Operation Atlantic freezes $12M, tracks $45M in crypto fraud

Operation Atlantic, a one-week enforcement effort led from the U.K. National Crime Agency’s London headquarters, froze $12 million and traced $45 million linked to approval-phishing schemes, the participants announced on April 9. The sweep identified more than 20,000 victims and flagged over 120 web domains connected to the scams.

The NCA coordinated international law enforcement with major crypto firms and analytics providers during the week in London. Teams focused on quickly finding victims, following stolen funds across blockchains, and cutting off tools used by fraud groups.

Approval phishing involves fake pop-ups or alerts that prompt a user to grant a wallet permission that looks legitimate. Once approved, criminals can move assets without further consent.

In addition to Coinbase, Binance and the U.S. Secret Service, partners included Chainalysis, Kraken and Tether. The Secret Service reported that more than 120 domains tied to the schemes were identified during the week. Authorities noted that the $12 million now frozen could be returned to victims where possible.

“To take on approval phishing at scale, our Global Intelligence team joined forces with multiple international law enforcement agencies and other partners for a focused operational sprint held at the National Crime Agency’s headquarters in London,” Coinbase wrote in a statement. “The goal was straightforward: identify victims, trace stolen funds, and disrupt the infrastructure that makes approval phishing possible-as fast as we could.”

“Operation Atlantic is a powerful example of what is possible when international agencies and private industry work side by side,” noted Miles Bronfield, deputy director of investigations at the National Crime Agency. “This intensive action has led to the safeguarding of thousands of victims in the UK and overseas, stopped criminals in their tracks and helped save others from losing their funds.”

Coinbase added that the collaboration compressed what is typically a months-long, cross-border process into days, moving from identification to action within the week.

The FBI’s Internet Crime Complaint Center recorded $11.366 billion in losses linked to crypto scams in 2025, a 22% increase from the prior year, based on 181,565 crypto-related complaints.

An exploit of the Solana-based protocol Drift last week led to about $285 million in losses, which investigators have attributed to a North Korea-linked group. Authorities involved in Operation Atlantic stated that consumer-targeted fraud such as approval phishing accounts for a significant share of incidents and victims.

Participants in Operation Atlantic plan to keep analyzing data from the week and pursue further actions, including efforts to return funds to affected users where possible.