FATF Traces Over $100 Million in Stolen Funds Through Crypto Wallets Linked to Global Scam Networks

Blockchain analysis cited in a new Financial Action Task Force (FATF) report has mapped more than $100 million in victim payments to a cryptocurrency wallet cluster attributed to a scam compound.

Investigators followed the money through laundering networks toward cash-out points, showing how transaction tracing can expose the financial systems behind organized online fraud.

Published on November 5, 2026, the report examines scam operations across Africa, Europe, the Americas, and Asia. FATF estimates that scam compounds cause tens of billions of dollars in annual losses.

Its findings describe criminal businesses that combine social engineering, trafficking, digital infrastructure, and money laundering rather than operating as isolated groups of scammers.

Analysts from SlowMist, reviewing FATF’s findings, noted that investigators must connect wallet activity with customer records, communications, and company information.

Their analysis does not identify a malware family or a new malware campaign; it interprets FATF’s findings on scam networks and financial flows.

FATF Traces Over $100 Million in Stolen Funds Through Crypto Wallets Linked

The headline figure comes from one case described in FATF’s scam compound report, not a newly announced FATF seizure. Blockchain analysis linked more than $100 million in incoming victim funds to an attributed wallet cluster.

Tracing those transfers revealed laundering routes, but the announcement does not establish that the full amount was frozen, recovered, or returned.

Victims are often drawn into investment schemes through social media, messaging services, or relationships built over time. Fake platforms display invented profits before blocking withdrawals and demanding additional payments.

Similar mechanics appear in fake prediction market platforms that use fabricated trading results and withdrawal fees to keep victims depositing cryptocurrency. These comparisons explain the fraud model without establishing a connection between separate cases.

Once payments arrive, operators can split or consolidate funds across bank accounts, electronic wallets, cryptocurrency services, and money mule networks.

Layering means moving funds through additional transactions to make their origin harder to follow. FATF describes underground banking, over-the-counter brokers, cross-chain services, and gambling platforms among the channels that investigators may encounter.

Cryptocurrency trail

The cryptocurrency trail is only one part of the evidence. Investigators must test wallet attribution against exchange customer information, payment conversion records, device communications, and corporate ownership data.

Separate reporting on crypto investment laundering operations illustrates how shell-company accounts and stablecoin transfers can connect conventional banking with cryptocurrency wallets. A blockchain label alone should not substitute for verified ownership evidence.

Speed creates a major obstacle. FATF says instant payment systems can move scam proceeds from a victim’s account in as little as two minutes.

A bank may see an apparently authorized transfer without knowing that manipulation caused it. Meanwhile, receiving institutions may observe rapid transfers but lack the victim’s messages or the fraudulent platform’s records.

That gap makes cooperation between banks, exchanges, telecommunications providers, technology platforms, and investigators essential. FATF identifies the first 24–72 hours after detection or reporting as critical for freezing funds and recovering assets.

Its recommendations extend beyond payments to recruitment advertisements, malicious domains, communications infrastructure, and services shared across criminal operations.

The wider infrastructure matters because scam networks can replace individual accounts and relocate smaller teams. Reporting on verified financial account sales shows how criminal suppliers advertise bank, fintech, and cryptocurrency accounts as ready-made laundering resources.

Disrupting those shared providers can address capabilities that survive the closure of a single scam website or physical location. FATF also warns that AI-generated content, deepfakes, and automation help criminals reduce costs and expand their reach.

Its response framework therefore combines early disruption with transaction tracing, lawful asset preservation, and victim protection. People trafficked or forced into scam operations require screening and safeguards, rather than automatic treatment as willing participants.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context on the latest threats to stop incidents quickly -> Integrate Threat Intel from 16K SOCs

The post FATF Traces Over $100 Million in Stolen Funds Through Crypto Wallets Linked to Global Scam Networks appeared first on Cyber Security News.