The Virtual Asset Service Providers Bill, 2025, requires every virtual assets service provider to open and operate a bank account in Kenya.
On February 28, 2025, detectives from the Directorate of Criminal Investigations (DCI) cornered and arrested two men in Kileleshwa for allegedly swindling a Chinese national of Sh6.5 million after posing as cryptocurrency exchange experts.
Cryptocurrency is a digital or virtual currency that does not require a central bank or financial institution to verify transactions. It is secured by cryptography and operates on a decentralised network using blockchain technology.
The duo, who masqueraded as crypto specialists, is alleged to have tricked the foreigner into believing they could facilitate a cryptocurrency exchange, only to disappear with the money. They were trailed and their scamming streak halted.
The two were later arraigned in court and charged with conspiracy to defraud.
A fortnight ago, two Nairobi men were arraigned at the Milimani Law Courts for defrauding a businesswoman of Sh15.4 million in a fake cryptocurrency investment scheme.
They were accused of luring the woman to a hotel in Nairobi, where they falsely claimed they could help her trade on Binance, a cryptocurrency exchange platform.
In yet another incident last month, three men and a woman defrauded a Nairobi businesswoman, allegedly making away with Sh13.5 million in a well-orchestrated crypto scam.
The cryptocurrency symbol of Bitcoin at the entrance of a private office in Bangalore, Pakistan on November 23, 2021.
In the latest incident on November 27, detectives from the DCI cornered and arrested a suspected notorious cryptocurrency swindler at Nakuru’s posh Kiamunyi Estate.
The suspect, who, according to police, has been operating under the fake names Abdirahman Abdikarim and Jamie Damon, had allegedly conned a Kilifi woman of Sh3.9 million in a sophisticated crypto swindle.
Investigators began pursuing him after the victim reported losing the money in what she believed was a legitimate digital currency investment.
Detectives linked the suspected cryptocurrency fraudster to a string of online scams that have, in the past, left victims across the country counting heavy losses.
“The suspect had created an elaborate network of digital transactions, fake crypto investment platforms and illegally registered SIM cards, which he used to conceal his identity and lure unsuspecting investors. He received funds through various mobile phone and online platforms before disappearing without delivering any returns,” revealed Nakuru County Police boss Emmanuel Epuru.
Bitcoin. The cryptocurrency market has grown exponentially in 2021 and is now worth a staggering $2.0 trillion.
DCI detectives from Kilifi North traced his digital footprints across several counties, eventually locating him in Nakuru City, where he had gone into hiding.
'Crime magnet'
These cases are just examples of more than 500 related incidents in the past three years in what DCI investigators now describe as a rising pattern of fraudulent cryptocurrency operations targeting both Kenyans and foreigners seeking quick returns in the booming digital currency space.
Cryptocurrency fraud has become extensive in Kenya. In 2024 alone, Kenyans lost over Sh5.6 billion to crypto-related fraud—a 73 per cent increase from the previous year, a DCI internal report shows.
“This year, more than Sh6 billion has been lost. Some Kenyans lose money but do not report the incidents,” revealed a senior detective aware of the current investigation plans but who spoke in confidence.
A report, From Risk to Resilience: AI and the Future of Cyber Risk Management, released last week, shows Kenya recorded Sh29.9 billion in cybercrime losses this year, while Africa-wide losses surged to Sh650 billion, reflecting increasingly sophisticated attacks.
The report is the latest Africa Cybersecurity Report, released by the Africa Cyber Immersion Centre (ACIC), which is the research arm of the cybersecurity firm Serianu Limited.
It was released in collaboration with partners and provides an analysis of cyber risks in Kenya and across the continent.
At least 280 organizations were surveyed, identifying dominant threat patterns, sector exposures, and the economic scale of emerging digital risks. Reports from the DCI indicate major financial losses.
Amid the worrying trend, the Nation established that 14 Kenyans have been flagged by Interpol for allegedly financing terrorism through cryptocurrency and other virtual assets.
“Already, four have been arrested as part of a continental crackdown on illicit financial flows,” said a senior DCI officer, who requested anonymity as he is not authorised to publicly comment on investigations.
The arrests are part of Operation Catalyst, a landmark swoop conducted between July and September 2025, which resulted in 83 arrests across six African countries and identified 160 persons of interest.
The countries involved in the swoop include Kenya, Angola, Cameroon, Namibia, Nigeria and South Sudan.
Money laundering
In Kenya, investigators uncovered a suspected money laundering syndicate using a virtual assets service provider with potential links to terrorism financing, involving a scheme worth Sh55.5 million.
Unlike traditional currencies, a central bank or government does not control cryptocurrency; instead, transactions are verified by a network of computers and recorded on a public, decentralized platform.
Cryptocurrency, which includes the most common one—Bitcoin—offers an opportunity to make money through staking by locking up coins to support the network’s operations, among other ways
However, fuelled by a lack of comprehensive regulation, rapid cryptocurrency adoption and the exploitation of human psychology, scammers have taken advantage of the technology to lure victims with promises of high, quick and guaranteed returns before swindling them.
