Operation Atlantic Freezes $12 Million in Crypto Scam Proceeds and Identifies 20,000 Approval Phishing Victims Across Three Continents
A week-long NCA-led operation with the US Secret Service and Canadian police disrupted approval phishing scams, freezing millions while identifying fraud wallets across more than 30 countries.
Overview
Law enforcement agencies in the United States, United Kingdom, and Canada concluded a week-long coordinated action against cryptocurrency fraud, freezing more than $12 million in criminal proceeds and identifying over 20,000 victims of so-called approval phishing scams, according to BleepingComputer. The operation, named Operation Atlantic, was announced on April 9, 2026, and was co-hosted by the U.S. Secret Service, the UK’s National Crime Agency (NCA), the Ontario Provincial Police, and the Ontario Securities Commission, as reported by The Register.
Investigators identified more than $45 million in cryptocurrency linked to fraud schemes globally, per The Register. The $12 million frozen during the week-long action represents the portion that agencies were able to secure before it was laundered through exchanges, while an additional $33 million in suspected proceeds has been flagged for further investigation.
What We Know
Operation Atlantic targeted a specific fraud technique known as approval phishing, in which criminals trick victims into granting wallet-draining permissions through deceptive prompts that appear to come from legitimate applications or services, according to BleepingComputer. Once a victim clicks to approve access, scammers can transfer funds out of the wallet in irreversible blockchain transactions.
The 20,000 victims were identified across the UK, Canada, and the United States, with affected wallet addresses traced to more than 30 countries, per The Register. Over the course of the operation, investigators directly contacted more than 3,000 victims to help them secure compromised accounts and pursue recovery of stolen funds.
The enforcement sprint was conducted at NCA headquarters in London and brought together government agencies with private-sector blockchain analytics firms. According to Decrypt, participating companies included cryptocurrency exchanges Coinbase, Binance, and Kraken, along with blockchain intelligence provider Chainalysis and stablecoin issuer Tether. The same outlet reports that 120 malicious web domains used in the scams were disrupted during the action.
Tactic and Scale
Approval phishing differs from conventional credential theft in that victims are not asked to hand over passwords or seed phrases. Instead, attackers trick users into approving wallet access through pop-ups and alerts that impersonate legitimate platforms, after which criminals can move funds in transactions that are typically irreversible, according to Decrypt.
U.S. Secret Service Assistant Director Brent Daniels said investigators “prevented millions of dollars in fraud losses and disrupted millions more in fraudulent transactions” through the operation, per The Register. The same report notes that U.S. authorities received 181,565 cryptocurrency-related complaints in 2025, a 21 percent year-over-year increase, corresponding to roughly $1.37 billion in reported losses.
According to Decrypt, Coinbase framed the speed of the intervention as a structural advantage of on-chain investigations, stating that “with traditional financial crimes, this kind of cross-border coordination would take months. With blockchain, we moved from identification to action in a week.” Miles Bronfield, the NCA’s Deputy Director of Investigations, said in the same report that the action “has led to the safeguarding of thousands of victims in the UK and overseas.”
What We Don’t Know
Neither the NCA nor the U.S. Secret Service has disclosed arrests tied to Operation Atlantic, and none of the three outlets reviewed list charges or indictments resulting from the week-long sprint. The geographic location of the fraud networks behind the approval phishing campaigns has not been publicly identified, nor has the split between individual scammers and organized syndicates responsible for the $45 million in identified losses.
It also remains unclear how much of the $33 million flagged for further investigation will ultimately be recovered. Frozen cryptocurrency funds typically require civil forfeiture proceedings or coordination with exchanges before they can be returned to identified victims, and the operation’s public materials did not specify a timeline for restitution.
Context
Operation Atlantic arrives during a period of intensified multilateral enforcement against cybercrime infrastructure. It follows earlier reporting by The Machine Herald on a $285 million DeFi exploit attributed to state-aligned actors, and arrives in the same week as Europol’s Operation PowerOFF, which seized 53 DDoS-for-hire domains. Unlike takedowns that focus on criminal infrastructure, Operation Atlantic’s distinguishing feature is its victim-centric design, with investigators using blockchain intelligence to notify holders of compromised wallets in real time rather than waiting for fraud reports to be filed after the fact.