{"id":530,"date":"2025-08-09T20:31:43","date_gmt":"2025-08-09T20:31:43","guid":{"rendered":"https:\/\/refundauthority.com\/?p=530"},"modified":"2026-03-18T20:36:02","modified_gmt":"2026-03-18T20:36:02","slug":"crypto-experts-law-enforcement-shut-down-network-stealing-billions-through-approval-phishing","status":"publish","type":"post","link":"https:\/\/refundauthority.com\/?p=530","title":{"rendered":"Crypto experts, law enforcement shut down network stealing billions through \u2018approval phishing\u2019"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Cryptocurrency experts and law enforcement agencies across six countries worked together to shut down scam networks that made more than $1 billion from \u201capproval phishing\u201d scams \u2014 where hackers trick people into allowing them to spend tokens inside a victim\u2019s crypto wallet.<\/p>

The effort \u2014 named \u201cOperation Spincaster<\/a>\u201d \u2014 involved 17 crypto exchanges including Binance and NDEX working with 12 public sector agencies on a series of \u201coperational sprints\u201d designed to disrupt the scams.\u00a0<\/p>

The operation started in Canada in March, when the Calgary Police Service worked with Chainalysis on the initial pilot project.\u00a0<\/p>

Danny Leong, the blockchain investigations team sergeant with the Calgary police, said in a statement that his team worked with Chainalysis earlier this year to host a private workshop where they identified more than 770 individuals, 119 which were Canadians, as victims of cryptocurrency fraud, with an estimated combined loss of $59 million.\u00a0<\/p>

Through the workshop, several Canadian law enforcement agencies were able to notify those impacted and prevent further crypto theft.\u00a0<\/p>

\u201cThrough this workshop, the participating organizations took swift action in notifying the impacted individuals to prevent further victimization,\u201d Leong said.\u00a0<\/p>

Chainalysis said it initially embarked on the effort after\u00a0reporting<\/a>\u00a0in December about $1 billion in losses due to approval phishing scams since May 2021. After that report, the company\u2019s experts identified more illicit addresses and updated the number to more than $2.7 billion in losses since 2021.\u00a0<\/p>

Chainalysis used their findings to work with law enforcement agencies in the U.S., U.K., Canada, Spain, the Netherlands and Australia on a series of sprints from April to June 2024 that saw them train officers on how to identify compromised wallets and trace the stolen funds.\u00a0<\/p>

\u201cOver 7,000 leads were disseminated during these sprints relating to approximately $162 million of losses. These leads were used to close accounts, seize funds and build intelligence to prevent future scams,\u201d Chainalysis explained.\u00a0<\/p>

\u201cIn fact, in one of the sprints, participants were able to contact a victim directly to warn them of an ongoing scam, prompting the victim to take preventative action on-chain by revoking the approval before the scammer was able to steal a six-figure sum.\u201d<\/p>

Celestino Calabrese, acting head of illicit finance threat at the U.K.\u2019s National Crime Agency, said they were able to identify 230 victims in their country and found more than $33 million of funds that they believe were the result of approval phishing.<\/p>

\u201cThis work has protected victims here in the UK, and provided opportunities for us to pursue organized crime groups causing significant harm,\u201d Calabrese said. \u201cMany of these groups are based overseas, and utilize sophisticated methods to gain the trust of unsuspecting investors.\u201d<\/p>

Chainalysis did not respond to requests for comment about how much of the money was clawed back by law enforcement and returned to victims.\u00a0<\/p>

Approval phishing is a tactic typically used alongside other popular scamming techniques like\u00a0romance scams<\/a>\u00a0or\u00a0fake crypto<\/a>\u00a0app schemes<\/a>.\u00a0<\/p>

The scammers usually trick victims into signing a malicious blockchain transaction that gives the scammer\u2019s address approval to spend specific tokens inside the victim\u2019s wallet, allowing the scammer to then drain the victim\u2019s address of those tokens at will.<\/p>

Tim Stainton, detective superintendent with the Australian Federal Police, said Operation Spincaster has \u201cshed a clear light on new tactics used by cybercriminals in their continued efforts to defraud Australians,\u201d adding that it will form a key part of their ongoing investigations to identify cybercrime victims and disrupt offenders in Australia.<\/p>

Binance\u2019s Erin Fracolli added that the effort helped crypto firms trace stolen funds, identify affected users and warn them of the scam.\u00a0<\/p>

Earlier this year, Singapore-based cyber firm Group-IB\u00a0published its own report<\/a>\u00a0on a similar scam where victims were tricked into connecting their cryptocurrency wallets with an attackers\u2019 infrastructure. That scheme saw hackers steal at least $80 million in assets from its victims\u2019 digital wallets.<\/p>

According to the FBI,\u00a0$3.94 billion of losses<\/a>\u00a0suffered by Americans last year were connected to cryptocurrency investment fraud.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

Cryptocurrency experts and law enforcement agencies across six countries worked together to shut down scam networks that made more than $1 billion from \u201capproval phishing\u201d scams \u2014 where hackers trick people into allowing them to spend tokens inside a victim\u2019s crypto wallet. The effort \u2014 named \u201cOperation Spincaster\u201d \u2014 involved 17 crypto exchanges including Binance […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_angie_page":false,"_eb_attr":"","page_builder":"","footnotes":""},"categories":[1],"tags":[],"class_list":["post-530","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/refundauthority.com\/index.php?rest_route=\/wp\/v2\/posts\/530","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/refundauthority.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/refundauthority.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/refundauthority.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/refundauthority.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=530"}],"version-history":[{"count":4,"href":"https:\/\/refundauthority.com\/index.php?rest_route=\/wp\/v2\/posts\/530\/revisions"}],"predecessor-version":[{"id":534,"href":"https:\/\/refundauthority.com\/index.php?rest_route=\/wp\/v2\/posts\/530\/revisions\/534"}],"wp:attachment":[{"href":"https:\/\/refundauthority.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=530"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/refundauthority.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=530"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/refundauthority.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=530"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}