Crypto Crime Report 2026: The Five Threat Models That Matter Most to Normal Users
Every year, chain analytics firms and law enforcement agencies publish figures on crypto-related crime. The numbers are large, the charts are dramatic, and the headlines write themselves. What gets lost is practical translation: which of these threats actually touch a person holding crypto in a self-custody wallet or on a regulated exchange, and what can they do about it?
The 2026 data -- drawn from Chainalysis, TRM Labs, Elliptic, and public enforcement disclosures -- paints a picture of a threat landscape that has shifted meaningfully from even two years ago. Rug pulls and ICO fraud have receded as dominant categories. In their place, five threat models now account for the overwhelming majority of losses suffered by ordinary users. Understanding these five categories, the mechanics behind each, and the realistic defensive options available is more useful than any aggregate crime statistic.
For deeper context on exchange-specific risks, see our ongoing Exchange Watch coverage.
Threat Model 1: Exchange Insolvency and Fraud
The collapse of FTX in late 2022 was the watershed event, but it was not the last. The pattern has repeated at smaller scales: an exchange commingles customer funds, takes directional risk with those funds, suffers losses, and then either halts withdrawals or reveals that assets are not where they were supposed to be. The 2025-2026 enforcement cycle has seen several smaller platforms shut down or enter receivership across Southeast Asia and the Middle East.
Chain analytics data from 2025 shows that approximately $2.3 billion in customer deposits were locked on platforms that subsequently failed or were seized. That figure excludes FTX recovery distributions still in process. The distinguishing characteristic of this threat is that users did nothing wrong -- they deposited funds on what appeared to be a functioning exchange, and the platform itself was the point of failure.
Mechanism
Exchange fraud typically follows a progression. Phase one involves legitimate operation to build deposits and trust. Phase two introduces commingling -- customer assets begin funding market-making operations, venture investments, or executive compensation. Phase three is the liquidity crunch, where a market downturn exposes the gap between liabilities and assets. Phase four is the withdrawal freeze, followed by either a controlled wind-down or a chaotic collapse.
The difficulty for users is that phase two is invisible from the outside. Proof-of-reserves attestations help but remain imperfect, particularly when they capture a point-in-time snapshot that the exchange may have prepared for.
Defensive Measures
Limit exposure to any single custodial platform. Verify that the exchange publishes regular proof-of-reserves with a reputable auditor. Favour platforms operating under regulatory regimes that require asset segregation. Move long-term holdings to self-custody. Monitor withdrawal processing times -- delays are often the first public signal of liquidity stress.
Threat Model 2: AI-Enabled Social Engineering
Social engineering has always been part of the crypto crime toolkit. What has changed in 2025-2026 is the quality and scalability of the attacks. Generative AI has reduced the cost of producing convincing phishing content to near zero, and real-time voice cloning has enabled a new class of impersonation attack that targets both retail users and exchange employees.
TRM Labs flagged AI-assisted social engineering as the fastest-growing attack category in their 2026 threat assessment. Reported losses attributable to AI-enhanced scams exceeded $1.1 billion globally in 2025, a figure that almost certainly understates the actual total given underreporting.
We covered the technical mechanics of these attacks in detail in our piece on AI impersonation scams. The core concern is that traditional verification methods -- recognizing a voice, checking an email address, verifying a video call -- are no longer reliable when generative models can reproduce all of these with high fidelity.
Mechanism
The attack surface is broad. Common vectors include: deepfake video calls impersonating exchange support staff or investment advisors; AI-generated phishing emails that are contextually accurate and grammatically flawless; voice clone calls that mimic known contacts requesting urgent fund transfers; and fake customer support channels on social platforms that use AI chatbots to guide victims through sending funds to attacker-controlled addresses.
The scalability is the problem. A single attacker can now run hundreds of simultaneous social engineering campaigns with personalized content for each target.
Defensive Measures
Establish out-of-band verification for any request involving fund movement. Use a pre-agreed code word with close contacts. Never act on urgency -- legitimate entities do not require immediate crypto transfers. Enable withdrawal address whitelisting with time-locked changes on every exchange account. Treat any unsolicited communication about your crypto holdings as hostile until independently verified.
