Category deep-dive: Scam and fraud volumes declined in 2024, but remain a significant threat
Editor’s note: The following post is an excerpt from our 2025 Crypto Crime Report, which we are breaking down by threat category over the coming weeks. In previous posts, we examined:
- Overall 2024 crypto transaction volumes
- How sanctioned entities drove illicit crypto volume in 2024
- Trends in the use of crypto in terrorism financing
- The growing threat of crypto-enabled ransomware attacks
- How crypto-enabled hacks evolved in 2024
In this post, we’ll take a closer look at the illicit use of crypto in in 2024. To read the 2025 Crypto Crime Report in full and download your copy, click here.
In 2024, funds sent to fraud amounted to at least USD 10.7 billion, representing a 40% decrease from 2023. This continued the decline from 2022, a year when funds sent to Ponzi schemes and financial grooming schemes (commonly referred to as "pig butchering" scams) reached an all-time high of about USD 16.8 billion.
As with all types of crypto crime discussed in this report, TRM’s coverage of fraud in 2024 will rise over time as more instances are found. Fraud numbers appear to be much more affected than other crimes, likely due to delayed fraud reporting by victims. Accordingly, TRM assesses that fraud volumes likely still declined in 2024, but not nearly as sharply as the data currently shows.
Fewer Ponzi and pyramid schemes received over USD 100 million
Approximately 45% of the decrease in 2024 fraud volume appears to be driven by a decrease in flows to apparent Ponzi and pyramid schemes. These schemes received a total of USD 4.3 billion in funds from victims, marking a 37% decrease from 2023 inflows. While this fraud typology remains popular, and hundreds are still being created every month (targeting victims in diverse regions such as the United States, Argentina, South Korea, the United Kingdom, Italy, Cyprus, and the Philippines), TRM did not see as many large schemes receiving over USD 100 million as in previous years (six in 2024 vs. 14 in 2023), which had volumes disproportionately driven by a handful of massive schemes.
Ponzi and pyramid schemes rely on word-of-mouth, marketing, and social networks in order to become popular and yield large losses. They can obtain a level of virality similar to other types of social media activity via both off- and online methods that can supercharge a scheme — taking it from a scheme that receives USD 5 million in inflows to one receiving hundreds of millions of dollars.
This does not appear to have happened as often in 2024 as in previous years. Much like determining why particular social media posts “go viral” and others don’t, it is difficult to say why no schemes appear to have “gone as viral” in 2024 as in previous years. It could be that people are more aware of such fraudulent schemes and did not fall for them as much. Or, recruitment into and marketing of these schemes could have moved offline or to private messaging, making them more difficult to find and track.
Self-reported instances of fraud remain high
Though the overall volume for fraud dipped, TRM still saw thousands of new investment scam and phishing websites being deployed each month, and received thousands of reports from Chainabuse, the largest publicly available reporting platform for illicit crypto activity.
Incoming volume to addresses reported on Chainabuse appeared to remain steady in 2024 — and at relatively high volumes compared to earlier years.
Finally, reported fraudulent activity on Chainabuse matches TRM internal data showing that bitcoin is the most common payment method requested by scammers — though its dominance has decreased over time.
Financial grooming, or “pig butchering” scams, received more than USD 2.5 billion in 2024
Financial grooming scams, also known as “pig butchering,” experienced a significant decline in 2024. Addresses associated with this fraud typology received at least an estimated USD 2.5 billion, a possible 58% decrease from 2023. This total is very likely an undercount of the true number, as many victims do not report their losses — and even fewer report their experiences publicly.
TRM attributes this reduction, in part, to heightened law enforcement efforts worldwide. For example, the number of freezes of USDT (historically the cryptocurrency of choice for financial groomers) increased substantially in late 2023 and continued in 2024.
TRM analysis also revealed fewer high-volume financial grooming entities active in 2024 compared to 2023. This decline is likely a combination of the aforementioned enforcement actions, along with increased awareness, delayed reporting, and shifts in fraudsters’ tactics.
- Increased awareness: News media and social media users have been publishing stories relating to victims’ large losses, the method of the scam, and its connection to transnational organized crime and human trafficking all throughout 2023 and 2024. The more people are aware of this scheme, the harder it is for the scammers to find victims.
- Delayed reporting: It frequently takes time — often many months — for victims to report scam losses, if they report at all. TRM will continue to attribute more volume to specific typologies over time as more known scam instances are found. For example, in TRM’s 2023 Illicit Crypto Economy report, our estimate for funds received by financial grooming addresses was approximately USD 4.4 billion. Today, we assess this 2023 figure to be approximately USD 6.0 billion.
- Shifting fraudster tactics: TRM has observed that fraudsters’ money movements have changed. Fraudsters appear to be using DAI more than they had in 2023, perhaps in response to more frequent USDT seizures. They also appear to be using more varied decentralized services and are bridging funds via decentralized services more often than in the past.
Unfortunately, the publicly-reported connection between financial grooming and forced scamming appears to still be live. Addresses known to be used for ransom payments facilitating the rescue of forced scamming victims continued to receive several million dollars of inflows in 2024.
Threat actors increasingly leveraged AI to defraud victims
TRM saw fraudsters use AI in multiple ways in 2024, and is strongly concerned about its future use. Financial groomers and other scammers use large language models (LLMs) to:
- More easily create personas customized to the area in which their targeted victim resides, and to have more realistic conversations
- Create live voice and video deepfakes of famous individuals (or of victims’ relatives or CEOs) to trick victims to invest money, pay an invoice, or make a hostage payment
- Send a higher quantity of (and better quality of) phishing messages
- Create pornographic images of individuals in order to extort them
- Create fake personas to bypass Know Your Customer (KYC) requirements
TRM believes criminals of all kinds will heavily expand their use of AI in 2025, and is working to counter this grave threat.
Next up in this series: We explore the final category featured in the 2025 Crypto Crime Report: Illicit drug sales.
Ready to dive into the full report? Get your copy here.
Access our coverage of TRON, Solana and 23 other blockchains
Fill out the form to speak with our team about investigative professional services.
