I kept coming back to one number while reading the latest round of financial-crime headlines: seventeen billion dollars, gone in a single year to crypto scams and fraud. Not a theoretical risk. Not a rounding error on a balance sheet. Seventeen billion. If you work anywhere near payments, compliance, or even ordinary customer support, that figure should make you sit up. Most of the people tasked with stopping this still say they do not know the subject well enough. That gap is exactly why a major anti-financial crime association and a blockchain intelligence firm have just widened their joint training program, with a redesigned certification scheduled to open on November 19, 2026.
This is not a story about a new coin or a price chart. It is a story about skills. The people who are supposed to spot dirty money are, by their own admission, behind the criminals who move it. Perhaps the most interesting part is how blunt that admission was. At a large professional gathering in Las Vegas this year, 79 percent of surveyed anti-financial crime staff picked crypto and digital assets as their biggest training or knowledge gap. Nearly four in five. I have sat in rooms where everyone nods at blockchain and then quietly hopes someone else will explain the bridge transaction. That nod is no longer good enough.
Why Crypto Crime Training Suddenly Feels Urgent
The redesigned Certified Cryptoasset AFC Specialist certification is the first major credential from this association to fold in material from a global partner. Pre-sales are already open. The launch date is fixed. On paper, that sounds like a product update. In practice, it is an admission that the old syllabus could not keep up with how money actually moves.
Identified illicit cryptocurrency addresses received at least $154 billion during 2025, according to the blockchain analytics firm involved in the partnership. Scams and fraud accounted for $17 billion of the harm. Those two figures do different jobs. The larger one measures what landed in wallets already flagged as illicit. The smaller one measures what victims lost to deception. Both matter. One tells you about the plumbing. The other tells you about the human cost.
I have found that people outside compliance often mix those numbers up. A scam loss is money a person thought they were investing, lending, or sending to someone they trusted. An illicit receipt is money that hit an address investigators already associate with crime. They overlap, but they are not the same ledger. Training that blurs them will produce analysts who sound confident and still miss the case.
The Knowledge Gap Nobody Wanted to Admit
Seventy-nine percent is an awkward statistic for a profession built on certainty. These were not students. They were working anti-financial crime professionals, the sort of people who already hold licenses, sit on committees, and file the reports everyone else assumes are routine. Crypto was still the hole in the floor.
Why the lag? Part of it is pace. A traditional money-laundering typology might take months to migrate from one corridor to another. A crypto scam script can be translated, cloned, and pointed at a new country before lunch. Part of it is vocabulary. Mixer, bridge, liquidity protocol, sanctioned mixer successor. The words change faster than the manuals. And part of it, if I am being honest, is status. For years, digital assets sat in a side room marked “innovation,” while the real compliance work happened in wires, trade finance, and correspondent banking. That side room now holds a large share of the loss data.
Staying ahead of financial crime requires practitioners to continually build new skills as threats and technologies evolve.
Association chief executive, on the expanded program
That line is corporate, sure. It is also accurate. The same executive described the partnership as training people to confront today’s blockchain threats and to anticipate what comes next. Anticipation is the hard part. Anyone can memorize last year’s scam. The useful analyst is the one who notices the new costume.
What the Redesigned Program Actually Covers
Four courses make up the revised path. One is an updated treatment of cryptoassets and blockchain, now carrying partner content. The other three are new: financial crime risks and regulatory frameworks, crypto compliance programs, and investigative case studies. That split is sensible. Technology without risk context produces hobbyists. Risk context without investigative practice produces people who can recite rules and freeze when a wallet graph appears.
The association says the material folds in recent regulatory developments, emerging criminal methods, and industry trends. Participants will work through case studies and exercises built around blockchain investigations. There is practice-focused online learning, plus an expanded practice exam of 300 questions. Three hundred. That is not a quiz you cram the night before. It is a signal that the credential is meant to be earned, not collected.
- Updated blockchain and cryptoasset foundations, with partner-contributed material
- Financial crime risks set against the regulatory frameworks that actually apply
- How to build and run a crypto compliance program, not just a policy PDF
- Investigative case studies that force you to follow funds instead of describing them
The intended audience sits across anti-money laundering, sanctions, and fraud. Their day jobs increasingly include reading blockchain activity, following illicit funds, and judging exposure to criminal transactions. If your role touches any of those three, this curriculum is aimed at you, whether your badge says bank, exchange, fintech, or advisory firm.
