Operation Atlantic freezes $12M+ tied to approval-phishing crypto scams
UK, US, and Canadian agencies identified 20,000+ victims, while Binance says no funds were frozen on its platform.
A UK-led enforcement action spanning the US and Canada froze more than $12 million linked to approval-phishing crypto scams. Authorities also flagged more than 20,000 victims and cited over $45 million in stolen cryptocurrency tied to fraud schemes.
Key Takeaways
- A joint US-UK-Canada enforcement effort targeted approval-phishing attacks under the name Operation Atlantic.
- More than $12 million in suspected criminal proceeds tied to crypto scams was secured and frozen, per the UK’s National Crime Agency.
- Investigators identified over 20,000 victims across the US, Canada, and the UK.
- Authorities also cited “more than $45 million” stolen in cryptocurrency fraud schemes, though the breakdown versus the freeze total was not specified.
Operation Atlantic’s Freeze: $12M+ Secured Across US-UK-Canada
Operation Atlantic ran in March 2026 as a coordinated enforcement action across the UK, US, and Canada focused on approval-phishing attacks. The operation was coordinated by the UK National Crime Agency (NCA) alongside the US Secret Service, the Ontario Provincial Police, and the Ontario Securities Commission.
In an April 9 disclosure, the NCA said the operation identified more than 20,000 victims across the three countries and froze more than $12 million in suspected criminal proceeds tied to crypto scams. The agency also said it identified “more than $45 million stolen in cryptocurrency fraud schemes.”
NCA Deputy Director of Investigations Miles Bonfield framed the action as a public-private model, saying: “Operation Atlantic is a powerful example of what is possible when international agencies and private industry work side by side,”
For traders, the scale matters more than the headline. A 20,000+ victim count and eight-figure freeze signals approval phishing remains a high-volume retail drain that enforcement is actively prioritizing across jurisdictions.
Approval Phishing: The Wallet-Permission Scam Behind the Crackdown
Approval phishing is not the classic “send funds to this address” con. The scam hinges on wallet permissions: victims are tricked into signing token-spending approvals that give an attacker the right to move specific tokens out of the wallet later.
That distinction is why these campaigns can be so persistent. The victim may not realize anything is wrong at the moment of signing, and the attacker can drain assets without needing the victim to initiate a direct transfer.
The NCA’s numbers also leave an important open question for market participants. The statement pairs “more than $12 million” frozen with “more than $45 million” stolen, but it does not clarify whether the freeze is a subset of the stolen total, a separate bucket, or tied to different cases found during the operation.
Binance’s Investigative Support—and Why It Says No Funds Were Frozen on Its Platform
Binance said it assisted Operation Atlantic through its Special Investigations team, including on-site support at the NCA’s London headquarters. The company described live account screening and scam intelligence work, plus sharing insights on potential bad actors to support asset seizure efforts.
Binance also said its research during the operation identified scam websites that were still actively defrauding victims at the time, suggesting the action targeted live infrastructure rather than only historical complaints.
Flavio Tonon, Binance’s senior regional advisor for Europe, the Middle East and Africa, called approval phishing “one of the most damaging types of scams targeting crypto users today,” and pointed to blockchain transparency as a constraint on criminals.
The key market-structure detail is what Binance did not claim. Binance said no funds were frozen on Binance accounts as part of Operation Atlantic, which positions its role here as investigative and intelligence-led rather than custody-led in this specific action.
What Traders Should Track After a Multi-Agency Freeze Operation
The next leg of this story is the plumbing: which chains, tokens, and custody venues were involved in the $12 million-plus freeze. Follow-up releases from the NCA, the US Secret Service, or Ontario authorities that name venues or specify asset types would tighten the risk map for where approvals are being abused and where funds are being interdicted.
Traders should also watch for clarification on the “more than $45 million stolen” figure. The real test is whether that number is a total-loss estimate across a broader set of schemes, a subset directly tied to Operation Atlantic cases, or a mix of both.
Finally, any exchange or wallet-provider statements that introduce new monitoring, warnings, or compliance actions tied to infrastructure identified during the operation would signal second-order effects. Further seizures, arrests, or takedowns linked to scam websites described as still active during the operation would confirm whether enforcement is disrupting the pipeline or just freezing proceeds after the fact.
Enforcement Freezes Are a Real-Time Stress Test for Self-Custody Habits
I treat operations like this as a live audit of how retail liquidity gets harvested. Approval phishing scales because it exploits normal DeFi behavior, and the 20,000+ victim figure shows the funnel is still wide even with years of warnings.
The threshold that matters is whether agencies publish enough venue and chain detail for the market to see where freezes are actually landing. If the $12 million-plus is traceable to specific rails and the $45 million-plus stolen figure is scoped to the same case set, the setup starts to look structural rather than narrative-driven, and it would matter in practical terms by changing where liquidity can safely exit and where compliance friction shows up first.
