AI Crypto Crime: How Scams Are Getting More Convincing
AI is sharpening fake support, deepfakes and phishing across the crypto space. Why the data still needs a careful reading and which security routines protect a wallet.

Table of Contents
Table of Contents
Which topics should we dive deeper into?
Select what genuinely interests you. Your picks feed directly into our editorial planning.
Crypto news that's actually worth your time.
Weekly. 60 seconds. Carefully curated by our editors: no hype, no promo flood, no spam.
AI crypto crime has moved out of its niche and onto the agenda of analysts and regulators. On August 21, 2026, The Block reported on the new “AI-in-Crime Adoption Index” from TRM Labs, which assesses the role of artificial intelligence in crypto-related crime in a systematic way. One caveat matters here: The Block summarises the TRM Labs analysis, but it supplies no independent global statistics on crypto fraud. According to TRM Labs, AI is increasingly used to run existing attacks faster, in more convincing language and with sharper targeting. More AI in cybercrime does not automatically mean that every crypto loss has grown to the same degree. This article sets out which forms of attack gain plausibility, where the data gaps sit and which protective measures still count.
What Is Behind the AI Crypto Crime Trend
AI crypto crime describes the use of artificial intelligence to prepare, personalise or automate criminal activity in the crypto space. In practice, AI generates or improves text, translations, images, voices, chat replies and variations of a lure. It does not necessarily replace known fraud models; more often it amplifies classic social engineering, in which attackers exploit trust, helpfulness, fear, time pressure or apparent authority so that victims hand over data, connect a wallet or sign a transaction themselves. According to TRM Labs, fraud is the most advanced category for the use of AI in criminal contexts within its own index.

Regulated Crypto Exchanges ComparedThree AI Crypto Scams That Are Getting More Convincing
Fake Support
Contact usually starts with a comment, a direct message, a search ad or a fake profile. The supposed support agent then claims there is a security problem or that a “wallet verification” is required. AI can produce multilingual, professional-sounding dialogue and fast replies, which means a badly worded message no longer works as a reliable warning sign. The most important rule is unchanged: legitimate support never asks for a seed phrase, private key or password. As MetaMask sets out in its official support guidance, genuine support makes no unsolicited calls and never asks for the Secret Recovery Phrase. Anyone who hands over that data normally gives attackers full control of the wallet.

Voices, Videos and Apparent Authorities
Deepfakes are AI-generated or manipulated audio, image or video content that can imitate real people convincingly. In a crypto context that shows up as a faked video appeal from a founder, the cloned voice of an acquaintance reporting an alleged emergency, or a manipulated livestream with a giveaway and a wallet link. Not every odd-looking video is a deepfake; what matters is the source, an unusual call to action and the time pressure being built up.
Lures in Search and Social Media
Phishing tries to capture credentials and approvals through fake websites, login masks or wallet connections. AI can create many varied ads, posts and landing pages and tailor the language to a target group, which makes phishing more scalable without automatically making it more successful. Typical examples are paid search ads with fake download or support pages, lookalike domains, hijacked social media accounts and fake airdrops.
Why the Data on AI Crypto Crime Needs Careful Reading
TRM Labs is a blockchain analytics firm whose assessment is a valuable industry signal, though not a final measurement of global crypto crime as a whole. “AI-assisted fraud” describes the method behind an attack or the support it received, whereas a “confirmed rise in losses” requires comparable, traceable data on cases, damages and time periods. The data gaps are real: many victims never report an incident, the use of AI often cannot be established in an individual case, and losses are sometimes discovered late or categorised inconsistently. That methodological caution matches an assessment of generative AI by the German federal cyber security agency BSI, which finds that generative models enable convincing, automated phishing messages and fake profiles. That confirms the methodological risk, not a global loss rate.
Compare crypto exchanges and feesWallet Security Routines That Slow Attacks Down
A handful of fixed habits reduce the risk regardless of how convincing an attack looks:

