TL;DR
- As crypto adoption grows and peer-to-peer (P2P) payment systems like PayPal and Zelle become more mainstream, fraudsters are finding more ways to exploit fragmented financial systems.
- Oftentimes, scammers can move money across multiple banks or systems faster than investigators can keep up, thus taking advantage of the lag between detection and coordinated responses.
- By analyzing data relationships — such as timestamps, address behaviors, transaction patterns, email addresses, IP logs, and account ownership — investigators can potentially uncover hidden connections between activities.
- New tools like Chainalysis Alterya help enable real-time fraud detection, helping the public and private sectors improve their efforts to trace scams that span multiple platforms.
Financial fraud isn’t what it used to be. Today’s scammers aren’t just phishing for credit cards — they’re running sophisticated international schemes that span multiple platforms, currencies, and technologies. As payments in cryptocurrency and peer-to-peer (P2P) payment systems like PayPal, Venmo, Zelle, Revolut, and Wise become more mainstream, fraudsters are finding more ways to exploit fragmented financial systems.
By jumping between blockchain and traditional payment platforms, fraudsters attempt to make their activities harder to trace. This multi-platform strategy creates major challenges for investigators and compliance teams: It’s no longer enough to look at a single ledger or transaction log. Instead, now more than ever, unmasking modern scammers requires connecting the dots between on-chain and off-chain data.
Siloed financial ecosystems
Traditional financial institutions and crypto platforms operate with fundamentally different frameworks. Banks rely on centralized infrastructure, enforce strict Know Your Customer (KYC) protocols, and maintain comprehensive transaction records. In contrast, crypto platforms have varying levels of privacy and transparency, depending on whether they are centralized or decentralized. These systems rarely interact directly, creating isolated data environments that don’t easily share information.
According to Caitlin Barnett, Director of Regulation & Compliance at Chainalysis, “When funds move from one system to another, such as from Zelle to a crypto wallet, there’s often no built-in mechanism to trace that movement across platforms. Investigators stuck within one domain rarely have the full picture, and scammers exploit this disconnect to obscure their tracks and avoid detection. Even within traditional finance, silos persist. Banks don’t share fraud data in real time; payment rails like ACH, wires, and P2P apps operate independently; and geographic or regulatory differences further fragment oversight.”
Oftentimes, scammers can move money across multiple banks or systems faster than investigators can keep up, thus taking advantage of the lag between detection and coordinated responses. Consequently, multi-platform scams can thrive due to difficulties tracking illicit activity end-to-end.
Fortunately, it is possible to bridge the gap between traditional and blockchain-based payment rails. By analyzing data relationships — such as timestamps, address behaviors, transaction patterns, email addresses, IP logs, and account ownership — investigators can potentially uncover hidden connections between activities. New tools like Chainalysis Alterya help enable real-time fraud detection, helping the public and private sector improve their efforts to trace scams that span multiple platforms.
Linking off-chain and on-chain data across platforms
In the chart below, which shows the number of unique scam crypto addresses between January 2020 and March 2025, we see a steep upward trend beginning in mid-2023. Between December 2024 and March 2025, the number of new addresses surpassed one million each month, reflecting the rapid growth of scams and fraud as a global problem.
Within the crypto ecosystem, scammers are increasing the number of off-ramps they use, taking advantage of silos in order to simultaneously reduce their chances of getting caught and scale their operations. In the next chart, which shows the top 10 fastest growing conversion services used by addresses associated with scammers, we see that sanctioned jurisdictions, gambling services, decentralized exchanges, and no-KYC exchanges are increasing in popularity year-over-year; this is no surprise, given that most are high-risk or illicit categories.
Additionally, by looking at email addresses associated with scammers (what they used to sign up for accounts at financial institutions), we determined that one email address was associated with 91 different scams. It is very common for scammers to use multiple forms of payment platforms — again because it reduces the likelihood of investigators recognizing recurring patterns.
Next, we’ll look at a case study involving a cryptocurrency address associated with a scammer who has also received funds at traditional payment platforms.
Scammers running multiple platforms
In the past, most scammers were focused on running large-scale, carefully managed Ponzi schemes, which were also common in the early days of crypto fraud. But today, it’s much easier to launch scam websites at scale and link them to different payment platforms. In one instance, we identified a crypto address with a history of interacting with traditional payment services, linked to 65 unique scam websites. As shown in the following Chainalysis Reactor graph, this scammer received approximately $89,000 from a U.S.-based centralized exchange.
Additionally, on-chain analysis revealed another example of two scam addresses controlled by the same operator that were linked to an email address with a history of running 50 unique scam websites.
In another instance, on August 20, 2024, we identified a scammer through the Zelle information the scammer provided to a victim during the social engineering process. Using this off-chain information, we applied heuristics to uncover on-chain wallets associated with the scammer. Notably, the first transfer initiated by the victim didn’t occur until a week after we first identified the scammer. This time difference may have provided an opportunity to flag and investigate the scam before any funds were lost.
As scammers fragment their activity across many domains and accounts, traditional on-chain signals alone are often insufficient to expose the full scope of their operations. Connecting on-chain data with off-chain intelligence — such as email addresses, web infrastructure, and payment service usage — provides the broader context needed to link seemingly isolated scams and disrupt these networks more effectively.
A new era in crypto fraud prevention
Scammers can no longer rely on the separation between financial systems to stay hidden. The ability to connect off-chain and on-chain data is reshaping the fight against fraud, revealing patterns and identities that would otherwise remain obscured. As financial crimes grow more sophisticated, multi-platform analytics will be essential for staying ahead and preventing crypto fraud.
For law enforcement, financial institutions, and crypto exchanges, this shift offers both a challenge and an opportunity. Those who embrace cross-platform detection strategies will be better positioned to respond — not just to today’s threats, but to whatever comes next.
Book a demo of Chainalysis Alterya’s fraud detection solution here.
This website contains links to third-party sites that are not under the control of Chainalysis, Inc. or its affiliates (collectively “Chainalysis”). Access to such information does not imply association with, endorsement of, approval of, or recommendation by Chainalysis of the site or its operators, and Chainalysis is not responsible for the products, services, or other content hosted therein.
This material is for informational purposes only, and is not intended to provide legal, tax, financial, or investment advice. Recipients should consult their own advisors before making these types of decisions. Chainalysis has no responsibility or liability for any decision made or any other acts or omissions in connection with Recipient’s use of this material.
Chainalysis does not guarantee or warrant the accuracy, completeness, timeliness, suitability or validity of the information in this report and will not be responsible for any claim attributable to errors, omissions, or other inaccuracies of any part of such material.
