2026 FIFA World Cup is now live, but so are crypto scams – Here’s what TRM Labs found!

If you thought crypto had moved past scams and hacks, think again.

Just halfway through 2026, the year is already shaping up to be a rough one. We’ve seen multiple major DeFi exploits totaling over $600 million in losses, along with newer incidents like the Humanity Protocol hack. Security teams are still actively tracking and responding to attackers across different protocols.

And, the impact is showing up clearly in the market too. For example – Total value locked (TVL) in DeFi has now hit a near two-year low of around $68 billion – Signaling growing caution and a lot more fear in the space.

However, the impact doesn’t stay limited to protocols dealing with losses or post-incident recovery.

Instead, governments are also stepping in more actively. In 2026, the U.S government has ramped up efforts to curb crypto-related scams and illicit activity, including stronger enforcement actions (such as Tornado Cash by the U.S. Treasury’s OFAC) to flag suspicious on-chain flows earlier in the cycle.

Now, this push is extending into real-world events. The 2026 FIFA World Cup is live now and law enforcement agencies like the FBI and the LA County Sheriff’s Department are already warning that crypto scams may be targeting fans around the tournament.

More importantly, TRM Labs has already identified three live scam operations positioned specifically around World Cup traffic, reinforcing a broader pattern – Even with stronger enforcement and better analytics, coordinated actors still heavily use crypto for scam activity during major global events.

That’s why clearer rules and faster coordination between regulators, exchanges, and compliance teams matters more than ever.

How crypto scam funds are moving during the World Cup

TRM Labs has found three active crypto scams targeting World Cup fans.

Two are fake ticket sites and one is a fake betting scheme. They were already set up before the tournament started. Notably, TRM Labs linked them to multiple crypto addresses reported on Chainabuse, showing how scammers set up infrastructure early and then wait for event-driven demand to spike.

More importantly, TRM also tracked how funds move after payment. In the ticketing scam, money flows from Polygon into Tron. Meanwhile, in the betting scam, payments go straight into a custodial exchange deposit address for potential cash-out.

In fact, over $1.9 billion in scam funds have moved through bridges this way.

These are the scam setups with on-chain evidence available today.

For law enforcement, exchange compliance teams, and ticketing platforms, the key signal is therefore simple – The infrastructure already exists and can scale quickly during the World Cup. This highlights once again how quickly crypto scams can adapt around high-traffic events.

That’s why real-time monitoring, using tools like TRM Labs’s database, known reports from Chainabuse, and patterns like cross-chain swaps and exchange deposits, matters more than ever. As the tournament progresses, more linked addresses will likely surface, and early detection will be key to limiting exposure.

Final Summary

• Use real-time tracking tools like TRM Labs and Chainabuse to spot scam activity early during the World Cup.
• More crypto scam addresses will likely appear, so fast detection and coordination are key to stopping scams before they scale.

  ---