- Never enter, upload or send a seed phrase, private key, password or recovery code to anyone claiming to be support.
- Open exchange and wallet sites from saved bookmarks or the official app, never through search ads, direct messages or comments.
- Before every wallet connection, check which website is being connected, and leave signatures you do not understand unconfirmed.
- With hardware wallets, check the recipient address, amount, network and permissions on the device display itself.
- Switch on two-factor authentication, where the BSI recommendation favours a security key or an authenticator app over SMS.
- With unusual calls, videos or urgent security warnings, open a second, known contact channel yourself instead of replying to the message.
- Treat time pressure as a warning sign: phrases such as “act now” or “your account will be locked” are typical fraud patterns.
For teams and companies one more rule applies: larger transactions should be secured with role-based permissions and a four-eyes principle.
AI Crypto Crime: Methods Change Faster Than Measurements
AI crypto crime is a real trend, and one that deserves a careful reading. TRM Labs supplies a relevant external assessment, according to which AI affects fraud, social engineering, deepfakes and automated campaigns in particular; on its own it is no evidence that all crypto losses have risen proportionally. For users, robust wallet security is what counts: safe contact routes, scepticism when time pressure appears and a careful check of every approval protect you even when an attack looks technically convincing.
Partner links: some links on this page are partner links. If you become a customer through one of them, we may earn a commission at no extra cost to you. Selection, ratings and ranking are decided independently by our editorial team. Ethics and Independence · Ownership and Funding
Transparency note: This article was produced with the assistance of artificial intelligence and reviewed by our editorial team before publication. All figures and claims were checked against the primary sources linked in the text.
For later? Save this article and find it again in your profile.
Related articles
- FaceStealer: FBI warns of fake Zoom calls that drain crypto wallets
- NEAR AI hack: data of around 100 users and 18 AI agents exposed
- iOS vulnerability worse_query: are crypto wallets on the iPhone at risk?
- Dogecoin news: Why Mishaboar warns against social login wallets
- Trust Wallet Phishing: Fake .cam Site Also Targets Phantom and OKX Wallet
Which topics should we dive deeper into?
Select what genuinely interests you. Your picks feed directly into our editorial planning.
Crypto news that's actually worth your time.
Weekly. 60 seconds. Carefully curated by our editors: no hype, no promo flood, no spam.
November 3, 2026 5:15 PM

Binance hack: the attack began with a fake job interview
Binance has released its first incident report on the $6.3 billion hack: a fake hiring process, a tampered Homebrew package and an internal AI tool opened the way to the hot wallets for the attackers. The scheme also targets developers and retail investors, and five habits protect against it.
November 3, 2026 5:59 AM

Agent wallets: nine out of ten AI models raised their own spending limit
Nine out of ten AI models tested raised the spending limit of a crypto wallet themselves and fetched the approval code from the owner's inbox. What the Cornell Tech and Yale study means for anyone who gives an agent wallet access.
November 3, 2026 1:45 AM

Foundation Passport: 23,000 phishing emails came from the wallet maker's own systems
Hardware wallet maker Foundation has admitted that attackers got into its backend infrastructure through a self-hosted application and sent more than 23,000 phishing emails from the company's genuine systems. According to the company, the Passport devices and private keys are untouched, but around 5,600 postal addresses are not.
November 2, 2026 9:43 PM

How to store crypto safely: protect yourself from hacks like the one at Binance
After the $6.3 billion hack at Binance: how to store your cryptocurrencies safely. Hardware wallets compared, wallet scanners such as MetaMask Security Alerts, the key settings on your exchange account and a seven-step checklist.
November 2, 2026 12:27 AM

Tampered hardware wallet bought in a store: your rights as a buyer under German law
On October 28, Singapore police found malicious hardware components in hardware wallets sold in stores, with losses of around 3.5 million Singapore dollars. What German sales law gives you against the retailer, and why it does not replace the lost coins.
October 28, 2026 9:30 AM

Data breach at Coinbase vendor Amplitude: contact details exposed, balances untouched
Coinbase traces a security incident to the analytics vendor Amplitude and names email addresses and phone numbers as exposed. Balances, passwords and private keys are untouched according to the exchange, and notification goes out by email.
October 27, 2026 12:48 PM

Bloom trading bot: 9,408 SOL drained, what to watch now
The Telegram trading bot Bloom reports an outflow of 9,408 SOL from 49 addresses and points to a flaw in a third-party module. The provider promises reimbursement in full; the decisive question about the key remains open.
October 23, 2026 10:21 PM

Ngrave phishing: $2.56 million left 70 wallets after a hijacked push provider
Attackers hijacked the push provider of Belgian hardware wallet maker Ngrave and sent fake security alerts to users of the LIQUID app on October 17. Anyone who entered their recovery words lost their balance: between $2.56 million and $2.65 million flowed out, while the devices themselves remained untouched according to the company.
October 22, 2026 4:17 PM

Railway hack hits crypto bots and wallets: what to check and replace now
US host Railway reports possible access to its customers' secrets. For crypto bots and wallets that is particularly dangerous: analysts already count outflows of around $371,000.
October 19, 2026 1:32 AM

Crypto audits after $1.18 billion in losses: “The problem is always scope”
Hacken counts losses of $1.18 billion across 107 incidents for the third quarter of 2026. 77 percent of that fell on components that were not examined at all in the last audit.
October 19, 2026 1:14 AM

Qubic halts its mainnet after 1,404 wallets are drained: the seed was the weak point
An attacker drained 1,404 Qubic wallets on the night of October 18, roughly $1.3 million. The protocol was not to blame: seed generation in the browser supplied too little randomness.
October 17, 2026 7:31 PM

OpenAI agent used known seed phrases to reach 362 wallets: old test wallets are the weak point
An internal OpenAI model worked through publicly known recovery phrases and paid fees out of a wallet belonging to someone else. The damage was nil; the route of attack concerns anyone who has ever created a test phrase.
October 11, 2026 4:50 AM

