April 9, 2026

TRM Labs Supports Operation Atlantic: USD 12 Million Frozen and 20,000 Victims Identified in International Crackdown on Crypto Scammers

TRM Team

TRM Labs Supports Operation Atlantic: USD 12 Million Frozen and 20,000 Victims Identified in International Crackdown on Crypto Scammers

Key takeaways

Operation Atlantic, led by the UK's National Crime Agency and co-hosted by the US Secret Service, Ontario Provincial
Police, and Ontario Securities Commission, targeted cryptocurrency approval phishing scams across three countries
More than USD 12 million in suspected criminal proceeds has been frozen, with over USD 45 million in stolen cryptocurrency identified worldwide
More than 20,000 victims were identified across the UK, Canada, and the United States
TRM Labs supported the operation from planning through execution, providing blockchain intelligence, on-chain tracing, and real-time victim identification

Today the UK's National Crime Agency (NCA) announced the results of Operation Atlantic, a weeklong international law enforcement sprint targeting criminals who steal cryptocurrency through a technique known as approval phishing.

The operation, co-hosted by the NCA, US Secret Service, Ontario Provincial Police, and Ontario Securities Commission, brought together investigators, analysts, and private sector partners at the NCA's London headquarters for a concentrated effort to identify victims, trace stolen funds, and disrupt active fraud networks.

TRM Labs was proud to support this operation as a private sector partner, providing blockchain intelligence and investigative expertise throughout.

What is approval phishing?

Approval phishing is a form of cryptocurrency fraud in which victims are manipulated into signing a blockchain transaction that grants a scammer control over their wallet. Unlike traditional phishing, where an attacker steals login credentials, approval phishing exploits the technical permissions built into smart contracts. Once a victim unknowingly approves access, the attacker can drain funds at will.

These schemes are often wrapped inside investment scams or romance fraud, where victims have been groomed over weeks or months before being directed to a malicious site. Many victims do not realize their funds have been compromised until long after the approval was signed.

How Operation Atlantic worked

Operation Atlantic followed a sprint model: an intensive, time-bound operational push in which law enforcement agencies and private sector partners work side by side in real time. Over the course of the week, teams at the NCA's London headquarters combined blockchain analytics, intelligence sharing, and direct victim outreach to identify and act on active approval phishing threats.

The results were significant:

More than USD 12 million in suspected criminal proceeds frozen
Over USD 45 million in cryptocurrency fraud schemes identified globally
More than 20,000 victims identified across the UK, Canada, and the United States

City of London Police, the Financial Conduct Authority, and other international law enforcement bodies also participated in the weeklong action.

TRM's role

TRM Labs supported Operation Atlantic from planning through execution. Ahead of the sprint, TRM worked with the US

Secret Service and NCA to prepare investigative workflows tailored to approval phishing typologies, so that investigators could begin triaging cases once the operation was underway.

During the week, TRM's tracing team worked alongside case officers in London, using TRM's blockchain analytics platform and intelligence from Chainabuse.com to triage thousands of addresses, identify high-risk victims, and map the movement of funds across exchanges and protocols.

That work produced multiple seizure-ready intelligence packages, including one linked to an approval phishing network responsible for more than USD 15 million in victim losses and contributed to the broader multi-million-dollar asset freezes announced by the authorities.

Crypto fraud by the numbers

Operation Atlantic is a powerful example of what coordinated action can achieve, and it underscores the scale of crypto-enabled fraud globally. TRM tracked approximately USD 35 billion in cryptocurrency flows to fraud schemes in 2025. Stablecoins now account for roughly 84% of verified fraud inflows, up from 70% in 2024, reflecting their prevalence across scam infrastructure. Fraud networks are also moving faster: many now shift stolen funds onward within 48 hours, compressing the window for intervention.

These trends make operations like Atlantic, where investigators and blockchain intelligence providers work together in real time, essential.

