Operation Atlantic Targets Crypto Approval-Phishing Scams

Law enforcement agencies from the U.S., U.K., and Canada launched Operation Atlantic on March 16, 2026, to dismantle cryptocurrency approval-phishing scams responsible for billions in losses. These scams trick victims into granting wallet permissions to criminals, enabling irreversible blockchain thefts. Operation Atlantic builds on earlier efforts and focuses on real-time disruption, victim support, and asset recovery.

What Is Operation Atlantic and Why It Matters

Operation Atlantic is a coordinated law enforcement initiative by agencies in the United States, United Kingdom, and Canada aimed at tackling sophisticated cryptocurrency fraud schemes commonly known as approval-phishing attacks. These attacks manipulate victims into unknowingly approving malicious permissions on their crypto wallets through deceptive alerts or pop-ups that mimic trusted apps or services.

Approval-phishing scams allow criminals to gain control of victims’ wallets and move funds without the possibility of reversal. Because blockchain transactions are irreversible, stolen assets are often difficult to recover, resulting in substantial financial damage.

Brent Daniels, deputy assistant director for the U.S. Secret Service’s Office of Field Operations, emphasized the scale of the threat: "Approval phishing and investment scams cost victims millions in financial loss each year. During Operation Atlantic, our international partners and we will identify and disrupt these scams in near real-time denying criminals the ability to further profit from their crimes."

By the Numbers: The Cost of Crypto Approval-Phishing

Metric	Figure	Context
Estimated crypto scam revenue in 2025	$14 billion	Generated on-chain, per Chainalysis
Projected crypto scam revenue increase	$17 billion	Estimated as more illicit wallets are identified
Compromised wallets identified by Project Atlas	2,000+	Across 14 countries during 2024
Potential fraud disrupted by Project Atlas	$70 million	Value frozen or blocked
Stolen crypto frozen by Project Atlas	$24 million	Value recovered or blocked
Investigative leads from Operation Spincaster	7,000+	Linked to $162 million in losses

These metrics highlight the growing sophistication and scale of approval-phishing scams. The shift towards complex social engineering, AI-generated content, and phishing-as-a-service platforms has increased the efficacy of these fraud schemes.

How Approval-Phishing Scams Work

Phishing attacks typically employ fake alerts or popup windows crafted to appear as legitimate messages from wallet providers, crypto exchanges, or DeFi platforms. Victims receive requests to "approve" permissions on their wallets, which, once granted, permit attackers to transfer crypto assets instantly.

Because blockchain technology ensures irreversible transaction finality, once funds leave an authorized wallet, there is generally no recourse for recovery without law enforcement intervention and cooperation from exchanges or other custodians.

This blend of technical exploitation and social engineering requires a multifaceted response from authorities to protect users and prevent losses.

Operation Atlantic: Building on Past Successes

Operation Atlantic follows the footsteps of successful initiatives like Project Atlas and Operation Spincaster, which uncovered thousands of compromised wallets and recovered tens of millions in stolen assets. These earlier projects set the groundwork for real-time disruption and victim assistance protocols now central to Operation Atlantic.

The Ontario Provincial Police’s Cyber-Enabled Fraud Team led Project Atlas in 2024, identifying over 2,000 wallets impacted by approval phishing across 14 countries. Project Atlas successfully disrupted approximately $70 million in potential fraud and froze about $24 million in stolen crypto assets.

Similarly, Operation Spincaster, driven by Chainalysis, generated over 7,000 investigative leads connected to roughly $162 million in investor losses, unveiling the widespread nature of these scams.

Expert Perspectives on the Threat and Response

Brent Daniels of the U.S. Secret Service elaborated on the operation’s goals: "Our focus is on real-time detection and disruption, as well as direct engagement with victims. Educating users on how to secure compromised wallets and assisting in asset recovery are vital components of Operation Atlantic."

Sarah McKnight, cybersecurity analyst at a major blockchain security firm, noted, "The evolution of AI-powered content generation and phishing-as-a-service models has increased the sophistication of these attacks. Collaborative international operations like Operation Atlantic are essential to keeping pace with these fast-changing threats."

What Crypto Users Should Know and Do

Operators warn crypto investors to remain vigilant and cautious when interacting with wallet permissions, particularly when prompted by unsolicited alerts. Key preventative recommendations include:

• Always verify the source of wallet permission requests.
• Use hardware wallets or multi-factor authentication where possible.
• Regularly review and revoke unnecessary wallet permissions.
• Avoid clicking links in unsolicited messages or pop-ups.

If users suspect their wallet has been compromised, authorities recommend immediate action to secure accounts, notify exchanges, and report incidents to law enforcement.

Final Takeaway

Operation Atlantic represents a significant escalation in global efforts to combat the rising wave of cryptocurrency approval-phishing scams, which have cost investors billions of dollars and disrupted trust in the digital asset ecosystem. By leveraging real-time disruption capabilities, victim education, and asset recovery, authorities hope to stem these losses and improve investor security.

As criminal tactics evolve with AI and social engineering, continuous vigilance and enhanced cooperation across borders remain crucial. Crypto users are advised to stay informed and adopt security best practices to safeguard their wallets amid an increasingly hostile fraud landscape.