Operation Level Up is a federal initiative launched in early 2024 that allows U.S. law enforcement to identify people who are actively losing money in crypto investment scams and intervene before further losses occur.
The program is led by the Federal Bureau of Investigation with operational and financial crime support from the United States Secret Service.
Its core function is simple but structurally different from traditional fraud enforcement: investigators trace scam-related crypto activity in real time, identify the individuals sending funds, and warn them directly while the scam is still in progress.
This model exists because crypto investment fraud now represents the single largest category of reported online financial losses in the United States.
Once funds leave a victim’s account and move through multiple wallets and offshore exchanges, recovery is rare. Preventing the next transfer is often the only meaningful way to limit damage.
Why Crypto Investment Scams Demand a Proactive Model
Investment fraud has changed faster than enforcement structures. Modern scams rely on long psychological conditioning, fake dashboards showing fabricated profits, and repeated capital injections that escalate over time.
Victims are rarely deceived in a single transaction. Losses accumulate gradually, which means there is a window where intervention is possible.
Traditional investigations typically start after a complaint is filed. In crypto cases, that usually happens only after withdrawal attempts fail and all funds are gone. Operation Level Up was designed to work upstream of victim awareness, using financial data rather than self-reporting as the trigger.
How Victims Are Identified: The Financial-first Approach
Identification begins with scam infrastructure, not individuals. Federal investigators maintain large, continuously updated datasets of wallet addresses, domains, fake trading platforms, and payment endpoints that have already been linked to confirmed fraud cases.
These datasets are built from prior investigations, victim complaints, exchange alerts, and interagency intelligence.
From there, analysts trace inbound blockchain transactions. Public ledgers allow investigators to see exactly which addresses are receiving funds, how often, and in what amounts.
Address clustering techniques are then used to determine whether multiple wallets are controlled by the same scam operation. This creates a map of the fraud ecosystem rather than isolated transactions.
Once inbound transactions are identified, investigators shift focus to the senders. When crypto is purchased or transmitted through regulated exchanges or financial institutions, those entities hold identity data under know-your-customer requirements.
Through lawful process, investigators can link transaction activity to real individuals and determine whether the sender is an active victim, a money mule, or part of the scam network.
Typical Data Sources Used in Operation Level Up
| Source type | Information obtained | Role in victim identification |
| Public blockchains | Wallet addresses, timestamps, amounts | Establishes transaction patterns and escalation |
| Crypto exchanges | Account ownership, funding sources | Links transactions to real individuals |
| Banks and wire services | Fiat on-ramps and payment history | Confirms victim-controlled accounts |
| IC3 complaints | Wallets, platforms, narratives | Seeds known scam infrastructure |
| Stablecoin issuers | Large flow monitoring | Identifies high-volume scam corridors |
Each source alone is incomplete. Combined, they allow investigators to distinguish coerced victims from intentional participants with a high degree of confidence.
The Secret Service Role in Tracing Mixed fiat and Crypto Flows
The involvement of the United States Secret Service reflects the reality that most crypto investment scams are not purely crypto-native. Victims often move money through multiple systems: bank wires, ACH transfers, card payments, crypto exchanges, and overseas off-ramps.
Secret Service agents specialize in following these hybrid flows. Their experience in financial fraud, money laundering, and payment systems helps connect the crypto layer to traditional banking records.
This is critical in cases where victims liquidate retirement accounts, take personal loans, or sell property to fund additional “investments.”
Behavioral Transaction Patterns That Signal an Active Victim
Operation Level Up relies on repeated patterns observed across thousands of cases. These patterns are statistical, not subjective.
| Pattern | Transaction behavior | Interpretation |
| Escalation curve | Increasing transfer sizes over time | Victim confidence manipulation |
| Platform-linked timing | Transfers follow fake profit updates | Scripted scam milestones |
| Single-destination clustering | Funds sent to related wallets | Centralized scam control |
| Rapid on-ramp movement | Crypto is purchased and then sent immediately | Victim-directed transfers |
| Fee-based follow-ups | New payments labeled as taxes or fees | Withdrawal-blocking stage |
These signals allow investigators to identify victims even when no complaint has been filed and no direct communication data is available.
From Identification to Intervention
Once investigators determine that a specific individual is actively sending funds into a known scam system, the case moves to intervention. Federal agents contact the person directly, typically by phone, using contact details obtained from financial institutions.
The purpose of the call is limited and precise. Victims are informed that the investment platform or wallet they are interacting with is fraudulent and that continued payments will result in loss. There are no requests for payment, no recovery offers, and no instructions to move funds.
In internal summaries released by the FBI, a large percentage of contacted individuals reported that they did not believe they were being scammed before the call. Even partial compliance, such as delaying a scheduled transfer, often prevents substantial additional losses.
What Operation Level Up Does Not Do
Understanding what the program does not do is essential, particularly because scammers attempt to impersonate law enforcement.
| Claim made to the victims | Legitimate under Level Up | Reality |
| Request to move crypto | No | Never required |
| Recovery fee demand | No | Always fraudulent |
| Request for private keys | No | Disallowed |
| Instructions to keep engaging the scammer | No | Victims are told to stop |
| Verification via gift cards or crypto | No | Clear scam indicator |
Most cases addressed by Operation Level Up fall under what federal investigators classify as the Pig Butchering Scam, a long-duration investment fraud model that combines financial manipulation with sustained psychological conditioning.
Unlike fast-hit fraud, these schemes rely on gradual trust building, staged profit displays, and escalating capital commitments over weeks or months.
The defining feature is not the initial solicitation but the repeated transaction cycle that follows, which creates a detectable financial signature long before the victim realizes anything is wrong.
Measured Outcomes and Impact
While exact figures change as the program expands, publicly released summaries from federal authorities indicate that Operation Level Up has already contacted thousands of individuals nationwide and prevented hundreds of millions of dollars in additional losses.
These numbers reflect prevented harm rather than recovered funds, which is a critical distinction in crypto fraud enforcement.
| Metric | Reported outcome |
| Program launch | January 2024 |
| Victims contacted | Thousands |
| Awareness at contact | Many are unaware they were scammed |
| Estimated losses prevented | Hundreds of millions of dollars |
| Primary scam type | Crypto investment and pig-butchering schemes |
Why This Model Matters Going Forward
Operation Level Up demonstrates that fraud prevention is most effective when it operates at the transaction layer rather than relying on consumer education alone. Even financially literate individuals fall victim to sophisticated investment scams.
By focusing on money movement, infrastructure reuse, and behavioral signals, law enforcement can intervene earlier and with greater precision.
The broader implication is clear. As long as crypto remains intertwined with regulated exchanges and financial institutions, proactive identification of fraud victims is possible. Operation Level Up represents one of the first large-scale efforts to operationalize that reality in real time.
Bottom Line
Operation Level Up works because it treats crypto investment fraud as a systems problem, not an individual failure.
By tracing known scam infrastructure, analyzing transaction behavior at scale, and intervening before funds are irreversibly lost, the FBI and Secret Service have shifted fraud enforcement from post-loss investigation to active loss prevention.
In the current crypto fraud landscape, that shift is not optional. It is necessary.
Read more: What are the most common types of internet crime charges and it’s possible penalties?