Threat Model 3: Physical Targeting
The $5 wrench attack -- the idea that physical coercion bypasses any amount of cryptographic security -- has moved from theoretical meme to documented pattern. Reported physical attacks on crypto holders increased sharply through 2025, with incidents documented across Europe, Latin America, Southeast Asia, and North America.
Our earlier coverage of physical security threats details the incident data and risk factors. The pattern is consistent: attackers identify a target believed to hold significant crypto, conduct physical surveillance or use publicly available data to locate them, and then use threats or violence to compel wallet access.
Mechanism
Targeting intelligence comes from several sources. Social media posts displaying wealth or discussing holdings. Conference attendance lists and speaker bios. On-chain analysis linking pseudonymous addresses to real identities through exchange KYC leaks or careless operational security. In some cases, insiders at exchanges or OTC desks have provided customer information to criminal groups.
The attack itself is straightforward: home invasion, street robbery, or kidnapping, followed by compelled unlocking of devices and wallet transfers. Multisig setups and time-locked vaults provide some protection, but only if the attacker believes that the target genuinely cannot access funds immediately.
Defensive Measures
Operational security is the primary defence. Do not disclose holdings publicly. Use a decoy wallet with a small balance that can be surrendered under duress. Implement multisig or social recovery schemes that require cooperation from geographically distributed parties. Consider time-locked vaults for large holdings. Avoid predictable routines when traveling to and from crypto-related events. Separate your public identity from your on-chain activity.
Threat Model 4: Approval and Signature Phishing
This is the most technically specific threat on the list, and the one most likely to catch users who consider themselves sophisticated. Approval phishing exploits the mechanics of token approvals on EVM-compatible chains and, increasingly, similar permission models on other networks. The victim signs a transaction that grants the attacker permission to move their tokens -- and then the attacker drains them.
Chainalysis data for 2025 attributed over $900 million in losses to approval phishing, making it one of the single largest categories of direct theft. The technique is distinct from traditional phishing because the victim interacts with what appears to be a legitimate smart contract interface. The malicious element is the scope of the approval being granted, not the site itself -- though in many cases the site is also fraudulent.
Mechanism
The typical flow works as follows. The victim visits a website -- often a convincing clone of a legitimate DeFi protocol, or a new site promoted through social media -- and connects their wallet. The site prompts a transaction for signature. The transaction contains a token approval granting an attacker-controlled address unlimited spending rights over a specific token, or in the case of permit-based attacks, a gasless signature that achieves the same result. Once signed, the attacker can drain the approved tokens at any time, often waiting until the balance increases before sweeping.
The permit2 pattern, widely adopted for user convenience, has expanded the attack surface by enabling single-signature approvals covering multiple tokens. EIP-712 typed data signing makes it harder for users to understand what they are authorizing.
Defensive Measures
Revoke unnecessary token approvals regularly using tools like Revoke.cash. Never grant unlimited approvals -- set specific amounts when interacting with protocols. Use a dedicated wallet for DeFi interactions, separate from your primary storage wallet. Read transaction details before signing -- if a site asks for an approval to an address you do not recognize, reject it. Consider hardware wallets that display transaction details for review before signing. Be especially cautious with permit signatures, which can authorize spending without an on-chain approval transaction.
Threat Model 5: Bridge and DeFi Exploit Contagion
The final threat model differs from the others in that users can be affected without making any direct mistake. Bridge exploits and DeFi protocol hacks damage users who have deposited funds into the affected protocol, and in severe cases, the contagion spreads to tokens and protocols with exposure to the compromised system.
The 2025 data from Elliptic and Chainalysis shows bridge and DeFi exploits accounting for approximately $1.8 billion in losses. While this is down from the peak years of 2022-2023 in percentage terms, the absolute numbers remain substantial. The attack surface has shifted from bridge contract vulnerabilities toward oracle manipulation, governance attacks, and economic exploits that are harder to detect through code audit alone.
Mechanism
Bridge exploits typically target the validation mechanism that confirms cross-chain transactions. A compromised validator set, a faulty proof verification, or an upgradeable contract with insufficient access controls can allow an attacker to mint unbacked tokens on the destination chain or drain locked assets on the source chain. The consequences cascade: the bridged token depegs, liquidity providers suffer losses, and any protocol holding the depegged asset takes a balance sheet hit.
