TL;DR: Treasury’s GENIUS Act report correctly identifies digital-asset illicit finance as a growing threat, according to Blockaid, but still centres investigation over prevention even as it cites $5.8B in crypto scam losses, $2.8B stolen by DPRK actors, and 3.8 billion monthly transactions. The practical shift is toward pre-transaction interdiction, behavioural detection, and wallet-layer controls before settlement.
At a glance
What this is: Blockaid’s reading of Treasury’s GENIUS Act report says the federal framing of crypto crime is finally accurate, but the operating model still leans too heavily on after-the-fact investigation.
Why it matters: This matters because financial institutions and identity teams now need controls that act before settlement, not just reporting and attribution after a transaction has cleared.
By the numbers:
- $5.8B lost to crypto investment scams in 2024, up 47% year-over-year.
- $2.8B was stolen by DPRK cybercriminals in just 21 months.
- $1.5B was taken in a single DPRK heist in February 2025, the largest in history.
- 3.8 billion monthly transactions were recorded as of early 2025, up 96% year-over-year.
Context
The core problem is that digital-asset compliance is still designed around post-transaction review, even though blockchain settlement happens in seconds and reversals are often impossible. That creates a governance gap between what can be observed after the fact and what must be blocked before value moves, especially where wallets, dApps, APIs, and digital identity checks all participate in the same transaction path.
Treasury’s report points in the right direction by treating AI, digital identity, blockchain analytics, APIs, and DeFi as part of the same illicit-finance problem space. The real question for practitioners is whether their control stack can evaluate risk at the point of interaction, rather than assuming that investigation can compensate later.
Key questions
A: Start by moving risk checks upstream of settlement. If the control can only explain what happened after funds moved, it is not preventing illicit finance. Focus first on wallet and dApp decision points, then connect them to audit logging, escalation rules, and containment authority so a suspicious transfer can be stopped before it clears.
Q: Why do sanctions screens miss many crypto threats that behavioural detection can catch?
A: Sanctions screens depend on known addresses and entities, while modern attackers can generate new wallets and change infrastructure quickly. Behavioural detection looks for patterns in timing, sequencing, contract interaction, and movement logic. That makes it better suited to fast-moving campaigns where the address itself is not the main clue.
Q: What breaks when transaction risk controls sit after settlement?
A: The institution loses the ability to influence the transfer itself and is reduced to evidence collection. In irreversible systems, that means the control can support investigation but cannot prevent loss. The governance failure is not visibility, it is timing: the decision arrives after the asset has already moved.
Q: How should organisations balance API security controls with regulatory accountability?
A: They should tie API controls to ownership, evidence, and incident reporting rather than to policy statements alone. In practice, that means the team responsible for the API must be able to show discovery, logging, exception handling, and review records that support regulatory scrutiny and operational risk oversight.
Technical breakdown
Why pre-transaction controls matter in onchain compliance
Onchain compliance fails when the control point sits after the transfer. Once a blockchain transaction settles, the institution is no longer deciding whether to permit movement of value, only how to interpret it. Pre-transaction interdiction moves the decision earlier, into wallet interfaces, dApp front ends, smart-contract interaction checks, and API-mediated workflows. That makes the control model closer to real-time access governance than traditional AML reporting. The technical implication is that the system must evaluate wallet behaviour, contract reputation, and interaction context before signing or routing occurs, not after the ledger records the event.
Practical implication: Treat pre-signing risk checks as a control requirement, not a monitoring enhancement.
Behavioural detection vs address screening
Address screening looks for known bad entities, while behavioural detection looks for suspicious action patterns that may emerge from new wallets, fresh infrastructure, or rapidly changing attack chains. In practice, this matters because state-linked actors and professional fraud groups often rotate addresses faster than sanctions or watchlists can keep up. Behavioural systems use features such as transaction sequencing, contract characteristics, protocol interactions, and timing anomalies to identify probable abuse before the identity of the address is even established. That is a different control problem from list matching, and the two should not be treated as interchangeable.
Practical implication: Separate detection logic for known-entity screening from model-driven behavioural analysis.
Wallet-layer security as a governance control
Wallet-layer security pushes compliance enforcement into the interface where users initiate transfers. That can include transaction simulation, malicious contract detection, dApp risk scoring, and protocol-level pauses for suspicious activity. The architectural shift is important because the wallet becomes part of the control plane, not just the user experience layer. For identity programmes, this also raises the bar for how trust is assigned to endpoints, sessions, and delegated approvals. In effect, the wallet is acting as a policy enforcement point for digital value movement, which means governance must cover its data inputs, decision logic, and override rules. Read the Ultimate Guide to NHIs: Standards.
Practical implication: Govern wallet integrations like enforcement points, with explicit approval and audit controls.
