FinCEN Ties $12.7B in Scam Proceeds to Tether (USDT) Laundering Trail

FinCEN Flags $12.7 Billion in Scam Activity

A sweeping analysis from the U.S. Treasury's Financial Crimes Enforcement Network, published Thursday, connects approximately $12.7 billion in suspicious financial activity to digital asset investment scams — the fraud pattern often labeled pig butchering or romance baiting. The review rests on 33,904 Bank Secrecy Act reports filed by roughly 1,300 institutions between Sept. 8, 2023 and Dec. 31, 2025, giving regulators an unusually granular view of how stolen funds traveled through banks, crypto businesses and securities firms (the official FinCEN analysis). Money services businesses — mostly digital asset firms — submitted 55% of the filings and flagged $5.5 billion, while banks accounted for 41% and reported $6.4 billion; securities firms and other institutions covered the remaining $784.5 million. Reporting climbed steadily across the window: monthly filings grew an average of 10.9% and reported sums by 18%, rising from 590 reports worth $485.7 million in October 2023 to 2,482 reports covering $833.5 million by December 2025. The agency cautions against reading the $12.7 billion as direct victim losses, since suspicious activity reports can include attempted transfers, transactions flagged by multiple institutions and filer errors that produce double counting. Part of the increase, FinCEN notes, may also reflect wider use of the search term introduced in its 2023 pig butchering alert. The schemes themselves followed a familiar script: criminal groups built fake identities and manufactured relationships to win trust before steering victims toward fraudulent crypto investments, with confirmed activity reaching victims in all 50 states and several U.S. territories.

Stablecoins Anchor the Laundering Trail

The asset trail is the report's most actionable finding. Scammers used at least 22 different cryptocurrencies — Ethereum, Tether's USDT and Circle's USDC appeared most often — but rarely minted bespoke tokens for the fraud. Instead, blockchain analysis cited in the filing shows proceeds were almost always converted into gas fee-powered Ethereum-style assets and then into stablecoins, almost exclusively USDT, before being routed through zero-knowledge proofs-adjacent DeFi protocols or exchanges outside the United States. Rather than turning to privacy coins like Monero, operators favored deep-liquidity assets that blend into normal exchange flow. Reused collection addresses — some receiving transfers from multiple victims simultaneously — gave compliance teams the thread that linked seemingly separate cases to single networks. On the victim side, FinCEN pushed back on a common assumption: elder exploitation appeared in roughly 25% of reports, close to the 24.4% share of Americans aged 60 or older, meaning seniors were neither disproportionately targeted nor disproportionately drained. Losses were still severe, frequently financed through retirement accounts, home equity lines, second mortgages and personal loans — one woman moved nearly $640,000 from her retirement fund, and another lost over $1 million in six months. Many operations ran from industrial-scale compounds in Cambodia, Laos and Burma staffed by trafficked workers the United Nations numbers in the hundreds of thousands, with the Cambodia-based Huione network previously linked to more than $89 billion in crypto transactions. FinCEN's Rapid Response Program has interdicted $1.8 billion since 2015, recovering just over $1 billion for 5,790 U.S. victims, and U.S. prosecutors have pursued the Cambodia-based Prince Group, seeking forfeiture of more than 127,000 Bitcoin tied to founder Chen Zhi, who was detained in January and transferred to China. Readers tracking the market in real time can follow live spot and futures prices on Binance.

USDT Sits at the Center of Illicit Flows

Our reading of the alert is that the load-bearing fact is the conversion funnel: whatever victims bought first, funds settled in USDT before exiting through offshore venues, making blind signing exploits, phishing kits and the “guarantee marketplaces” selling laundering services the chokepoints worth policing. Investors vetting venues should also review our guide to the best crypto exchanges for compliance screening practices.