Scams, Laundering Networks, and State Actors
The threat picture in the announcement is deliberately wide. Sophisticated scams. International money-laundering networks. State-sponsored sanctions evasion. Those are not three versions of the same crime. A romance-investment hybrid that drains a retiree’s savings looks nothing like a professional network cycling proceeds through nested services, and neither looks like a state program trying to slip past a sanctions list. Training that treats them as one blob will fail all three.
What they share is speed and a public ledger. Practitioners need blockchain knowledge and tools that can process activity at the pace criminals operate. That second requirement is easy to underweight. Knowledge without tooling is a lecture. Tooling without knowledge is a dashboard nobody trusts. The useful combination is a person who can challenge the tool, not worship it.
The advantage the transparency of blockchains provides only matters if practitioners have the data, skills and tools to use it.
Blockchain intelligence chief executive
I like that sentence because it refuses the usual sermon. Transparency is not a moral victory. It is an option. If the analyst cannot read the trail, the trail might as well be a paper ledger in a locked cabinet. The same executive argued that compliance teams need tools able to identify and disrupt criminal activity at the same scale and pace as automated attacks. Scale and pace. Not a quarterly typology review. Not a PDF circulated after the loss has already settled.
Artificial Intelligence on Both Sides of the Desk
Criminals are using artificial intelligence to automate scams, manufacture synthetic identities, and hop money between blockchains in seconds. That is the offensive side. The defensive side showed up in a recent hack investigation, where analysts used AI to cut one transaction-matching task from more than twenty hours to under ten minutes. The breach in question dated to September 24. The public account of the tracing work landed in early October. The stolen asset was XRP. The path ran through a cross-chain liquidity protocol that paid out in Bitcoin. Subsequent hops led to Bitcoin addresses controlled by the attackers.
Here is the detail I would not skip if I were building a training module. Investigators built custom automation, kept control of the matching rules, reviewed the results, and decided which leads to chase. The time saving applied to that matching step, not to the whole trace. Human judgment stayed in the loop. That is the difference between a tool and a magic trick. Courses that sell the magic trick will age badly. Courses that teach the loop might actually stick.
Newly identified addresses, the firm said, received stolen-fund labels within minutes, so compliance teams using the same intelligence platform could see the finding while it was still warm. Minutes matter when an attacker is already bridging. Hours matter when a victim is still on the phone with a fake support agent. Training that never puts a clock on the exercise is training for a slower world than the one we have.
Physical Attacks Are Part of the Same File
Online theft is not the whole file. Research published in early August estimated that successful kidnappings, hostage situations, and home invasions extracted more than $30 million in the first half of 2026. The estimate covered publicly reported incidents and almost certainly understated the total. People do not always want a violent robbery in the newspaper, especially if the ransom moved in coins.
Successful forced transfers still leave a blockchain record. Some offenders sent stolen assets straight to centralized exchanges. More experienced operators used bridges, decentralized exchanges, and intermediary wallets before cashing out. Same crime, different hygiene. An investigator who only knows the clumsy version will miss the careful one. An investigator who only knows the careful version may overcomplicate a case that was, frankly, sloppy.
I keep thinking about the victim in these cases. The loss is not an abstract address. It is a person who opened a door, or whose family did. Compliance training usually lives in policy language. This corner of the problem does not. If the curriculum stays entirely inside transaction graphs, it will miss why some of those graphs exist.
What U.S. Stablecoin Rules Add to the Workload
American compliance staff have a second pile of reading. Treasury has proposed separate anti-money laundering and sanctions requirements for permitted payment stablecoin issuers under the GENIUS Act. In an April 8 announcement, Treasury said the financial-crimes bureau and the sanctions office had jointly proposed rules implementing the law’s illicit-finance provisions. The statute directs Treasury to treat permitted issuers as financial institutions under the Bank Secrecy Act and to impose anti-money laundering obligations. Permitted payment stablecoin issuers would also have to adopt and maintain effective sanctions compliance programs.
That is specific. It is not a vibe about “crypto regulation.” It is a statement that a permitted issuer sits inside a familiar legal frame, with program duties that banks already recognize and many crypto-native teams are still building. If your firm issues, redeems, or custodians a payment stablecoin aimed at the U.S. market, the training gap is no longer optional professional development. It is operational risk with a statute behind it.
Does every analyst need to become a sanctions lawyer? No. Does every analyst touching stablecoin flows need to know what an effective program looks like, and what a weak one excuses? Yes. I have watched teams treat sanctions screening as a vendor logo on a slide. The proposal does not care about the logo. It cares about whether the program works.
