TL;DR: Stablecoin transactions were found to be twice as risky as other payment types across Riskified’s global network, while account takeovers, credential stuffing, SIM swapping, and phishing remain the main upstream attack paths. Stable value increases fraudsters’ ROI and reduces recovery time, making identity behaviour and transaction controls the decisive defence, according to Riskified.
At a glance
What this is: Stablecoin adoption is lowering payment friction while increasing fraud appeal, because predictable value, high liquidity, and limited recourse make these assets easier to monetise once access is stolen.
Why it matters: Fraud, IAM, and identity-verification teams need to treat stablecoin accounts as high-risk targets where account takeover, behavioural detection, and transaction policy must work together.
By the numbers:
- 71% of customers new to cryptocurrency businesses were already connected through Riskified’s global merchant network.
Context
Stablecoin adoption expands the payment surface without removing the core fraud problem. The underlying issue is not price volatility, but the way predictable value, fast settlement, and low-friction transfer change the economics of account takeover, mule activity, and off-ramping.
For fraud and identity teams, the governance gap is that traditional transaction screening often assumes the asset itself is the main risk. In stablecoin environments, the decisive control point shifts upstream to identity behaviour, account access integrity, and policy-based limits. That is a fraud and identity-verification problem as much as a payments problem.
Key questions
Q: How should fraud teams handle stablecoin account takeover risk?
A: Fraud teams should treat stablecoin account takeover as an identity problem first and a payment problem second. The right response is to combine device risk, credential abuse signals, behavioural scoring, and step-up verification before a wallet can be drained or converted. Controls that only inspect the transaction arrive too late in the attack path.
Q: Why do stablecoins increase the value of account takeover for fraudsters?
A: Stablecoins combine predictable value with fast monetisation, so a compromised account can be drained and converted before a victim or platform can react. That makes account takeover a higher-return attack than it is in many other payment contexts. The attacker is buying speed, liquidity, and reduced traceability.
Q: What breaks when KYC and AML controls are not tied to wallet activity?
A: The platform loses visibility into how funds move after onboarding, which lets mule networks and synthetic identities route value through multiple accounts or exchanges. KYC may still satisfy onboarding requirements, but without ongoing transaction and off-ramp monitoring it does not meaningfully constrain abuse.
Q: What should fraud teams do when stablecoin adoption starts accelerating?
A: They should review purchase limits, transfer thresholds, identity risk scoring, and off-ramp monitoring together rather than as separate controls. Adoption increases exposure fastest when growth teams optimise for frictionless use and risk teams only intervene after a loss pattern is already established.
Technical breakdown
Why stablecoin value changes fraud economics
Stablecoins remove the price volatility that makes some crypto theft less attractive, which changes the attacker’s expected return. When stolen value is predictable and liquidity is high, fraudsters can monetise access quickly and with fewer incentives to wait. That matters because fraud risk is not only about whether a payment rail is innovative, but whether it lets an attacker preserve value long enough to cash out. In practice, the same account compromise becomes more valuable when funds can be moved instantly and retain purchasing power. The result is a control problem built around settlement speed, traceability, and downstream conversion, not just payment authorisation.
Practical implication: Treat predictable-value assets as a fraud accelerator and tighten policy around balances, transfer speed, and conversion paths.
Account takeovers are the upstream control failure
The article’s strongest operational signal is that account takeover sits upstream of most stablecoin loss. Credential stuffing, SIM swapping, and phishing bypass the point where payment controls can still intervene, because the attacker is already acting inside a legitimate wallet or platform account. Once inside, the fraud path is usually short: drain funds, convert them, or route them through other assets before investigators can react. This is why identity proofing and session risk matter even in payment-focused environments. If the platform only reacts at transaction time, it is already too late for the highest-value abuse cases.
Practical implication: Move detection earlier in the journey by correlating login risk, device change, SIM swap signals, and unusual wallet activity.
KYC and AML gaps widen off-ramping risk
Stablecoins become most damaging when they cross into money mule networks and cross-border exchanges, because layered movement makes recovery and attribution harder. Weak or inconsistent KYC and AML practices across jurisdictions create safe havens for illicit off-ramps, especially when synthetic identities are used to fragment the trail. This is not just a compliance issue. It is a governance failure where customer verification, beneficiary visibility, and transaction monitoring are too loosely connected to stop rapid value extraction. The more portable the asset, the more important it becomes to understand who controls the account and where the funds are going next.
Practical implication: Strengthen KYC, AML, and off-ramp monitoring together so identity assurance follows the money across jurisdictions.
Threat narrative
Attacker objective: The attacker seeks to turn account access into quickly monetised, low-trace value before identity and transaction controls can intervene.
- Entry begins with credential stuffing, SIM swapping, or phishing that gives the attacker access to a legitimate customer wallet or fintech account.
- Credential access is followed by immediate abuse of the wallet balance, because stablecoin value is predictable and can be transferred or converted quickly.
- Impact comes through rapid draining, mule routing, or off-ramping, which reduces traceability and recovery time for the victim and the platform.
Breaches seen in the wild
- Mailchimp breach 2022: Attackers socially engineered Mailchimp staff, used a support tool to export 102 customer lists and exposed customer API keys for phishing.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Stablecoins create a fraud scaling problem, not a crypto-only problem. The article is really about how predictable value and faster settlement improve the economics of abuse. That shifts the security question from whether a token is novel to whether identity, access, and transaction controls can keep pace with its liquidity. Practitioners should treat stablecoin adoption as a fraud-control redesign trigger, not a product-feature discussion.
