Crypto Fraud Detection Software: How Exchanges Catch Scams Before the Money Leaves

Quick solution

If you need a working answer today: run fraud detection as its own detection layer beside your AML transaction monitoring, not inside it. Pick a tool that scores the counterparty wallet at withdrawal time — the moment a customer sends funds to an address your vendor has already linked to a scam network, hold the transaction and show the customer why. Chainalysis Alterya and Scout, Elliptic, and TRM Labs all maintain scam-address intelligence; behavioral platforms like Sardine and Unit21 add device and session signals that catch account takeover before any blockchain activity happens. Start with withdrawal-time wallet screening because it is the cheapest control with the highest save rate: the victim's money is still in your custody, so a hold actually prevents the loss instead of documenting it. Then add behavioral signals for account takeover, and route everything into the same case queue your investigators already work so fraud holds get reviewed in hours, not days.

Image: Chainalysis — the Scout monitoring dashboard tracks flagged fraud exposure across an exchange's customer base, breaking alert volume down by scam category.

The distinction matters because the two systems optimize for opposite things. Your AML transaction monitoring — the alert rules, case queues, and SAR filings we covered in our guide to transaction monitoring for crypto exchanges — is a regulatory obligation measured in reporting deadlines. A suspicious transaction gets flagged, investigated over days, and reported to FinCEN within 30 days. Nobody expects the money to come back.

Fraud detection is measured in minutes. A pig-butchering victim who initiates a 40,000 dollar withdrawal to a scammer's wallet is still your customer, and the money is still in your custody. If your system scores that withdrawal in the seconds before it broadcasts, you can hold it, warn the victim, and in a meaningful fraction of cases stop the loss entirely. FinCEN's September 8, 2023 alert on pig butchering told financial institutions exactly this: the pattern is identifiable before completion, and institutions are expected to look for it.

The practical consequence is architectural. AML monitoring can run in batch, overnight, against settled transactions. Fraud detection has to sit in the withdrawal path, return a score fast enough that customers do not notice, and make a hold decision automatically. Teams that try to stretch their AML rules engine into that role discover it was never built for sub-second decisions — and teams that only run fraud rules discover at their next exam that fraud alerts are not SARs. You need both layers, feeding one investigative workflow. Your crypto AML compliance software stack handles the regulatory clock; the fraud layer handles the rescue clock.

The four fraud patterns that actually drain accounts

Vendors market against an endless taxonomy of scams, but exchange losses concentrate in four patterns, and each one needs a different detection signal.

Investment scams, including pig butchering. The scammer builds trust over weeks, then walks the victim through buying crypto on your legitimate exchange and sending it to a fake investment platform. The victim passes every identity check because they are exactly who they claim to be. The tell is on the other side of the transaction: the destination address clusters with thousands of other victims' deposits. This is where blockchain-intelligence vendors earn their fees — Chainalysis attributes scam infrastructure through on-chain clustering plus off-platform signals, so the address your customer is about to pay has often been flagged before your customer ever met the scammer.

Image: Chainalysis — a Scout entity profile scores a counterparty wallet 99.99 with a Severe risk level and a Scam label, the signal an exchange needs at withdrawal time.

Account takeover. Credential stuffing, SIM swaps, and phishing kits give an attacker control of a real customer's account. On-chain intelligence is useless here until the theft is already broadcasting; the detection surface is behavioral. A login from a new device, a password and 2FA reset in quick succession, an immediate address-book change, then a full-balance withdrawal — that sequence is the signature. Device-intelligence platforms like Sardine fingerprint the session; rules platforms like Unit21 let you encode the sequence as a velocity rule that steps up authentication instead of blocking outright.

Authorized push payment fraud. The customer is manipulated into sending the payment themselves — a fake exchange support agent, a spoofed bank warning, a romance scam that has escalated to an urgent transfer. Because the customer authorizes it, nothing about the session looks compromised. Detection depends on counterparty risk and on friction placed well: a plain-language warning interstitial when the destination scores high, with the specific reason shown.