Complaint Data and the Limits of Any Single Number
A September 24 account of a federal crypto training forum in San Antonio described investigators, foreign law-enforcement partners, and crypto specialists in the same room. Discussions covered tracing illicit funds, scams, sanctions, and activity linked to North Korea. The bureau’s Internet Crime Complaint Center received 181,565 cryptocurrency-related complaints during 2025, with reported losses exceeding $11 billion. More than $7.2 billion of that total sat inside cryptocurrency investment fraud.
Read those figures with the caveat attached. They measure complaints submitted to that center. They do not capture every cryptocurrency-related crime committed during the year. Plenty of victims never file. Plenty of institutional losses never look like a consumer complaint. The $17 billion scam estimate and the $11 billion complaint total can both be directionally true without matching. Different nets, different fish.
Still, investment fraud dominating the complaint losses tells you something practical. The story that empties accounts is often not a clever exploit. It is a person, or a synthetic person, selling a return. Training that obsesses over protocol exploits and ignores the script on the phone will miss the larger bucket.
| Signal | Figure cited | What it actually measures |
| Scam and fraud losses | $17 billion in 2025 | Estimated victim losses to crypto scams and fraud |
| Illicit address receipts | At least $154 billion in 2025 | Value received by identified illicit addresses |
| Complaint-center losses | Over $11 billion in 2025 | Reported losses in 181,565 crypto-related complaints |
| Investment fraud slice | More than $7.2 billion | Subset of those complaint losses |
| Violent extraction | Over $30 million, first half of 2026 | Publicly reported kidnappings, hostage cases, home invasions |
| Training gap | 79 percent of surveyed staff | Share naming crypto as their biggest knowledge gap |
Tables like that are useful and dangerous. Useful, because they stop a conversation from collapsing into one scary number. Dangerous, because a reader may treat them as a single audited account. They are not. They come from different methods, different time windows, and different incentives to report. A good course will spend as much time on the footnotes as on the headlines.
How Investigations Actually Move, Once the Alarm Sounds
Take the September breach as a teaching case, stripped of heroics. Attackers moved XRP. Investigators had to match bridge deposits with payments on another chain. That matching used to be a long manual grind, more than twenty hours for the slice in question. Custom automation, with humans still owning the rules, compressed it to under ten minutes. The payout landed in Bitcoin via a cross-chain liquidity protocol. From there, the trail continued to attacker-controlled Bitcoin addresses. Labels propagated to newly identified addresses within minutes.
Notice what did not happen. Nobody solved the entire case by pressing one button. The time saving was local. The judgment about which lead mattered stayed human. That pattern should be the spine of any investigative module worth the name. Show the boring match. Show the rule the analyst refused to loosen. Show the hop that looked clever and was not. Show the hop that looked ordinary and was the exit.
Direct-to-exchange cash-outs are the beginner version. Bridges, decentralized exchanges, and intermediary wallets are the intermediate version. Neither is exotic anymore. If a case study still treats a bridge as an advanced topic reserved for the last slide, the case study is late.
What “Confront and Anticipate” Should Mean in a Classroom
The partnership language talks about confronting today’s threats and anticipating the next ones. Fine. What does that look like on a Tuesday? A few habits, in my view, separate a course that changes behavior from a course that changes a LinkedIn line.
- Start with a victim narrative, then open the graph. Context stops analysts from treating every hop as equally guilty.
- Force a clock. Ten minutes for a match. An hour for a first hypothesis. Deadlines reveal who is performing and who is deciding.
- Make students break their own rules. If the automation flags a cluster, ask what evidence would make them unflag it.
- Separate scam typology from laundering typology from sanctions typology in the same fact pattern. Real cases stack.
- End with a write-up a colleague could act on, not a screenshot. The job is a decision, not a picture.
None of that requires a brand name on the slide. It requires instructors who have missed a lead and are willing to say so. The expanded 300-question practice exam can test recall. It cannot, by itself, test nerve. Case work is where nerve shows up.
Who Should Care, Even If They Never Sit the Exam
Banks with crypto-exposed clients. Exchanges and brokers. Stablecoin issuers staring at the proposed program rules. Fintechs that on-ramp and off-ramp. Advisers who tell family offices that “blockchain is transparent, so the risk is contained.” That last group worries me. Transparency without skill is a slogan. The chief executive of the analytics firm said as much, in cleaner language.
Fraud teams should care for a narrower reason. Investment-fraud complaints are where a huge share of reported consumer loss sits. If your fraud playbook still assumes a wire to a mule account and a phone call to the beneficiary bank, you are playing last decade’s game on this decade’s losses. Crypto off-ramps, nested services, and instant cross-chain hops change the window in which a recall even makes sense.
