AI‑Powered Deepfake Scams Surge, Targeting Authorization Rather Than Code

Deepfake and AI‑driven scams are exploding in the cryptocurrency space, with reported losses in 2026 already 263% higher than the total for all of 2025. TRM Labs’ AI‑in‑Crime Adoption Index now lists scams as the only crypto‑crime category where artificial intelligence has reached a “Mature” level of adoption.

Rapid Growth of AI‑Enabled Scams

TRM Labs says reports of scams that use AI tools—such as deepfakes, chatbots and AI‑generated lures—have increased roughly 13‑fold since 2022. Across all scam reports that mention AI, the volume has risen about 25‑fold in the same period. Chainalysis data shows impersonation‑related inflows up more than 1,400% year‑over‑year, and addresses linked to AI service providers generate 4.5 × more revenue on average than those without such links.

Security Gap Lies Before Authorization

Traditional safeguards—smart‑contract audits, hardware‑wallet signatures and exchange authentication—remain effective at preventing code‑level attacks. However, AI‑driven impersonation can convince a legitimate user to approve a transaction, bypassing those technical controls. The critical vulnerability now resides in the decision‑making moment before a signature is applied.

How AI Enhances Impersonation

• Synthetic video and voice can mimic executives or family members during remote verification.
• Multilingual chatbots enable attackers to maintain simultaneous conversations with many victims.
• AI‑generated documents and profiles create consistent fraudulent narratives across channels.

Implications for Exchanges, Treasuries and Individuals

At exchanges, attackers may use deepfakes to impersonate customers during account‑recovery requests, change authentication factors and add new withdrawal addresses. Corporate treasuries face similar risks when synthetic media pressures employees to approve transfers or alter signers. For individual holders, a convincing video call or voice message can persuade the victim to send funds directly.

Recommended Defensive Measures

• Strengthen post‑onboarding identity checks, including verification of device changes and location anomalies.
• Implement multi‑person approval workflows and delay periods for newly added withdrawal addresses.
• Monitor for mismatched identity information, resistance to multifactor authentication and rapid transactions after account changes.
• Maintain traditional security practices—contract audits, private‑key protection, wallet simulation and transaction monitoring—but recognize they cannot stop a transaction approved by a deceived user.

While on‑chain analytics remain valuable for tracing stolen assets, they are less effective at preventing transactions that appear legitimate because the authorized signer was tricked.