US, UK, Canada launch Operation Atlantic against approval phishing

Law enforcement agencies in the United States, United Kingdom and Canada launched Operation Atlantic, a coordinated effort to disrupt approval‑phishing scams, recover stolen funds and increase public awareness. The campaign, which began Monday, is co‑hosted by the U.S. Secret Service, the UK’s National Crime Agency, the Ontario Provincial Police and the Ontario Securities Commission, with support from private industry partners.

According to the agencies, the operation focuses on identifying potential victims in near real time, tracing illicit cryptocurrency flows and intervening when possible to prevent further losses. The work relies on cross‑border information sharing among participating authorities and industry.

Approval‑phishing scams trick users into signing malicious blockchain transactions that grant attackers permission to move tokens from a victim’s wallet. Scammers often push fake pop‑ups or alerts that resemble trusted apps and ask the user to “approve” access. Once granted, funds can be transferred out, and recovery is difficult because crypto transactions are typically irreversible. Investigators link these schemes to broader crypto investment fraud known as pig butchering.

Related: Is QR code safe? 5 essential steps to avoid getting scammed

Additional participants include the Royal Canadian Mounted Police, the City of London Police, the U.S. Attorney’s Office for the District of Columbia and the UK Financial Conduct Authority. Agencies highlighted public outreach as a central part of the effort, with guidance on how wallet approvals work and the risks of signing transactions triggered by unsolicited prompts.

In a statement, Brent Daniels, deputy assistant director for the U.S. Secret Service’s Office of Field Operations, underscored the goal:

“Approval phishing and investment scams cost victims millions in financial loss each year. During Operation Atlantic, the U.S. Secret Service, alongside our international law enforcement partners, will identify and disrupt these scams in near real‑time denying criminals the ability to further profit from their crimes.”

Data compiled for 2025 shows reported approval‑phishing losses of $83.85 million across EVM‑compatible blockchains such as Ethereum, an 83% decline from $494 million in 2024, based on a year‑end analysis by Scam Sniffer. The number of identified victims fell to 106,106 from 332,000 a year earlier. The largest single theft in 2025 totaled $6.5 million, involving stETH and aEthWBTC stolen via a Permit signature in September. Eleven incidents exceeded $1 million, with Permit and Permit2 signatures accounting for 38% of those high‑value cases.

Despite the decline in tracked losses, analysts describe a growing commercial ecosystem behind these scams. Research by Chainalysis details phishing‑as‑a‑service networks that sell ready‑made kits to fraudsters, highlighting a China‑based group known as the Smishing Triad, or Darcula, which operated a vendor called Lighthouse. That service was found to have received more than 7,000 cryptocurrency deposits totaling over $1.5 million across three years, based on findings that reference a Google lawsuit filed in November 2025.

Related: Sanctioned states moved $154B in illicit crypto in 2025

Organizers of Operation Atlantic indicate the campaign aims to match that professionalization with faster information sharing and targeted disruption. Authorities urge users to verify any approval requests, avoid clicking transaction prompts from unsolicited messages or pop‑ups and review wallet permissions regularly to revoke unnecessary access.