Artificial intelligence is moving from an auxiliary tool to a routine feature of cryptocurrency crime, led by scams that use deepfakes and automated chatbots to impersonate trusted people at scale. TRM Labs said AI use in crypto-related crime rose 40% over the past year, while its 2026 AI-in-crime adoption index reached 54 out of 100, compared with roughly 28 in 2024.
The blockchain intelligence firm classified AI-enabled scam activity as “mature,” its most advanced category. Hacking and ransomware operations remain at an “emerging” stage, while narcotics trafficking and darknet market activity sit in the earlier “horizon” category, where AI use is present but comparatively limited.
The results point to a crime landscape in which fraudsters are gaining the clearest operational benefit from generative AI. Tools capable of producing convincing voices, videos, messages and fake customer-service interactions allow criminals to run impersonation campaigns without the staffing and language skills once needed to target victims across multiple countries.
Deepfake scam losses have accelerated in 2026
TRM Labs said the share of crypto scam reports involving AI tools, including deepfakes and AI chatbots, has increased by as much as 13 times since 2022. Reported losses from deepfake-related scams in 2026 so far have already exceeded the full-year 2025 total by 263%, according to the firm.
Deepfake scams can take several forms: a fabricated video of an executive promoting a token sale, an imitation of a family member requesting an urgent transfer, or a voice clone used to bypass informal identity checks. In crypto markets, where transfers are generally irreversible and users often interact through online-only channels, a convincing impersonation can be enough to trigger a payment before the target recognizes the deception.
TRM’s classification of scams as mature reflects how readily available these tools have become. A criminal does not need to build a machine-learning model to generate a synthetic voice or create a chatbot that mimics a support agent. Off-the-shelf AI services can be adapted to familiar fraud techniques, giving old schemes a more convincing delivery method.
The report’s figures measure reported activity, which means the actual use of AI in scams may be difficult to isolate when victims do not know whether a message, call or video was machine-generated. The sharp increase in deepfake-linked losses nevertheless suggests that synthetic media is no longer confined to isolated high-profile fraud attempts.
Hackers are applying AI to access and discovery
AI’s role in hacking is less mature than in scams, but TRM said cyber actors are using it for vulnerability analysis, social engineering and infiltration. The report highlighted activity associated with North Korea, including deepfake IT-worker infiltration schemes, AI-assisted social engineering and automated vulnerability discovery targeting companies and blockchain protocols.
One example involved Zcash’s Orchard transaction pool. According to TRM, security engineer Taylor Hornby identified a vulnerability in June using AI. The flaw could have been exploited to create an “unlimited” amount of counterfeit tokens within the pool, the report said.
The case illustrates a more complex effect of AI on cybersecurity: the same technology that can speed up offensive research can also help defenders find flaws before criminals exploit them. The balance depends heavily on who has access to capable tools, sound technical judgment and the ability to test potential weaknesses responsibly.
TRM recorded 201 digital-asset hacks in the first half of 2026, a record level that it said was more than double the 2025 figure. About 75% of losses came from only 4% of incidents, largely infrastructure compromises involving stolen private keys or credentials.
That concentration places particular pressure on exchanges, custodians, wallet providers and protocol teams to protect privileged access. AI may help criminals identify weak points or produce better phishing material, but the largest losses described by TRM still stemmed mainly from familiar failures: compromised credentials and inadequate controls around critical systems.
North Korea remained the dominant source of losses
TRM attributed roughly $600 million, or 61% of digital-asset hack losses in the first half of 2026, to activity linked to North Korea. The country has long been associated with cryptocurrency theft and laundering operations, and the report said AI is now being incorporated into techniques used to obtain access and deceive targets.
Deepfake IT-worker schemes have become a particular concern for companies hiring remote technical staff. In these operations, applicants may use fabricated identities, manipulated video feeds or AI-generated documents to secure roles that provide access to internal systems, source code or sensitive credentials.
Ransomware groups are also integrating AI earlier in their attack chains. TRM said many operations already use AI during phishing and initial-access stages, where attackers seek to persuade a target to open a malicious attachment, reveal credentials or approve a login request.
The report said no-code ransomware kits are being sold for between $400 and $1,200. Such products lower the technical burden for deploying malware, although successful extortion campaigns still require access to victims’ systems, operational security and ways to receive or move funds.
TRM also cited JadePuffer, which it described as the first fully agentic ransomware attack used in an extortion operation. According to the report, an AI agent handled reconnaissance, credential theft, lateral movement, privilege escalation and encryption from end to end. If such workflows become reproducible, ransomware operators could run more simultaneous intrusion attempts while reserving human involvement for selecting targets and negotiating payments.
Darknet use remains limited
AI adoption in narcotics trafficking and darknet markets remains limited, TRM said, and is concentrated mainly in marketing. Sellers may use automated tools to write advertisements, translate listings or create promotional images, but the report did not place the sector near the level of AI integration seen in scams.
TRM based its index partly on criminal activity that ultimately moves value across public blockchains. That visibility gives researchers a way to track transactions connected to known illicit wallets and services, though it does not capture every part of an attack, such as the initial phishing message or a fabricated video call.
The immediate defensive lesson from the report is practical rather than technological. High-value transfers and changes to wallet permissions should be verified through an independent channel, while organizations should rely on strong credential controls, hardware-backed authentication and clear approval procedures. A convincing voice or video can no longer function as sufficient proof that the person on the other end of a call is genuine.
Concerned about AI-driven scams? Learn essential protection tips in our guide here and trade more securely.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