A model for public-private disruption

Operation Atlantic reflects a broader shift in how crypto crime is fought. Across the industry, the conversation has moved beyond public-private partnership toward public-private disruption: operational collaboration that produces real-world seizures, victim notifications, and criminal network takedowns.

The Financial Action Task Force (FATF) cited TRM's Beacon Network, which connects law enforcement agencies, exchanges, and stablecoin issuers in a shared real-time alerting system, as an example of this model. Beacon has helped freeze more than USD 330 million in illicit proceeds to date.

Operations like Atlantic build on the same principle: when investigators, analysts, and industry work in the same room with the same data, the results are tangible.

As NCA Deputy Director of Investigations Miles Bonfield said: "Operational Atlantic is a powerful example of what is possible when international agencies and private industry work side by side. This intensive action has led to the safeguarding of thousands of victims in the UK and overseas, stopped criminals in their tracks and helped save others from losing their funds."

Phil Ariss, director of UK public sector relations at TRM Labs, said: "Operations like Atlantic show what public-private disruption looks like in practice. When blockchain intelligence and law enforcement expertise come together in real time, across borders, the results are meaningful: funds frozen, victims protected, and criminal networks disrupted. TRM is proud to support the NCA, the US Secret Service, and their partners in this work."

What comes next

The NCA and its partners are now analyzing intelligence gathered during Operation Atlantic to support victims and investigate further criminal activity. For TRM, this operation demonstrates that the most effective response to crypto-enabled crime comes through sustained, cross-border, public-private collaboration.

If you have been a victim of cryptocurrency fraud, you can report it through https://www.chainabuse.com or contact your local authorities. UK residents can report fraud at https://reportfraud.police.uk or call 0300 123 2040.

Frequently asked questions (FAQs)

1. What is Operation Atlantic?

Operation Atlantic was a weeklong international law enforcement operation led by the UK's National Crime Agency (NCA) and co-hosted by the US Secret Service, Ontario Provincial Police, and the Ontario Securities Commission. It targeted criminals stealing cryptocurrency through approval phishing scams. The operation resulted in more than USD 12 million in suspected criminal proceeds frozen, over USD 45 million in fraud schemes identified globally, and more than 20,000 victims identified across the UK, Canada, and the United States.

2. What is approval phishing?

Approval phishing is a form of cryptocurrency fraud where victims are manipulated into signing a blockchain transaction that grants a scammer control over their wallet. Unlike traditional phishing that steals login credentials, approval phishing exploits technical permissions built into smart contracts. Once a victim unknowingly approves access, the attacker can drain funds at will. These schemes are often embedded in investment scams or romance fraud, where victims are groomed over weeks or months before being directed to a malicious site.

3. What role did TRM Labs play in Operation Atlantic?

TRM Labs served as a private sector partner throughout the operation, from planning to execution. Before the sprint began, TRM worked with the US Secret Service and NCA to prepare investigative workflows tailored to approval phishing. During the operation, TRM's tracing team worked alongside case officers in London, using TRM's blockchain analytics platform and intelligence from Chainabuse.com to triage thousands of addresses, identify high-risk victims, and map the movement of funds. This work produced multiple seizure-ready intelligence packages, including one linked to a network responsible for more than USD 15 million in losses.

4. How big is the crypto fraud problem globally?

TRM tracked approximately USD 35 billion in cryptocurrency flows to fraud schemes in 2025. Stablecoins now account for roughly 84% of verified fraud inflows, up from 70% in 2024, reflecting their prevalence across scam infrastructure. Fraud networks are also accelerating: many now move stolen funds within 48 hours, compressing the window for law enforcement intervention.

5. What should I do if I've been a victim of cryptocurrency fraud?

You can report cryptocurrency fraud through Chainabuse.com or contact your local authorities. UK residents can report fraud at reportfraud.police.uk or call 0300 123 2040. Early reporting helps law enforcement trace funds and potentially recover assets before they are moved beyond reach.