FinCEN counts $12.7bn of suspected scam flows and names the settlement asset

What happened

The Treasury's Financial Crimes Enforcement Network published two documents on 3 September 2026: a Financial Trend Analysis titled 'Digital Asset Investment Scams: 2023-2025 Threat Pattern & Trend Information', issued under section 6206 of the Anti-Money Laundering Act of 2020, and alert FIN-2026-Alert005 to financial institutions. The analysis examined 33,904 Bank Secrecy Act reports filed between 8 September 2023 and 31 December 2025 that reference the key term from its own 2023 pig butchering alert, and puts the reported activity at approximately $12.7bn. Money services businesses, 'predominantly those related to the digital asset sector', and depository institutions filed 96 per cent of them. ABA Banking Journal, the one report read here that adds a figure the release omits, splits that: more than half the reports came from money services businesses and account for $5.5bn of activity, about 41 per cent from depository institutions and $6.4bn. Gene Lange, performing the duties of Under Secretary for Terrorism and Financial Intelligence, said that 'Digital asset investment scams pose one of the most significant fraud threats facing Americans today.' Two findings in the analysis are about the plumbing rather than the fraud. Filers named at least 22 different digital assets, with Ethereum, Tether and USD Coin most frequent, and then: 'regardless of the asset used in the original investment, scammers nearly always exchanged scam proceeds for stablecoins, almost exclusively USDT.' The alert describes the market underneath that, in which operators buy account creation, phishing and laundering services through 'guarantee marketplaces', which it defines as 'online marketplaces that typically operate as networks of Chinese-language chat groups on the Telegram messaging platform' holding a buyer's payment in escrow until delivery is confirmed, and which connect operators to Chinese money laundering networks. On the underground banking services those networks use, the alert says that 'these services typically rely on the liquidity provided by large MSBs in the digital asset sector to process transactions'. It also recounts that Huione Group launched a stablecoin, USDH, in September 2024 that it advertised as 'unfreezable' and 'not restricted by traditional regulatory agencies'; FinCEN severed Huione from the US financial system by final rule in October 2025 and proposed on 23 June 2026 to extend that rule to a successor, H-Pay Service PLC.

Why it matters

The number will travel and the sentence about USDT is the one worth keeping. It says that the scam economy has settled on a single unit of account, that the choice is made after the fraud rather than during it, and that the conversion happens at the laundering stage rather than the victim stage. That is a claim about market structure, not about crime: the asset that wins here wins for the same reasons it wins in legitimate cross-border payments, being deep, dollar-denominated and reachable from anywhere, and the alert says the ancillary services rely on the liquidity that large regulated money services businesses in the sector supply. It also puts a shape on what compliance is being asked to do. Under the GENIUS Act, permitted payment stablecoin issuers are being brought inside the Bank Secrecy Act by the Treasury's own April 2026 proposal, which means the entity that can freeze a token is becoming the entity with the reporting duty. Huione's USDH is the counter-example already in the record: a stablecoin marketed on the promise that it cannot be frozen, from a group the same agency then cut off. The distance between those two facts is the whole policy question about whether a stablecoin is an instrument a supervisor can reach.

What is not settled

Whether the trend is a trend. The release is headed on a rising rate and every report read here leads with one, but footnote 7 of the analysis says of the same growth that 'This may indicate an increased adoption of the Alert's key term and does not necessarily indicate there is an accelerating rate of investment scams.' The sample is defined by a term FinCEN introduced in September 2023, so the series measures how quickly filers adopted the vocabulary as much as it measures the underlying activity, and the monthly figures wobble accordingly: an 80 per cent rise in August 2024, an 11 per cent rise in September, a 19 per cent fall in October. The agency's own caution about the money is at least as strong. Suspicious activity amounts 'may also include transfers between accounts, typos, and errors as submitted by filers', may count both sides of a transaction, may include attempted and unpaid payments, and may duplicate across amending reports, so $12.7bn is an upper bound on reported activity rather than a loss estimate. Reports are counted by filing date rather than by the date of the conduct. Nothing in either document is an allegation against any named issuer or exchange, and neither says what share of the proceeds was recovered or frozen. The alert lists red flag indicators for institutions and does not create a new reporting obligation.