Suspicious crypto rarely stays still
A payment arrives, an alert appears, and the easy response is to leave the case in a queue. Recent investigations show why that delay can matter. Fraud proceeds may be split, swapped, mixed with other funds, or moved through many wallets while a business is still deciding who should review the transaction.
The first hour is not a legal deadline and it does not guarantee recovery. It is an operational principle: stop avoidable movement, preserve what is known, review the actual wallet, and send a useful evidence package to the right people. That process is different from proving source of funds. It is incident response for a payment that has already produced a warning.
This article reviews major developments reported between November 2025 and July 2026. Sources were checked on 21 August 2026.
Six cases that explain why speed matters
November 2025: the SFO opened its first major crypto investigation
The United Kingdom Serious Fraud Office announced an investigation into the collapse of Basis Markets, a crypto scheme that had raised about $28 million. Investigators searched properties and arrested two men on suspicion of fraud and money laundering offences. The allegations remain under investigation, but the case shows that AML risk can begin with the commercial story around an investment, not only with a known illicit wallet.
Read the Serious Fraud Office announcement.
April 2026: reported crypto losses passed $11 billion
The FBI's 2025 Internet Crime Report recorded 181,565 complaints involving cryptocurrency and more than $11 billion in reported losses. The FBI advised victims to report quickly and document where funds were sent, the method of payment, dates, and the people or companies involved. That list is also a useful model for a business response record.
Read the FBI announcement and 2025 Internet Crime Report summary.
April 2026: real time tracing helped freeze $12 million
The United Kingdom National Crime Agency said Operation Atlantic identified more than 20,000 victims and froze over $12 million in suspected criminal proceeds. More than $45 million stolen in crypto fraud schemes was identified worldwide. The agency highlighted real time intelligence sharing and private sector tracing before criminals could move the assets. The lesson is practical: information becomes less useful when it reaches the right team too late.
Read the National Crime Agency report on Operation Atlantic.
June 2026: coordinated disruption froze another $3.8 million
During the United States Scam Center Strike Force's Disruption Week, information shared by government investigators enabled private companies to freeze more than $3.8 million in cryptocurrency involved in laundering stolen funds. The operation also disrupted online accounts and infrastructure used by scam networks. Wallet evidence mattered, but so did fast coordination across exchanges, technology providers, and public authorities.
Read the United States Department of Justice report on Disruption Week.
June 2026: AudiA6 showed how professional laundering infrastructure operates
United States prosecutors charged two people in connection with AudiA6, a service alleged to have laundered more than $389 million in cryptocurrency. Authorities targeted servers, domains, Telegram accounts, and crypto assets. The complaint described both direct deposits from known illicit sources and additional indirect exposure. The defendants are presumed innocent unless proven guilty. For risk teams, the case illustrates why transaction distance and supporting evidence matter alongside a label.
Read the United States Department of Justice announcement about AudiA6.
July 2026: hundreds of intermediary wallets did not make funds invisible
The United States Attorney's Office for the District of Columbia announced five civil forfeiture complaints seeking more than $25 million in crypto linked to international fraud investigations. One case began with an alert from a private sector partner. Another involved proceeds moved through hundreds of intermediary addresses and combined with funds from other victims. The actions were ongoing civil matters, but they demonstrate the value of preserving the first transaction trail before it becomes a much larger graph.
Read the United States Attorney's Office report on the five investigations.
A first hour process for a suspicious payment
1. Prevent further movement
Do not automatically credit, convert, refund, or forward the assets while the alert is unresolved. Follow the hold and escalation powers available under your contracts, policy, and applicable law. Returning funds to an address supplied in a message can create a second risky transaction and may send money to a different controller.
2. Preserve the payment record
Capture the network, asset, amount, sender and receiver addresses, transaction hash, block time, invoice or customer reference, alert time, and every message connected to the payment. Keep the original wallet and transaction identifiers. Screenshots can help, but they should not replace machine readable values.
3. Generate a current Farona assessment
Screen the wallet involved in the payment on the correct network. Farona converts available blockchain signals into a Farona score, one of five Farona risk levels, a plain language verdict, and supporting evidence. Record when the report was generated because wallet activity and available intelligence can change.
4. Test the alert against context
Read why the result was assigned. Separate direct exposure from indirect exposure and consider the available value, number of intermediate steps, labels, counterparties, and transaction flows. A High or Critical Farona result should receive documented human review under the organization's policy. A lower result should not override a strong external warning or an obvious mismatch in the payment story.
5. Escalate with a useful evidence package
Send the facts, not a vague message saying that crypto looks suspicious. A useful package contains wallet addresses, network, transaction hashes, timestamps, amount, Farona findings, customer context, and the action already taken. Depending on the case, recipients may include the compliance lead, legal counsel, an exchange or custodian, a banking partner, an insurer, or the relevant reporting authority.
6. Maintain one decision log
Record who reviewed the case, what evidence was available, which external parties were contacted, and why the payment was released, held, rejected, or escalated. If new activity appears, add it to the same case rather than starting an unconnected review.
Three mistakes that waste the first hour
- Moving the funds to make the problem disappear: an internal transfer, conversion, or refund can complicate the trail and create new exposure.
- Screening the wrong address or network: a customer profile, exchange name, or receiving address may not represent the actual sender involved in the alert.
- Treating a score as the final legal answer: a risk score supports triage. It does not establish ownership, criminal intent, or a reporting obligation by itself.
Where Farona fits in the response
Farona helps a team move from an alert to a structured blockchain risk review. It can surface evidence that supports prioritization and give reviewers a consistent record to discuss. It does not freeze assets, recover stolen cryptocurrency, identify the legal owner of every wallet, contact law enforcement, or replace qualified AML and legal judgment.
The news from 2026 points to a clear operational lesson. Recovery and disruption can depend on fast, accurate information moving between businesses, service providers, and authorities. The first hour should produce that information before the transaction trail grows more complex.
This article provides general information and is not legal advice. Reporting, holding, and disclosure duties vary by jurisdiction and business model.
Image credit
The hero photograph appeared in the Serious Fraud Office news release published on 20 November 2025. Source: Serious Fraud Office via GOV.UK. Crown copyright material is reused under the Open Government Licence version 3.0.
