In 2024, addresses identified as illicit received $40.9 billion, while the amount of funds stolen from services increased by 21% to reach $2.2 billion, according to Chainalysis. For an exchange owner, these are not abstract statistics: sooner or later, a platform without effective controls will process funds belonging to someone else, stolen funds, or laundered money, and the consequences of allowing such a transaction through may affect relationships with banks, the service's licence, and its reputation. Below, we examine the different layers of this protection, the data it checks, and how to configure it so that customers do not complain about unnecessary blocks.

What Is an Anti-Fraud System in a Crypto Exchange

In simple terms, an anti-fraud system is a set of rules, scoring models, and manual checks that compare each exchange request against the customer's normal behaviour, the transaction amount, and the recipient's address. The system does not replace KYC at the onboarding stage: it operates afterwards, at the level of a specific transaction, and determines whether to approve the transaction immediately, put it on hold, or refer it to an operator. For most exchanges, this is not a standalone service but a combination of a rules engine, wallet scoring, and a manual review queue.

Which Transactions Should an Anti-Fraud System Monitor

Controls are needed wherever money changes form or route faster than an operator can respond. Transactions that are usually subject to checks include: one-off large exchanges that deviate from a customer's transaction history; a series of small consecutive transfers that resemble the splitting of a single transaction; exchanges involving wallets previously linked to scams or sanctions lists; and sudden changes in the customer's usual exchange direction or currency. Particular attention should be paid to stablecoins: according to Chainalysis data for 2024, they already account for 63% of all illicit cryptocurrency transaction volume, whereas Bitcoin dominated just a few years ago. Networks of interconnected wallets also deserve special attention: if several formally separate accounts exchange funds with one another before withdrawing them to a large exchange, this is also grounds for a review, even if each individual transaction is relatively small.

What Data Does Anti-Fraud Analyse

Before making a decision, the mechanism collects several layers of data: the history and risk profile of the recipient's wallet, the amount and frequency of the customer's transactions over the previous few days, the device and IP address from which the request was submitted, and the KYC data the customer has already provided during registration. According to TRM Labs, wallet screening includes checking the address against databases of sanctioned and scam-related addresses, analysing behaviour such as sudden transfers or the use of mixers, and assigning a risk score based on links to previously flagged wallets. The broader the scoring provider's database, the lower the likelihood of missing a wallet that was flagged only yesterday.

How Does Anti-Fraud Check an Exchange Request

The question of “how anti-fraud works” in a particular service usually arises for an exchange owner during the first week after launch, when the system begins putting some requests on hold. The logic is generally the same: a request is submitted, the recipient's wallet is screened, the customer's data and transaction amount are checked against the rules, and the result leads to one of three scenarios: automatic approval, manual review, or rejection. Speed is critical here: address screening by TRM Labs takes less than 400 milliseconds and covers more than 70 million addresses across 29+ blockchains, so the delay is almost imperceptible for a legitimate customer.

How Is the Risk Level of a Transaction Determined

The final risk score is based not on a single indicator but on a combination of factors: the wallet's risk level, the amount and frequency of transactions, the country and payment method, and the customer's own verification level. TRM Labs allows clients to configure more than 150 risk parameters, including exposure type — direct, counterparty, or indirect — and categories such as sanctions, scams, or darknet exposure. In practice, an exchange sets its own thresholds: the trigger threshold for a verified customer with an established transaction history is higher than for a new account with no history. The weightings should be recalculated at least once a quarter: old thresholds quickly become outdated as the customer base changes or new methods of circumventing limits emerge in the market.

What Happens If Anti-Fraud Detects Suspicious Activity

If a transaction receives a high risk score, events can develop according to several scenarios. A minor deviation is usually handled through an additional information request: the exchange asks the customer to confirm the source of funds or the purpose of the payment. A match with a sanctions list or an obvious scam address usually results in the transaction being frozen and an internal report being sent to the compliance team. Ignoring such signals can be costly: in March 2026, a South Korean regulator fined a major crypto exchange $24.6 million and suspended some of its operations for six months specifically because of gaps in AML and KYC controls, according to Sumsub.