Money mules. Recruited or witting account holders receive stolen funds and forward them onward, turning your exchange into a laundering hop for someone else's fraud. Mule accounts look like ordinary customers at onboarding, then show a distinctive pass-through shape: deposits from many unrelated sources, brief dwell time, structured forwarding. This pattern overlaps with AML monitoring, which is exactly why the fraud and AML layers should share a case system — a mule network is simultaneously a fraud problem and a SAR obligation.

Underneath the marketing, crypto fraud platforms combine four signal families, and knowing which family a vendor is strong in tells you what it will catch.

Counterparty intelligence. The vendor maintains attribution for scam wallets, drainer contracts, fake investment platforms, and mule networks, then scores any address your customer interacts with. This is the highest-value signal for investment scams and APP fraud because it works even when the customer and session are completely legitimate.

Behavioral and device signals. Session fingerprints, typing cadence, device history, geolocation velocity, and the sequence of account actions. This is the account-takeover layer, and it fires before any blockchain transaction exists.

Transaction shape. Velocity rules, structuring detection, dormancy-then-drain patterns, first-time-counterparty size checks. Cheap to run and explainable to examiners, but noisy without the other two families to confirm.

On-chain protocol telemetry. For platforms holding treasury or running their own chain infrastructure, real-time monitoring of smart-contract interactions catches drainer approvals and exploit-adjacent activity. Chainalysis Hexagate, which watches contract-level threats, is the clearest example of this family.

Image: Chainalysis — the Hexagate dashboard tracks risk events by severity alongside a real recent-exploit feed, including the July 2024 WazirX incident.

A useful mental test when a vendor demos: ask which of the four families the score in front of you is built from. A platform that only has transaction-shape rules will present itself identically to one with deep counterparty attribution, right up until a pig-butchering case walks past it.

Image: Chainalysis — Hexagate's threat feed surfaces model-flagged suspicious transactions with the hash and initiator, the raw material an investigator pivots from.

Comparing the main crypto fraud detection platforms

Because no single public source compares crypto fraud tooling side by side, we compiled one from vendor documentation, product pages, and regulator guidance current as of September 2026.

Two honest caveats on the table. First, the counterparty vendors overlap heavily; the differentiator is attribution depth in your specific corridors, which you can only test with your own historical cases. Second, the behavioral platforms were built for card and ACH fraud and vary widely in how natively they understand crypto withdrawal semantics — ask specifically how they treat a first-time on-chain counterparty versus a first-time ACH payee.

Every fraud tool ships with the same failure mode: turned up, it holds a quarter of legitimate withdrawals and your support queue melts; turned down, it waves the pig-butchering wire through. The teams that escape this trap follow a few rules.

Score at decision points, not continuously. The moments that matter are login, credential change, deposit-address add, and withdrawal initiation. Scoring those four events well beats scoring every page view badly.

Make the response proportional to the score. A mid-range score should trigger step-up authentication or a warning interstitial, not a frozen account. Reserve hard holds for high-confidence counterparty matches — a destination address attributed to an active scam cluster — where the false-positive cost is low and the save value is high.

Image: Chainalysis — Hexagate's monitor builder lets a risk team choose exactly which threat categories and severities page a human, which is how alert fatigue gets contained.

Tell the customer why. A hold that says "transaction under review" generates a support ticket and an angry tweet. A hold that says "the address you are paying has received funds from 1,400 other people this month and is linked to investment-scam reports" converts a meaningful share of victims into grateful customers. The interstitial is part of the control.

Feed outcomes back weekly. Every hold resolves as a confirmed save, a false positive, or an inconclusive. That label stream is the only ground truth your thresholds will ever get; teams that review it weekly tune in weeks, teams that do not are still guessing a year later.