Sanctions teams should care because state-linked evasion is named outright in the threat description, and because permitted stablecoin issuers are being pulled into program obligations that look familiar and will not feel familiar on day one. A sanctions analyst who cannot read a wallet exposure is going to lean entirely on a vendor score. Vendor scores are inputs. They are not the program.
A Practical Reading of the November Launch
Pre-sales are open. The certification becomes available on November 19, 2026. Between now and then, firms have a choice. They can treat the date as a marketing moment and buy seats for people who already like the subject. Or they can treat it as a gap-closing exercise and put the skeptics in the room, the ones who still route every crypto question to a single specialist two floors away.
I would do the second. Specialists burn out, leave, or become bottlenecks. A team where 79 percent of peers admit a blind spot cannot outsource the entire subject to one enthusiastic analyst. The four-course shape helps here. Foundations for the people who need vocabulary. Risk and regulation for the people who write policy. Program design for the people who own the control framework. Case studies for the people who will actually open a file at 6 p.m. on a Friday.
A simple staffing test before you buy seats: Who files the suspicious-activity narrative? Who challenges a vendor alert? Who talks to the sanctions officer when a hop looks state-linked? If those are three different people with three different vocabularies, you do not have a program. You have a relay race.
Relay races drop the baton. Crypto cases drop it at the bridge, at the label that arrived ten minutes late, at the stablecoin redemption nobody mapped to a customer. Training will not fix a broken operating model. It can stop the model from hiding behind ignorance.
Where the Numbers Still Leave Room for Doubt
Any honest article on this subject should say what it does not know. Illicit-receipt estimates depend on which addresses have been identified. Unidentified crime is invisible to that method, which means $154 billion is a floor for known clusters, not a ceiling for reality. Scam-loss estimates depend on methodology, reporting, and how aggressively analysts attribute flows. Complaint totals depend on who bothers to file. Violent-theft totals depend on what reaches the press. Training-gap surveys depend on who attended the conference and how the question was phrased.
None of that makes the direction unclear. Losses are large. The skill gap is admitted by the people inside the profession. Tools are getting faster, and so are the attacks. Regulation is pulling stablecoin issuers into program duties that used to live mainly in banks. You do not need false precision to justify better training. You need the humility to teach the limits of each number alongside the number.
Perhaps that humility is the part vendors dislike. A course sponsored alongside a data platform will be tempted to treat the platform as the answer. The better version of this partnership, the one worth the November launch, treats the platform as a instrument and the analyst as the person who can put it down. The Bitget-related tracing account, with its custom rules and retained human review, points that way. So does the warning that blockchain transparency only matters if someone can use it.
What I Would Watch After the Courses Go Live
Completion rates are a weak signal. Everyone can click through videos. I would watch three quieter things. First, whether case studies include failed traces, not only clean ones. Second, whether sanctions, fraud, and anti-money laundering students are forced to write a joint narrative on the same fact pattern. Third, whether the practice exam punishes confident nonsense. A 300-question bank that rewards jargon will reproduce the 79 percent gap in a nicer font.
I would also watch whether physical-threat cases stay in the curriculum once the marketing cycle moves on. Thirty million dollars in half a year is smaller than the scam total and harder to teach, because the offense is violent and the blockchain piece is only the cash-out. Leaving it out would be convenient. It would also be a miss. The same bridges and exchanges show up. The investigative habits transfer. The human stakes do not.
And I would watch the stablecoin rules as they move from proposal to practice. A certification that freezes the April proposal in amber will be outdated by the time someone frames the certificate. A certification that teaches people how to read a program obligation, map it to flows, and test whether the control fires will age better. Regulatory text changes. The habit of mapping text to a transaction does not.
A Plain Closing for Anyone Holding the Risk
Seventeen billion dollars in scam and fraud losses is a large enough number to end an argument about whether crypto crime training is a niche. One hundred fifty-four billion dollars received by identified illicit addresses is a large enough number to end an argument about whether the pipes are small. Seventy-nine percent of surveyed professionals calling this their biggest gap is a large enough number to end an argument about whether the industry already knows what it is doing.
The response on offer is concrete. Four courses. Partner content inside a flagship certification. Case work. A long practice exam. A launch date in mid-November. Tools that can label an address in minutes, provided a human still decides what the label means. Proposed U.S. rules that will not wait for everyone to feel ready.
If you run a team, do not send only the volunteer. Send the person who still thinks this is someone else’s problem. If you are that person, the graph is less mystical than it looks, and more unforgiving than the slides suggest. The ledger will sit there either way. The only open question is whether anyone in your building can read it before the next hop lands.