Account takeover is the control gap that matters most. Credential stuffing, SIM swapping, and phishing are not side issues here, because they are the entry points that turn a wallet into an instant loss event. The deeper governance failure is assuming transaction controls can compensate after authentication has already been defeated. Fraud teams need to align identity assurance, device risk, and payout policy as one control plane.
Stablecoin off-ramping exposes the weakness of disconnected KYC and AML decisions. Once funds move through mule networks or cross-border exchanges, recovery becomes a race the defender usually loses. This is why the verification layer has to follow the asset lifecycle, not stop at onboarding. Verification trust gap: if customer identity is checked once but asset movement is never re-evaluated, the platform has no meaningful control over how value leaves the system. Practitioners should connect KYC, AML, and behavioural monitoring into one governed flow.
Fraud prevention for stablecoins is now an identity programme concern. The strongest signals in the article are behavioural, not purely financial: known bad actors, repeat compromise patterns, and rapid monetisation after account access. That intersects directly with identity verification governance, especially where synthetic identities or mule accounts blur the line between legitimate users and facilitated fraud. Fraud teams should operationalise identity behaviour as a first-class risk signal.
What this signals
Stablecoin adoption forces fraud teams to move earlier in the lifecycle. The control failure is not just at the checkout or transfer stage. It begins when identity risk is not connected to wallet access decisions, and that gap gets wider as stablecoins become more liquid and more attractive to organised fraud.
Behavioural identity signals are becoming more important than static customer profiles. In stablecoin environments, repeat compromise patterns, device churn, and abnormal account activity are often more useful than basic onboarding data. Practitioners should expect fraud models to rely more heavily on live identity behaviour than on point-in-time verification alone.
For practitioners
- Implement identity-behaviour scoring Correlate login anomalies, device change, prior exposure, and account age before approving stablecoin transfers or wallet changes.
- Set stablecoin purchase and transfer thresholds Use daily limits, velocity rules, and step-up checks for unusually large or rapid stablecoin movements, especially on newly created accounts.
- Link ATO signals to payout controls Trigger additional verification when credential stuffing, SIM swap indicators, or phishing-like login patterns appear before value can be drained.
- Tighten KYC and off-ramp monitoring Verify where stablecoin funds are going next and review mule-like routing patterns across exchanges, wallets, and jurisdictions.
- Broaden fraud detection beyond one vertical Use controls that learn from patterns across multiple payment and commerce environments, because fraudsters move to the easiest target rather than the most obvious one.
Key takeaways
- Stablecoin growth changes the fraud equation because predictable value and liquidity make compromised accounts easier to monetise.
- The strongest loss pattern in the article starts upstream with account takeover, not at the moment of payment.
- Fraud teams need controls that combine identity behaviour, transaction policy, and off-ramp monitoring rather than relying on one layer alone.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack surface, NIST SP 800-63 and NIST CSF 2.0 set the technical controls, and GDPR defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | SP 800-63B — Authentication | The article centers on account takeover and identity assurance for wallet access. |
| SP 800-63A — Enrollment and Identity Proofing | Synthetic identities and weak onboarding amplify mule and off-ramp risk. | |
| Recommendation — Apply SP 800-63B to strengthen authentication and step-up checks around stablecoin access. Use SP 800-63A to harden proofing before accounts can move stablecoin value. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Wallet abuse depends on over-broad access once a legitimate account is compromised. |
| Recommendation — Review entitlements and authorization boundaries so a stolen account cannot rapidly drain value. | ||
| GDPR | Art.32 — Security of Processing | Fraud controls here depend on protecting identity and payment data processed in stablecoin flows. |
| Recommendation — Apply Art.32 security controls to the identity and transaction data used in stablecoin risk decisions. | ||
| MITRE ATT&CK | TA0006;TA0009 — Credential Access; Collection | Credential stuffing, SIM swapping, and phishing are the attack paths described in the article. |
| Recommendation — Map stablecoin fraud indicators to credential access and collection techniques in your detections. | ||
Key terms
- Stablecoin settlement risk: The compliance risk created when stablecoins are used as fast, liquid settlement instruments in high-risk or cross-border flows. The concern is not the token alone, but the way it can accelerate layering, reduce friction, and make illicit movement harder to disrupt without coordinated monitoring.
- Account Takeover: Account takeover is unauthorized use of a legitimate account after an attacker obtains valid access through stolen credentials, tokens, or trusted integrations. The key security problem is that the resulting activity often looks normal to logs and controls, which makes containment and attribution harder than in a forced-entry breach.
- Off-Ramp: An off-ramp is the point where digital assets are converted back into fiat currency or moved into a form that is easier to spend or launder. Weak visibility at the off-ramp makes fraud recovery difficult because the asset can leave the controlled environment very quickly.
- Identity Behaviour Analysis: Identity behaviour analysis is the practice of monitoring how identities actually use access over time, not just what was approved at provisioning. It looks for abnormal patterns, privilege drift, and unexpected delegation so teams can detect risky activity and tie remediation back to the owning system or lifecycle state.
Deepen your knowledge
NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore nhimg.org for resources that connect identity governance to the broader security disciplines your programme depends on.
Published by the NHIMG editorial team on July 11, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org