Common mistakes that undermine fraud programs

• Running fraud rules inside the AML engine and accepting its clock. An alert reviewed in four days documents a loss; it does not prevent one. The fraud layer needs to decide before the transaction broadcasts.
• Screening deposits but not withdrawals. Deposit screening protects you from dirty inbound funds; withdrawal screening protects your customer from being robbed. Programs routinely build the first and skip the second, which is backwards for fraud.
• Treating repeat victims as closed cases. Pig-butchering victims are re-targeted, and recovery-scam operators buy victim lists. An account that hit one confirmed scam should carry elevated friction on new counterparties for months, not return to baseline the day the case closes.
• Buying attribution and never testing it. Vendors differ most in corridor-specific coverage. Run your last fifty confirmed fraud cases through any tool you are evaluating before signing; the hit rate on your own history is the only benchmark that transfers.

Image: Chainalysis — Hexagate's contract assessment lists the specific security checks an address passed or failed, from mixer interactions to OFAC status, giving investigators reasons rather than a bare score.

"We are a mid-size US exchange and we bolted withdrawal screening onto our existing AML vendor first because procurement was faster," one compliance head told us. "The save that paid for the year was a 60-year-old customer sending 85,000 dollars to a fake mining platform. The hold interstitial showed her the cluster evidence and she called us instead of the scammer."

"We are a European neobank that added crypto rails last year, and account takeover was our loss center, not scams," a fraud lead said. "Device intelligence at login plus a 24-hour cooling period on new withdrawal addresses cut ATO losses by more than half before we bought any blockchain analytics at all."

"We are a small brokerage and we could not afford two investigation teams," an operations manager explained. "So fraud holds and AML alerts land in one queue with different clocks — fraud cases must be touched within four hours. One team, two service levels. Examiners liked it more than our old split system."

The pattern across all three: the win came from putting an existing signal at the right decision point, not from buying the most expensive platform.

Frequently asked questions

Is fraud detection software legally required for crypto exchanges?

Not by name. US exchanges registered as money services businesses must run an AML program with suspicious-activity monitoring, and FinCEN alerts make clear that institutions are expected to detect patterns like pig butchering. Fraud prevention itself is driven by loss exposure, customer-protection rules in some jurisdictions, and increasingly by reimbursement pressure — but a fraud tool does not satisfy your AML monitoring obligation, and vice versa.

Can one vendor cover both fraud and AML monitoring?

Sometimes. The large blockchain-intelligence vendors sell screening that feeds both programs, and rules platforms like Unit21 host both rule sets. What matters is that the two clocks stay separate: fraud decisions in seconds at the transaction path, AML investigation on the regulatory timeline. One vendor is fine; one undifferentiated alert queue is not.

What does crypto fraud detection software cost?

Counterparty-screening APIs typically price per screened transaction or as annual platform tiers, commonly starting in the tens of thousands of dollars per year for a mid-size exchange. Behavioral platforms price per active user or per session scored. Most teams find total cost lands well below annual fraud losses prevented, but the honest way to size it is to price your last year of confirmed fraud losses first.

How do these tools detect pig butchering specifically?

Through the destination, not the victim. Scam operations reuse wallet infrastructure across thousands of victims, so clustering links the address your customer is about to pay with previously reported scam deposits. When the score comes back severe at withdrawal time, the exchange holds the transaction and shows the victim the evidence. FinCEN's 2023 alert lists the same behavioral red flags — new investment enthusiasm, urgency, a counterparty the customer has never transacted with — that behavioral layers encode as rules.

Do fraud holds create regulatory risk of their own?

Holds need a clear policy basis, consistent application, and prompt review — an indefinite freeze without communication generates complaints and, in some jurisdictions, regulatory attention. The well-run pattern is a short automatic hold, a specific customer-facing reason, a fast human review, and documented outcomes. That paper trail also becomes your evidence file when the same case turns into a SAR.

Sources

• FBI Internet Crime Complaint Center, "2024 IC3 Annual Report" — April 23, 2025. Reported cryptocurrency fraud losses of 9.3 billion dollars for 2024.
• FinCEN, "FIN-2023-Alert005: Alert on Prevailing Trends in Virtual Currency Investment Scams (Pig Butchering)" — September 8, 2023.
• Chainalysis, "2025 Crypto Crime Report" — February 2025. Scam revenue and infrastructure attribution trends.