NHI Mgmt Group analysis
Pre-transaction interdiction is now the decisive control layer for digital-asset risk. The report’s strongest idea is not its compliance inventory but its recognition that prevention has to happen before settlement. That changes the control objective from after-the-fact attribution to real-time decisioning at the wallet, dApp, and protocol interface. For financial institutions, this is the difference between documenting harm and stopping it.
Behavioural detection is a separate governance domain from sanctions screening. Address-based controls remain useful, but they cannot be the primary defence against actors who create new wallets to outrun watchlists. The operational mistake is to treat list matching as if it were a preventive control for dynamic threat behaviour. Practitioners should design for pattern recognition, not just entity recognition.
Digital identity and transaction authority are converging in onchain security. The report’s focus on APIs, digital identity, and DeFi shows that access governance no longer ends at login or onboarding. vendor security assessments matter here because third-party wallet, custody, and protocol integrations can become the enforcement surface for risk decisions. The practitioner takeaway is to govern who can trigger, approve, and override transaction controls, not just who can see balances.
APIs are becoming the policy boundary for illicit-finance controls. Treasury’s emphasis on API-enabled pre-transaction assessment reflects where enforcement now has to sit. That means control owners need clear expectations for latency, decision thresholds, exception handling, and evidentiary logging. The practitioner conclusion is simple: if the API cannot influence the transfer before settlement, it is not a prevention control.
What this signals
Pre-settlement risk control is becoming the new compliance boundary. The practical direction of travel is clear: institutions will be judged less on how well they can reconstruct a crime and more on whether they can block it before value leaves the system. That shifts programme design toward control placement, exception handling, and real-time governance rather than static reporting.
The governance implication for identity teams is that transaction authority now needs to be treated like privileged access. Wallets, protocol interfaces, and APIs increasingly decide whether a transfer can proceed, which means approval logic, audit evidence, and override rules belong in the same control conversation as authentication and authorisation.
For practitioners
- Implement pre-transaction decision points Place risk evaluation before signing, routing, or settlement in wallets, dApps, and payment workflows so suspicious transfers can be blocked in time.
- Separate screening from behavioural detection Run sanctions and known-entity screening alongside behavioural models that look for wallet sequencing, contract traits, and suspicious interaction patterns.
- Govern wallet and dApp integrations as control surfaces Review external integrations for override rules, audit logging, model inputs, and escalation paths because they now shape enforcement decisions.
- Define containment authority for active incidents Pre-authorise who can pause contracts, freeze bridge activity, or halt token transfers when a malicious pattern is detected.
Key takeaways
- Crypto compliance is moving from post-hoc tracing toward prevention at the point of transaction.
- The reported losses and transaction volumes show why settlement-speed risk is now a mainstream governance problem.
- Teams that still rely on address screening alone will miss the behavioural patterns that modern attackers use to evade detection.
Related NHI Mgmt Group resources: Ultimate Guide to NHIs: Standards · Vendor Security Assessment Template · AI Risk Assessment Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP API Security Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP API Security Top 10 | API8 — Security Misconfiguration | APIs are presented as the enforcement layer for pre-transaction digital-asset controls. |
| Recommendation — Apply API8 controls to harden transaction-checking endpoints and prevent unsafe policy bypasses. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Wallets and protocol interfaces now make authorisation decisions before settlement. |
| Recommendation — Use PR.AA-05 to govern who can approve, trigger, or override transfer controls. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | The report’s prevention model depends on limiting who can initiate high-risk transaction actions. |
| Recommendation — Enforce AC-6 so only tightly scoped roles can authorise or pause digital-asset transfers. | ||
| MITRE ATT&CK | TA0006;TA0040 — Credential Access; Impact | The threat pattern combines deceptive access to wallets with irreversible financial impact. |
| Recommendation — Map transaction-abuse scenarios to TA0006 and TA0040 to prioritise detection and containment. | ||
Key terms
- Pre-transaction interdiction: A control model that evaluates and can stop a digital-asset transfer before it settles. It shifts security from post-event investigation to real-time prevention inside wallets, dApps, APIs, or protocol interfaces where a transaction is first created or signed.
- Behavioral Detection: A monitoring approach that looks for unusual activity rather than relying only on static inventories. For SaaS integrations, it detects drift in token use, data movement, timing, and endpoint behavior so teams can spot compromise, misuse, or automation that no longer matches its expected pattern.
- Wallet-layer security: Security controls embedded in the wallet experience so risk decisions happen at the point of transaction initiation. This can include simulation, contract reputation checks, policy enforcement, and override controls, making the wallet part of the governance plane rather than a passive client.
- Protocol-level containment: A time-limited defensive action that pauses or constrains blockchain activity when active abuse is detected. It is most relevant when the threat moves faster than manual review, so operators need authorised ways to freeze bridging, transfers, or contract execution while they investigate.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management. It gives practitioners a practical foundation for governing privileged access patterns across modern identity programmes.
Published by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org