryptocurrency confidence schemes. The common mechanism across all three is a fake persona and sustained social engineering, aimed at getting a victim to move funds into wallets or platforms controlled by the scammer — often gradually, with fabricated "returns" shown along the way to encourage larger transfers.

Why the scale matters more than any single case

Compare FinCEN's roughly $13 billion figure to the crypto industry's own hack-loss tracking: researchers estimate 2026's on-chain exploits — everything from DeFi protocol bugs to the year's highest-profile hardware wallet and sidechain incidents — at around $2.2 billion year to date. Scam losses aren't a rounding error next to hack losses; they're roughly six times larger. That's a hard reframe for an industry whose security conversation is dominated by audits, bug bounties, and multisig setups — all of which do essentially nothing against a scammer who convinces someone to send funds voluntarily.

What FinCEN is asking banks — and victims — to do

The recommendations are aimed mostly at financial institutions: watch for a specific set of red flags associated with scam-center activity, and use the voluntary information-sharing protections under Section 314(b) of the USA PATRIOT Act to compare notes across institutions rather than each bank fighting the pattern in isolation. For individuals, the guidance is more basic — contact your bank immediately, file a complaint with the FBI's Internet Crime Complaint Center, or reach out to a U.S. Secret Service field office. None of that recovers stolen funds reliably, which is itself the point: prevention and early detection are doing almost all of the real work here, because after-the-fact recovery on cross-border crypto scams is rare.

Why it matters more than another hack headline

ChainBrief covers a lot of hacks and exploits because they're technically interesting and because the dollar figures are easy to verify on-chain. But this report is a reminder that the bigger threat to ordinary people's money isn't a bug in a smart contract — it's a patient human being on the other end of a chat app, over weeks or months, building exactly the kind of trust that makes someone ignore their own better judgment. No audit, bug bounty, or multisig setup defends against that, because the victim is the one authorizing the transfer. The practical takeaway is boring but real: unsolicited investment advice from someone you met online, especially anyone who won't get on a video call or meet in person, is the single highest-value red flag in this entire dataset — far more predictive than any technical signal ChainBrief would normally cover. It's also a reminder for anyone with an older or less online-savvy family member holding crypto: the conversation worth having isn't about seed phrases or hardware wallets, it's the plainer one about never moving money for someone met exclusively online, no matter how long the relationship has gone on or how legitimate the pitch sounds. It also complicates the usual policy response to crypto fraud, which tends to focus on exchange-level controls and on-chain monitoring — tools built to catch a hack in progress, not to catch a victim who is willingly, if unknowingly, wiring their own funds to a scammer over the course of months. FinCEN's own advisory leans harder on financial institutions flagging behavioral patterns, like a customer suddenly asking about crypto transfers after months of ordinary banking activity, precisely because the technical signals this industry usually relies on don't apply here. That puts more weight on the human side of the fraud-prevention chain — bank tellers, customer-support reps, even friends and family — noticing a pattern of behavior long before any blockchain analytics tool would ever flag the destination wallet as suspicious.

Further reading

Frequently asked

Is this $13 billion only from 2026?

No — the figure covers Bank Secrecy Act reports filed between September 2023 and the end of 2025, so it's a multi-year total, not a single-year figure.

Can victims get their money back?

Rarely, and not reliably. Once funds move into a scammer's wallet or through cross-border exchanges, recovery is difficult; FinCEN's own guidance focuses mostly on prevention and early detection rather than after-the-fact recovery.

What's the difference between "pig butchering" and "romance baiting"?

They overlap heavily — both involve a scammer building a long-term relationship with a victim before introducing a fraudulent investment. "Romance baiting" specifically emphasizes the romantic angle, while "pig butchering" is the broader term for the slow, trust-building con regardless of whether romance is involved.