Operation Atlantic: US and UK Team Freeze Millions in Stolen Crypto

• Operation Atlantic identified over $45M in stolen crypto linked to global fraud schemes.
• Authorities froze $12 million in funds while tracing more than 20,000 victim wallets.
• Approval phishing scams emerged as the primary attack vector behind these losses.

A coordinated law enforcement operation led by agencies in the United States, United Kingdom, and Canada has identified more than $45 million in stolen cryptocurrency tied to global fraud schemes.

The initiative, known as Operation Atlantic, ran as a week-long enforcement sprint starting March 27.

It brought together the US Secret Service, the UK’s National Crime Agency (NCA), Ontario Provincial Police, and the Ontario Securities Commission, along with private sector partners including Coinbase, Binance, and Chainalysis.

The operation focused on approval phishing scams, a fast-growing attack method used to gain direct access to victims’ crypto wallets.

$12 Million Frozen, 20,000 Victims Identified

Investigators identified over 20,000 victims across more than 30 countries, including the United States, the United Kingdom, and Canada.

Out of the $45 million traced, approximately $12 million in stolen funds has already been frozen with the goal of returning assets to victims. Authorities also flagged an additional $33 million linked to suspected investment fraud, which remains under investigation.

In one confirmed case, a victim in the UK lost more than £52,000 ($69.7K) through an approval phishing attack.

The operation also mapped more than 20,000 wallet addresses connected to fraud activity, giving investigators a clear view of the scale and structure of these networks.

How Approval Phishing Works

Approval phishing relies on deception rather than technical exploits. Victims receive fake alerts or pop-ups that appear to come from trusted crypto platforms or investment services.

These prompts ask users to “approve” access to their wallets. Once approved, attackers gain full control over the wallet. They can move funds instantly, and due to the nature of blockchain transactions, these transfers are irreversible.

Operation Atlantic identified and disrupted more than 120 domains used to run these scams globally. It is important to note that a key factor behind the operation was the use of real-time on-chain intelligence.

Blockchain analytics firms like Chainalysis worked alongside investigators at the NCA’s London headquarters, tracing illicit flows and flagging high-risk wallets as activity happened.

This allowed exchanges and service providers to act immediately, pausing suspicious transactions and applying enhanced monitoring before funds could be laundered further.

Public-Private Collaboration Expands Reach

Operation Atlantic relied heavily on coordination between government agencies and private companies.

Crypto firms, including Coinbase, Kraken, Tether, and Binance, contributed data, infrastructure insights, and compliance support. This collaboration helped investigators connect wallet activity across exchanges, bridges, and services.

The model builds on earlier efforts like Operation Spincaster, which generated over 7,000 investigative leads tied to roughly $162 million in losses.

Authorities say this type of joint approach is now essential, as fraud networks operate globally and move funds across multiple platforms within minutes.

Related: X Targets Phishing Scams With Forced Locks on New Crypto Activity