Last week, Chainalysis joined a proactive joint operation co-hosted by the UK’s National Crime Agency (NCA), the US Secret Service, Ontario Provincial Police, and the Ontario Securities Commission to disrupt large-scale cryptocurrency fraud and protect victims in real time.

Operation Atlantic focused on a fast-growing threat: approval phishing scams that trick victims into granting criminals permission to drain their wallets. Over the course of the operation, law enforcement and private sector partners identified more than 20,000 victims across the UK, Canada, and the United States. So far, the operation has secured and frozen more than $12 million in suspected criminal proceeds taken from victims, and identified more than $45 million in stolen cryptocurrency linked to fraud schemes around the world. In many cases, this meant funds could be secured before criminals were able to move them further.

One UK victim identified during the operation is believed to have lost more than £52,000 to this type of fraud.

Operation Atlantic is a clear demonstration of what can happen when on-chain intelligence, investigative expertise, and victim outreach come together at speed.

From intelligence to intervention: Inside Operation Atlantic

Operation Atlantic’s objective is simple but ambitious: spot victims and compromised wallets in real time, freeze and secure illicit funds before they can be laundered through exchanges or services, generate new investigative leads on the fraud networks behind these scams, and lay the groundwork for ongoing investigations based on the intelligence collected during the operation.

This public–private approach is closely aligned with the UK government’s Fraud Strategy, which emphasizes earlier intervention by connecting data, knowledge, and expertise from both industry and law enforcement. The week-long action at the NCA’s headquarters is that strategy in practice: agencies and companies working side by side, sharing insights and tools, and acting quickly on emerging intelligence. Operation Atlantic also builds on earlier public–private initiatives such as Operation Spincaster, a Chainalysis-led effort that generated more than 7,000 investigative leads tied to roughly $162 million in losses, underscoring the scale of approval phishing and the impact that coordinated, on-chain intelligence–driven operations can have.

How Chainalysis turned on-chain intelligence into impact

As a blockchain intelligence partner in Operation Atlantic, Chainalysis supported law enforcement and regulatory agencies with real-time on-chain intelligence, tracing, and alerting. Our tools and experts helped trace illicit flows linked to approval phishing, identify victim wallets and scam infrastructure, and map connections across chains and services, including exchanges, bridges, and high-risk VASPs.

Working alongside operational teams at the NCA’s London headquarters, Chainalysis delivered enriched, highly targeted blockchain intelligence leveraging Chainalysis Data Solutions with hands-on investigative support, flagging suspicious addresses, connecting them to known scam clusters, and helping prioritize wallets at highest immediate risk of further loss. As a result, VASPs could act on high-confidence on-chain intelligence rather than broad heuristics, and were able to pause suspicious activity more quickly, focus enhanced due diligence on the riskiest exposure, and file timely, well-substantiated suspicious activity reports where appropriate.

On-chain insights also supported targeted victim outreach. By leveraging data enrichment workflows in Data Solutions, operational teams were better equipped to understand what had happened, what assets were still recoverable, and what practical steps the victim could take.This combination of on-chain intelligence and direct support gave many individuals a better chance of limiting their losses and regaining control of their funds.

Operation Atlantic is a powerful example of what is possible when international agencies and private industry work side by side. By combining traditional investigative techniques in Reactor with the advanced analytics and threat intelligence workflows delivered via Data Solutions, participating agencies have safeguarded thousands of victims, stopped criminals in their tracks, and helped prevent others from losing their funds.

On-chain insights also supported targeted victim outreach. When an at-risk wallet or compromised account was identified, operational teams were better equipped to understand what had happened, what assets were still recoverable, and what practical steps the victim could take. This combination of on-chain intelligence and direct support gave many individuals a better chance of limiting their losses and regaining control of their funds.

Commenting on the operation, Miles Bonfield, Deputy Director of Investigations at the National Crime Agency, said:

“Operation Atlantic is a powerful example of what is possible when international agencies and private industry work side by side. This intensive action has led to the safeguarding of thousands of victims in the UK and overseas, stopped criminals in their tracks and helped save others from losing their funds. We know that fraudsters operate globally and, together with our international partners, so will the NCA to target them wherever they are based.”

His comments underline a broader shift in how fraud and cyber-enabled crime are tackled. On-chain intelligence is no longer a nice-to-have; it is central to understanding how scams operate, disrupting them at scale, and ensuring that responses keep pace with the speed at which criminals move money across borders and services.

Beyond a single operation

Although Operation Atlantic was time-bound, its impact will extend far beyond a single week. The NCA and its partners are now analysing the intelligence gathered to pursue criminal investigations against key actors and networks, support ongoing victim remediation and asset recovery efforts, and inform future joint operations aimed at fraud, scams, and other forms of crypto-enabled crime.

The operation also reinforces several core principles for Chainalysis. On-chain data are most powerful when it is operationalized in real time and placed directly into the hands of investigators and compliance teams. Meaningful public–private collaboration is essential to move at the same speed as criminals who exploit global infrastructure and cross-border gaps. A victim-centric approach must sit at the heart of any effective fraud strategy, from the design of analytics to the way findings are communicated and acted on.

Chainalysis will continue to support the NCA, the US Secret Service, and other Operation Atlantic partners as they build on this effort. We see Atlantic as part of a broader evolution: moving from a world where fraud is primarily investigated after the fact, to one in which illicit activity is identified, disrupted, and often stopped before criminals can fully cash out.

This website contains links to third-party sites that are not under the control of Chainalysis, Inc. or its affiliates (collectively “Chainalysis”). Access to such information does not imply association with, endorsement of, approval of, or recommendation by Chainalysis of the site or its operators, and Chainalysis is not responsible for the products, services, or other content hosted therein. 

This material is for informational purposes only, and is not intended to provide legal, tax, financial, or investment advice. Recipients should consult their own advisors before making these types of decisions. Chainalysis has no responsibility or liability for any decision made or any other acts or omissions in connection with Recipient’s use of this material.

Chainalysis does not guarantee or warrant the accuracy, completeness, timeliness, suitability or validity of the information in this report and will not be responsible for any claim attributable to errors, omissions, or other inaccuracies of any part of such material.