Anti-Fraud and AML: What Is the Difference

AML refers to the broader regulatory framework: compliance policies, customer identification, regulatory reporting, and requirements such as the Travel Rule, which requires sender and recipient information to be transmitted when transferring virtual assets, as explained by the FATF in Recommendation 16. An anti-fraud system operates as an operational layer on top of this framework: it consists of specific rules and models that determine the outcome of an individual request in real time. AML answers the question of which procedures a business is required to follow, while operational protection addresses another question: what should be done with this particular transaction right now?

Automated and Manual Anti-Fraud Control

Fully automated control saves time but inevitably makes mistakes: overly broad rules block legitimate customers, while overly narrow rules allow genuine threats to pass through. According to Sumsub, 60% of surveyed crypto companies named false positives and missed cases as the main verification challenge in 2025, rather than slow verification speeds, as might have been expected. Therefore, an effective model is almost always hybrid: automation handles the main transaction flow and instantly approves standard transactions, while only borderline cases enter the operator's queue — a new wallet with no history, an unusual amount, or a change in the country of login. At the same time, the operator needs to see not merely a “block” or “approve” verdict but the complete set of factors that resulted in the score; otherwise, reviewing a single borderline case takes no less time than the check itself.

How Anti-Fraud Integrates into a Crypto Exchange's Infrastructure

Technically, protection is integrated via API at several points in the transaction flow: when a customer registers, before funds are withdrawn, and at the moment of the exchange itself. A wallet-screening request is sent to an external provider such as TRM Labs, while the rules and scoring are processed by the exchange's own engine or a separate SaaS service. The result is then returned to the operator through the platform interface, where the owner can see the status of the request and manually remove or confirm the block. The fewer manual steps there are between screening and the decision, the lower the risk that the operator will simply fail to respond to the alert in time. Some exchanges build a small time buffer into the interface: the scoring provider may respond quickly, but the exchange's own request queue can sometimes operate more slowly, and it is more sensible to account for this in advance.

How to Configure Anti-Fraud Without Generating Too Many False Positives

The way to reduce unnecessary blocks is not to disable rules but to calibrate them. First, customers should be divided into risk profiles: a new account, a verified regular customer, and a VIP with a history of large exchanges, with a separate trigger threshold set for each group. Next, it is useful to feed the outcomes of manual reviews back into the model: if an operator repeatedly removes blocks from the same type of transaction, the rule should be relaxed. Finally, it makes sense to consider not only the amount but also the context: the same transfer looks very different for a customer with a six-month history and for an account registered yesterday.

Why Does a Crypto Exchange Need Anti-Fraud

An exchange needs controls for much more than simply meeting regulatory requirements. A data breach or an undetected fraudulent transaction creates direct costs for the business: according to IBM data for 2026, the average cost of a data breach reached a record $4.99 million worldwide, while for the financial sector, including crypto platforms, the figure is even higher at $6.3 million per incident. Partner banks through which an exchange handles fiat transactions also pay attention to blocking statistics: if too many fraudulent cases are allowed through, the platform risks losing its bank account faster than it receives a fine from a regulator.

Anti-Fraud as Part of the Infrastructure of a Modern Exchange Service

Controls are no longer a separate checkbox on a compliance checklist; they have become part of an exchange's core infrastructure alongside wallets, exchange rates, and payment gateways. Customers expect a legitimate exchange to be completed within seconds, while regulators and partner banks expect suspicious transactions not to go through at all, and both objectives are addressed by the same set of rules and models. An exchange that takes this layer seriously from the outset spends less time on disputes with banks and less effort explaining delays to customers who have waited longer than usual for a transfer. In this model, the support team and the compliance department work with the same request data rather than comparing two independent reports after an incident has already occurred.

Conclusion

A fraud protection system in an exchange operates as a combination of rules, scoring, and manual review positioned between the customer's request and the actual transfer of funds, filtering out transactions that do not resemble normal behaviour. For an exchange owner, this leads to a practical conclusion: thresholds should not be configured only once at launch but should be reviewed regularly as the customer base grows and new fraud schemes emerge.

The BoxExchanger platform helps manage exchange rates and exchange directions, so configuring controls is handled in conjunction with the service's other operational parameters rather than separately from them.

The information presented in this article is for informational purposes only and does not constitute a guide to action, financial recommendation, or investment advice. Cryptocurrency investments involve a high level of risk, and every investor should conduct their own analysis, assess their financial capabilities, and consult professional financial advisers before making investment decisions.