In President William Ruto’s State of Security report presented to Parliament in November 2025, he mentions cryptocurrency fraud as a threat to national security.
“Cybercriminals have been exploiting cryptocurrency platforms for fraud, ransomware payments and anonymous transactions, thereby fuelling cybercrime — a threat to our national security,” states the report.
The rising tide of complex cryptocurrency fraud has prompted the DCI to form a specialised unit to pursue cryptocurrency criminals in a planned, ruthless crackdown.
“We are forming a specialised unit to crack down on cryptocurrency fraud. The DCI is committed to staying ahead of criminal syndicates. As criminals migrate to digital spaces that offer anonymity, law enforcement must innovate with equal speed,” said Ms Rosemary Kuraru, the Director of the National Forensic Laboratory at the DCI.
Growing economies
Kenya is a cryptocurrency hub in Africa, with over six million citizens owning digital assets.
The rapid growth, however, has exposed citizens to significant risks, including fraud, money laundering and terrorism financing, prompting the intervention of law enforcement agencies.
The DCI has already kicked off training for detectives who will be involved in the crackdown, equipping them with skills to combat cryptocurrency fraud.
Ms Kuraru launched the programme known as the “Blockchain and Cryptocurrency Investigation Training Module” early this week in Nairobi.
The training programme, funded by the European Union (EU), seeks to equip officers with the expertise required to handle fraud in the complex crypto ecosystem.
“Detectives will acquire skills on tracing and analysing blockchain transactions, investigating crimes related to digital wallets and cryptocurrency exchanges, applying international best practices in digital forensics and enhancing cross-border cooperation to tackle transnational digital crimes,” revealed Ms Kuraru.
“The initiative is critical for Kenya, which has been identified as a hub for cybercrime in Africa and was recently placed on a global financial watchdog’s ‘grey list’ due to gaps in curbing illicit financial flows.
"The proliferation of digital assets has brought both opportunity and peril. While many Kenyans use cryptocurrency for remittances and as an alternative financial solution, thousands have also fallen victim to fraudsters, losing billions of shillings,” she explained.
This new DCI unit aims to restore confidence and build a safer digital marketplace by making it harder for illicit actors to operate.
In an attempt to tame cryptocurrency fraud, President William Ruto has also assented to the Virtual Assets Service Providers (VASP) Bill, 2025.
The law aims to license and oversee crypto service providers, safeguard investors and restore trust in the market, as well as curb fraud.
The new law seeks to license and supervise firms dealing in digital assets such as Bitcoin, stablecoins and non-fungible tokens (NFTs).
Under the law, all businesses offering crypto-related services — including exchanges, brokers, wallet providers and token issuers — must obtain a licence from the Capital Markets Authority (CMA).
Operators will also be required to meet strict fit-and-proper tests, maintain adequate capital and ensure consumer protection measures before approval.
“A virtual service provider shall at all times maintain its business in a financially sound condition by complying with such things as capital, solvency and insurance requirements as may be prescribed,” the law states.
The law also requires service providers to implement robust data protection and cybersecurity standards, including encryption and secure storage of private keys.
Breaches must be reported promptly to the CMA and data authorities, including when a virtual assets provider becomes insolvent or is likely to become insolvent.
Operating without a valid licence will attract fines of up to Sh10 million, imprisonment for up to 10 years, or both, in the case of an individual.
For a company, a fine of up to Sh20 million applies.
A virtual asset service provider must maintain a registered office in Kenya, and its affairs must be managed by a board of directors with at least two directors.
Legal blockchain experts insist that the issue is not the technology itself, but the gap in public education and awareness.
“Lack of awareness fuels crypto scams. But the Virtual Assets Service Providers (VASP) Bill, 2025, will provide guidelines on how companies should operate,” says Keega Gakuua, an advocate and expert in cryptocurrency and digital assets.
“But even before the law is operationalised, Kenya already has laws like the Computer Misuse and Cybercrime Act that can be used to deal with crypto-related fraud,” he added.
According to experts, cryptocurrency fraud happens through various schemes such as fake investment platforms, giveaway scams and phishing.
“Scammers create fake websites or apps that look like legitimate crypto exchanges or investment platforms. They may pressure you to invest, sometimes allowing small initial withdrawals to build trust.
They can also send emails or messages that look like they are from a legitimate company to steal your private key, which is used to access and steal all the cryptocurrency in your digital wallet,” explained Tom Oduor, a cybercrime expert.
To protect themselves from cryptocurrency fraud, Mr Oduor advises Kenyans to remain sceptical about investment platforms, research before investing and avoid falling prey to celebrity endorsements.
“If something sounds too good to be true, it probably isn’t. No legitimate investment will pressure you to act immediately. Always research before choosing an investment platform and protect your personal information,” he said.
“Also, secure your accounts with strong, unique passwords and two-factor authentication. Never share your credentials with anyone,” he added.
According to the 2024/2025 Cybercrime Report, the magnitude of cyberattacks in Kenya has been consistently rising over the past year, leading to losses of over Sh30 billion.
