What AMLBot's 2026 crime report means if you swap without KYC

On 16 October AMLBot, a blockchain-analytics company, published a summary of its Crypto Investigations Report 2026. It covers more than 250 crypto crime cases the company investigated from 1 January to 13 October 2026, with $291.6 million in reported losses: $227.5 million for January–September and $64.1 million in cases opened in the first 13 days of October (AMLBot).

What makes it different from the usual yearly tallies is where the numbers come from. Most of the cases were brought by victims themselves — individuals, businesses and exchanges — so the report shows how crypto crime reaches ordinary users, not only the hacks that make headlines. AMLBot itself notes the limits: the losses are what victims reported when a case opened, and people who pay for an investigation tend to have lost more than average.

What did the report find?

• Reported losses keep growing, the typical case is getting smaller. Losses rose from $62.9 million in Q1 to $75.9 million in Q2 and $88.7 million in Q3, while the median loss fell from $223,000 in Q2 to $113,000 in Q3. A few very large cases drive the total.
• Hacks are rare but expensive. In Q3 hacks were 19% of cases but 40% of reported losses ($35.9 million). The median hack was $359,000, against $85,000 for phishing and wallet compromise.
• People are the main target. Phishing, wallet compromise, scams and social engineering made up 72% of cases from January to September. Individual users were the target in 77% of cases.
• For exchanges, the threat is hacks. Centralized exchanges were 7% of cases but 18.8% of reported losses, and 81% of cases involving exchanges and other custodial services were hacks or exploits.
• Bitcoin cases are fewer but bigger. Bitcoin was involved in 20% of cases and had the highest median loss of the four most-involved networks, $364,000. Ethereum (36%) and TRON (33%) — the two main USDT networks — appeared most often.

Why does this matter if you swap without KYC?

One finding is about money moving, not money lost: AMLBot’s investigators saw stolen stablecoins converted into BTC and ETH quickly, through decentralized exchanges and cross-chain routes, so that no issuer could freeze them. The report’s advice to victims is to file freeze requests within hours, because that window closes fast.

Those routes — a stablecoin in, a native coin out, sometimes across chains — are exactly what an instant swap does for everyone else. That is why many swap services screen incoming coins, and why a perfectly ordinary swap can be held after the deposit: if your coins passed close to a hacked or flagged address, the service’s screening partner may stop the order and ask where the funds came from. It is the most common complaint we read, and it is the reason we quote each service’s KYC and screening terms word for word in its review.

The report’s exchange numbers point the same way from the other side. If 81% of exchange cases are hacks, then who holds your coins during a swap matters. A non-custodial route keeps the window short; a custodial one asks you to trust the operator’s wallets for as long as the order runs.

What else happened in the niche this week?

• Pirate Chain (ARRR), 14–15 October. An attacker used two validation flaws in the network’s Ironwood upgrade (activated on 3 October) to create about 39.8 million ARRR — roughly a fifth of the supply — inside the coin’s own shielded pool. The team first proposed rolling the chain back to 14 October, then dropped the plan the same day, saying a decentralized network cannot roll back unilaterally (Startup Fortune). If you hold or swap ARRR, check whether your exchange has paused it before you send.
• Drift Protocol, 20–21 October. Wallets linked to the April hack of the Solana exchange moved about 44,510 ETH, roughly $109 million, into Tornado Cash over two days; the Drift Foundation said on 1 October that about $9.2 million of some $295 million stolen had been frozen (Crypto Briefing, The Crypto Times). Large flows like this are what screening tools watch for — and what can make coins that later pass nearby look risky.
• PHP2Shell, from 21 October. Two critical flaws in PHP (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) allow remote code execution on PHP servers, with exploitation attempts reported before patches were out (CoinGape). Smart contracts and cold wallets are not affected; web front ends and dashboards of swap services built on PHP may be. Our site does not run PHP.

What should you do before your next swap?

1. Read the service’s KYC and screening terms first — in our reviews they are quoted verbatim, with the clause number and the date we last read them.
2. Prefer a short custody window. Non-custodial routes and services that say who holds coins during a swap carry less of the risk the report describes.
3. Send a small amount first on a service you have not used, and keep the order ID and transaction hashes until the coins arrive.
4. If a swap is held, see our guide What to do if a no-KYC exchange freezes your funds — and record everything at once, because, as the report says, the window for any recovery is measured in hours.