Enforcement Outcome Rates by Crypto Typology

Core idea

Outcomes are wildly uneven by crime type, and the pattern is not about how much money was involved. It tracks how easy the offender is to identify and whether the operation had anything physical attached to it. Useful at scoping, for telling a client or a victim what the realistic ceiling is, and for spotting when a case sits in a category where enforcement almost never lands.

Components

Counts below are taken from the report’s own tables covering 164 documented cases from 2005 to 2025. They are one organisation’s dataset of publicly documented incidents, not a complete population, and the report’s own summary percentages disagree with its tables in a few places, which is flagged where it happens. Use these as orders of magnitude, not as citable rates.

On-ramps, 130 cases: legal action in 75, convictions in 29.

Off-ramps, 19 cases (14 exchanges and OTC desks, 5 payment platforms): legal action in all 19, convictions in 7, and only about 484m USD seized against roughly 24.6bn USD processed, which the report puts at 2 percent.

Across all 164 cases: criminal charges in 70 (43 percent), convictions in 35 (21 percent), civil action in 65 (40 percent), sanctions in 21 (13 percent). 54 cases drew no legal action at all, and 79 percent produced no conviction. Total recovered or seized is put at about 92bn USD, or 27 percent of value.

The two poles, and why.

• Crypto ATMs sit at the top. All five networks in the dataset were dismantled and all five operators convicted. The report attributes this to physical infrastructure maintained in public view: it can be found from tips, tested on site, and seized directly. See Working a Crypto ATM as a Physical Pivot.
• Hacks sit at the bottom, with legal action in under a third of cases and convictions in about 9 percent. Attribution is hard, the funds move within minutes, and those who are charged are frequently in jurisdictions that do not extradite. 31 of the 64 hacks recovered nothing at all.
• Criminal enterprises drew legal action in every case and produced no convictions in the dataset, which is a distinct failure mode from the hacks: the actors are identified, named and sanctioned, and still out of reach.
• Ponzi schemes attract action reliably because they generate large numbers of identifiable victims and political pressure. Note the internal inconsistency: the tables give 11 convictions from 19 cases, the narrative says 58 percent, and the findings section says 65 percent.

When to use

At intake and scoping, when setting expectations with a victim, client or referring party, and when deciding where to spend a limited budget. Pair with Case Tractability, When to Decline.

Avoid when

Do not present these as predictive for a specific case, and do not quote the percentages as established statistics. A dataset of publicly documented incidents is biased towards cases that were detected and reported, which are the cases most likely to have gone somewhere. The true conviction rate across all offending is lower than anything in this table.

Example

A victim of an exchange hack asks whether the perpetrators will be prosecuted. This table supports an honest answer: enforcement action follows in roughly a third of documented incidents of that type and conviction in under one in ten, so the realistic objective is asset recovery through freezing and civil routes rather than a criminal outcome. That reframing at intake is worth more than optimism.

Related

Case Tractability: When to Decline · Identify the Predicate Typology First · Crypto Crime Typology Catalogue · Escalation Decision Matrix and Triggers · Recovery Budget Tiers by Asset Value · Four Parallel Recovery Avenues · Working a Crypto ATM as a Physical Pivot · Post-Hack Appreciation and the Valuation Date · Scope the Engagement in Writing · Translate Stakeholder Wants into Investigable Questions · Recovery Jurisdictions and Crypto Case Law