preferred on
Points of Focus
- Crypto scams reached at least $14 billion onchain in 2025, with the final figure projected to exceed $17 billion.
- AI-linked operations extracted an average of $3.2 million per scam versus $719,000 for those without visible AI ties — a 4.5x difference.
- Binance reported its AI systems prevented $10.53 billion in potential user losses, yet overall scam profitability continues to favor attackers.
Crypto fraud is no longer just opportunistic phishing or one-time wallet drains. In 2025, it functioned more like a software business, with modular tools, subscription-style services, scalable infrastructure, and measurable unit costs.
In 2026, this trend continued. According to TRM Labs, AI use in crypto crime increased 40% year-on-year, and recorded deepfake-scam losses had already eclipsed the 2025 total by 263%.
Chainalysis data show that the average scam payment increased by 253%, from $782 in 2024 to $2,764 in 2025. Onchain links to AI suppliers allowed operations to scale more quickly, manage more victims at once, and generate more income.
The same techniques that power legitimate product development, like large language models, face-swap software, and deepfake generation, are now used to reduce the cost and increase the conversion rate of social-engineering efforts aimed at crypto users.
The numbers behind the scams
According to Chainalysis’ 2026 Crypto Crime Report, confirmed scam inflows for 2025 rose to $14 billion, which is up from $12 billion for 2024. Once more clusters are attributed, the company projects a total figure above $17 billion due to historical undercounting trends.
AI is the most notable multiplier. An average of $3.2 million was made per operation by scams that displayed visible onchain payments to Chinese AI suppliers selling face-swap tools, deepfake packages, and large language models. The average for those without these links was $719,000 — a difference of 4.5 times.
Impersonation drove much of the volume growth. These schemes, in which scammers pretend to be government agencies, trusted contacts, or exchange support, increased by more than 1,400% annually. The category’s average payment severity increased by over 600%.
Although pig-butchering schemes and high-yield investment programs still represented significant numbers, the distinctions between them became hazy as operators combined strategies.
A prime example of this happened in September 2026. A campaign of fake Claude AI trading-bot tutorials was tracked on YouTube. Nine near-identical videos, using AI-generated presenters, directed viewers to fraudulent Remix-style compilers. Victims themselves deployed and funded the resulting contracts.
Between February and August, the operation drained 274.6 Ether (ETH), about $517,000 at the time, from 224 wallets. The median loss matched the tutorials’ suggested 1 ETH “startup capital.” Funds moved only through decentralized finance (DeFi), bridges, and mixers.
Scammers found a way to make people drain their own wallets without sending them a phishing link.
They uploaded YouTube tutorials showing people how to build an AI crypto trading bot with Claude.
People followed the tutorial themselves.
Copied the code.
Deployed the smart…
— wyck 📴 (@wyckoffweb) September 20, 2026
Who is targeted and how these operations scale
Volume and persuasion are more important than technical results in economic terms. AI makes it easier to operate multiple conversations at once, create realistic deepfakes, and customize messages on a large scale. According to Financial Action Task Force president Giles Thomson, tasks that previously needed considerably bigger teams can now be completed by “one or two people in a basement with a very big server.”
The majority of targets are still cryptocurrency users who deal with exchanges or self-custody wallets and already have assets. Some average vectors consist of:
- Impersonation of exchange support teams following customer list leaks or data breaches
- Government or toll-agency phishing (the Darcula/Smishing Triad organization is credited with the E-ZPass smishing campaigns)
- AI-generated individuals used in romance and investment schemes
- Fake educational resources that lure users into installing dangerous contracts themselves.
A 23-year-old was accused by Brooklyn prosecutors in December 2025 of masterminding a nearly $16-million impersonation scam with Coinbase support. Customer information that had previously been stolen was used in the operation. Similar trends can be seen in scam compounds in Southeast Asia, where networks of forced laborers engage in large-scale investment fraud and pig butchering.
Entry barriers are now lower. Companies like Lighthouse sold phishing-as-a-service kits for as little as $20-$50 in crypto. Stablecoin-accepting Chinese-language Telegram channels offer bulk social media accounts and SMS-spamming tools. According to Chainalysis, scams that used these kits were 688 times more successful financially than regular scams. What’s more, scams that purchased social media accounts in bulk were 238 times more profitable.
AI tools turning fraud into a modular service
Fraud supply chains now resemble software marketplaces. Separate groups specialize in phishing templates, victim data lists, bulk messaging, malware deployment, and money laundering. But these days, instead of creating a campaign from scratch, operators can buy the missing modules.
Onchain visibility captures only a subset of AI tool purchases, which are those paid for with crypto. Only a portion of AI tool purchases, those made with cryptocurrency, are captured by onchain visibility. Much more happens via traditional payment channels. As a result, there is a measurable difference between AI-linked and non-linked clusters that underestimates overall adoption.
Looking ahead, according to Chainalysis, almost all fraud will eventually use some form of artificial intelligence.
Laundering follows the same modular logic. Instead of using centralized exchanges, impersonation increasingly uses DeFi protocols, bridges, and decentralized exchanges (DEXs). Over the course of 2025, patterns changed from smart contract layering to bridge and DEX waves, indicating a quick response to detection pressure.
Forced-labor compounds and enforcement limits
A great deal of scams are still connected to organized crime networks in East and Southeast Asia via onchain analysis. Compounds that use forced labor are still prevalent in Myanmar, Cambodia, and neighboring countries. Professional laundering services manage the back end of social engineering, while trafficked workers run the front end.
Authorities in the US and the UK have started focusing on the infrastructure. A $15-billion seizure action and 146 entity designations resulted from the Prince Group case. More than 61,000 Bitcoin (BTC) connected to a previous Chinese investment scam were recovered by the UK. Although these operations show enhanced tracing capacity, disruption is still not total because of the compounds’ industrial scale.
Defenses grow, yet the disparity in profitability persists
In reaction, some centralized platforms built their own AI stacks. According to Binance, between the beginning of 2025 and the first quarter of 2026, more than 24 AI-driven projects and more than 100 models prevented $10.53 billion in potential losses for more than 5.4 million users.
The systems stopped 22.9 million phishing and fraud attempts in the first quarter of 2026 alone, protecting almost $1.98 billion. 57% of the exchange’s fraud controls are now powered by AI, which also helped lower card fraud rates by 60%-70% compared to industry norms.
Additionally, these numbers only cover a single platform’s user base, which is less than 2% of Binance’s total users, according to some estimates, and they keep up with the industry’s general trend. Scam revenue continued to increase overall.
Here, limitations in the data matter. Only a small portion of AI usage is captured via onchain linkages. 2025 totals will probably increase even more since attribution of final losses gets better over time. Even though they establish records, law enforcement seizures only recover a percentage of flows and can happen years after the initial theft.
Share
Most read articles