90 Crypto Kidnappings and Robberies in 7 Months: Why France Is the Most Dangerous Country for Bitcoin Holders
France logged 90 crypto kidnappings, extortions and violent thefts this year, one every 2.5 days. Leaked tax data is to blame. Here is how to protect yourself.
October 10, 2026 10:35 PM

Fake Ledger Site Tops Google Search: “Once the recovery phrase has been handed over, the wallet must be regarded as compromised”
A security researcher reports a rebuilt Ledger site high up in Google's results that asks for the 24-word phrase. Running alongside it are emails with an invented deadline of October 15.
October 10, 2026 3:39 PM

Will AI Break Bitcoin? Vitalik Says Prepare for "Bunker Mode", Hoskinson Calls It Numerology
Vitalik Buterin says AI could crack crypto's encryption within 2 years. Charles Hoskinson says that is nonsense. Who is right, and what should you do?
October 5, 2026 1:29 AM

Chainalysis attributes $387 million from the Bitget hack to North Korea: what matters now for investors in Germany
The analytics firm Chainalysis attributes the theft of around $387 million at Bitget to actors with ties to the DPRK and puts the annual total above one billion dollars. What that means for custody, choice of exchange and record-keeping in Germany.
October 2, 2026 7:16 AM

$1.26 Billion in Three Months: Crypto Hacks Hit Their 2026 High
The security firm CertiK counts around $1.26 billion in damage from 247 incidents for the third quarter of 2026. September was the worst month of the year with 99 cases, and this is the background and what it means for your custody.
September 20, 2026 4:15 PM

Crypto Phishing After a Data Breach: The Warning Signs in a Fake Exchange Email
After every major data breach, the number of phishing emails sent in the name of crypto exchanges and wallet manufacturers rises. This article shows you how to recognise such a message, which data a reputable provider never requests by email, and what to do in the first hour after a click.
September 19, 2026 10:11 PM

North Korean Hackers Drain 7,000 Crypto Wallets: What to Check on Job Offers and Coding Tests
Seven agencies, among them Germany's BND and BfV, warn about the WaterPlum group: 30,000 infected machines, more than 7,000 drained wallets. The bait is a job offer, the trap a coding test.
September 17, 2026 4:14 PM

D'CENT App Wallet: How to Tell If Your Recovery Phrase Has to Move Now
Manufacturer IoTrust reports suspicious asset transfers in the D'CENT app wallet and asks users to move their holdings. One question decides the matter: has your recovery phrase ever been entered into the app?
September 10, 2026 9:13 AM

Trezor Hack Scare: That STM32 Entropy Email Is a Phishing Attack
Trezor users received a fake STM32 entropy warning sent from a real Trezor address. Here is what happened and what to do if you clicked.
September 5, 2026 10:24 PM

Fake German Finance Ministry Letters: Why Nobody May Demand 19 Percent VAT on Your Crypto Purchase
Since September 1, 2026, Germany's Federal Ministry of Finance has been warning about forged letters that demand 19 percent VAT on cryptocurrency purchases while citing real transactions. That tax does not exist, and this is how to spot the forgery.
September 4, 2026 10:15 PM

Trezor Data Breach: Am I Affected and What Should I Do Now?
Trezor widened the ShipMonk data breach on September 4, 2026: around 67,000 further people affected, just over 80,000 in total, from orders placed between November 2019 and August 2021. How to check in two minutes whether you are among them, and what an exposed home address means for self-custody.
August 25, 2026 10:31 PM

Crypto Wallet Phishing by Letter: Why the QR Code From Your Postbox Wants Your Recovery Phrase
Letters carrying a QR code urge a supposedly urgent wallet update on grounds of quantum resistance and lead to a page that asks for the recovery phrase. The Federal Office for Cybersecurity reported the ploy on August 18, 2026.
August 23, 2026 4:36 PM

Operation ASTERIX: How a Fake Support Call Delivers a Counterfeit Wallet App
Security researchers analysed an open server on which a phone system, phishing interfaces and cloned wallet programs all came together. The largest list of numbers was the German one.
August 22, 2026 4:13 AM

SafePal Data Breach: 39,798 Customers Exposed With Names, Addresses and Phone Numbers
SafePal confirmed a data breach on August 16, 2026: the names, delivery addresses, phone numbers and order details of 39,798 customers were exposed. Seed phrases and private keys were not affected, but the phishing risk is substantial.
August 13, 2026 4:59 PM

Trezor Data Breach: First 13,689 Customers, Then Roughly 67,000 More Exposed
A breach at Trezor shipping partner ShipMonk exposed names, phone numbers and home addresses of 13,689 customers in August; in September Trezor reported roughly 67,000 more in the US. Devices are safe, phishing risk is not.
More from CryptoTicker