DeFi exploits follow a broader range of patterns -- flash loan attacks manipulating price oracles, reentrancy bugs, logic errors in liquidation mechanisms, and governance takeovers where an attacker accumulates enough voting power to pass a malicious proposal. The common thread is that users who deposited funds into the protocol in good faith lose some or all of their deposit through no individual action of their own.
Defensive Measures
Diversify across protocols and chains rather than concentrating in a single DeFi position. Favour protocols with longer track records, multiple independent audits, and active bug bounty programs. Understand the difference between audited and battle-tested -- a clean audit report does not guarantee security. Monitor protocol governance for unusual activity. Use circuit breaker tools or DeFi insurance protocols where available, while understanding their limitations and exclusions. When using bridges, prefer those with decentralized validator sets and transparent security incident histories.
The Aggregate Picture
These five threat models are not equally distributed. Exchange insolvency risk disproportionately affects users in less-regulated jurisdictions. AI social engineering scales globally but hits hardest where crypto literacy is lower. Physical targeting concentrates on high-net-worth holders in specific geographic areas. Approval phishing targets active DeFi users on EVM chains. Bridge exploits affect users who actively interact with cross-chain protocols.
For a user who holds crypto on a single regulated exchange and does not interact with DeFi, the primary threats are exchange insolvency and AI social engineering. For a DeFi-active user with self-custody, the primary threats shift to approval phishing and protocol exploits. For a high-profile holder, physical security rises in priority.
The chain analytics data confirms that the total addressable victim pool has grown as crypto adoption has expanded, but the composition of attacks has shifted toward more sophisticated, harder-to-detect methods. The era of obviously fraudulent ICOs and blatant Ponzi tokens has given way to technically proficient attacks that require a corresponding increase in user awareness and defensive practice.
Cross-Cutting Defensive Principles
Across all five threat models, several principles apply universally:
Compartmentalize. Use separate wallets for different functions -- cold storage, exchange deposits, DeFi interaction, and daily transactions. A compromise of one compartment should not cascade to the others.
Verify independently. Never trust a single channel of communication. Confirm exchange solvency through multiple sources. Verify contract addresses through official channels. Authenticate contacts through pre-established methods.
Minimize exposure. Do not leave more value on any platform than necessary for your intended activity. Do not grant more permissions than a transaction requires. Do not share more personal information than a service demands.
Stay current. The threat landscape evolves faster than annual reports can capture. Follow chain analytics research, security researcher disclosures, and enforcement actions as they happen, not as year-end summaries.
Accept residual risk. No combination of measures eliminates all risk. The goal is to reduce the probability and blast radius of each threat model to an acceptable level, not to achieve perfect security. Anyone claiming their product or method provides complete protection is selling something.
FAQ
Which threat model causes the most total dollar losses?
Based on 2025 data, bridge and DeFi exploits account for the largest single category at approximately $1.8 billion. However, exchange insolvency can produce larger individual events -- a single major exchange collapse can exceed the annual total of all DeFi exploits combined.
Are hardware wallets sufficient to protect against all five threats?
No. Hardware wallets protect private keys from remote extraction but do not defend against approval phishing (the user still signs the malicious transaction), physical coercion (the attacker compels the user to sign), or exchange insolvency (the user's assets are on the exchange, not in their wallet). They are one component of a broader security strategy.
How reliable are crypto crime statistics?
Underreporting is significant. Chain analytics firms can only track on-chain activity, and many scams involve off-chain social engineering where the final transfer appears voluntary. Enforcement agencies rely on victim reports, which many people never file. Published figures should be treated as lower bounds.
Do these threat models apply equally to Bitcoin and Ethereum users?
The distribution varies. Approval phishing is predominantly an EVM-chain issue due to the token approval mechanism. Bridge exploits affect multi-chain users. Exchange insolvency, AI social engineering, and physical targeting are chain-agnostic -- they affect holders regardless of which assets they own.
What is the single most impactful defensive action for a normal user?
Moving the majority of holdings to self-custody with a hardware wallet and keeping only trading amounts on exchanges. This single action substantially reduces exposure to exchange insolvency -- historically the largest single source of user losses -- while maintaining the ability to trade when needed.