Reported losses from deepfake scams in 2026 have already blown past all of 2025 by 263%. That’s TRM Labs’ number, and it says something uncomfortable about where crypto crime is headed: the attackers aren’t breaking the code anymore. They’re breaking the person holding the keys.
The blockchain intelligence firm’s new AI-in-Crime Adoption Index puts scams in a category of one. It’s the only crypto-crime type where TRM rates artificial intelligence adoption as “Mature.”
The 13-fold number matters more than the 25-fold one
TRM said reports involving scammer-side use of AI, including deepfakes, chatbots and AI-powered lures, have risen roughly 13-fold since 2022. There’s a bigger, splashier figure floating around in the same research: a 25-fold increase across all scam reports mentioning AI since 2022.
Ignore that one. It includes cases where victims used consumer AI tools while investigating suspected fraud, which tells you nothing about attacker capability. The narrower 13-fold series isolates reports where scammers themselves used AI. That’s the one worth tracking.
TRM’s index measures how prevalent AI is within different crime types, how broadly it’s used across stages such as targeting and deception, and how sophisticated the tooling is. The 263% deepfake loss figure covers 2026 through the period in TRM’s Aug. 17 report, measured against the reported total for all of 2025.
Your hardware wallet did its job. You didn’t.
Here’s the part that breaks the mental model most of us have been running on for a decade. An exchange account can be properly authenticated. A hardware wallet can sign correctly. A smart contract can execute exactly as programmed. And the money still lands in an attacker’s address, because a deepfake convinced the person controlling all three to approve the transaction.
Nothing in the stack failed. That’s the problem.
The security burden moves to the moment before authorization: when an exchange decides whether an account-recovery request is genuine, when a treasury signer approves a transfer, when you accept payment instructions from someone you’re sure you recognize.
Other datasets say the same thing
Chainalysis said inflows to impersonation scams rose more than 1,400% year over year. It also found that scam operations with visible on-chain links to AI service providers generated 4.5 times more revenue on average than those without.
Read that second figure carefully before you get excited about it. Chainalysis cautions that the numbers are based on addresses it has identified and can change as attribution improves. Attribution-dependent multiples have a way of moving.
The FBI’s 2025 Internet Crime Report logged 22,364 complaints carrying an AI-related descriptor and $893.35 million in associated reported losses. Complaints involving cryptocurrency descriptors, counted separately, totaled $11.37 billion in losses.
Why AI is so good at this specific crime
Impersonation used to have a cost floor. Somebody had to be on the phone, in the right language, with a plausible story, for as long as it took. AI drops that floor through the basement.
A single attacker can maintain conversations with victims in multiple languages. Synthetic video can prop up a false identity during remote verification. Voice cloning can imitate an executive or a family member. AI-generated documents, profiles and communications can make a fraudulent request look consistent across several channels at once, which is exactly what a careful person checks for.
And crypto makes it worse, because transactions are hard to reverse once authorized.
The exchange account-recovery path
TRM’s separate review of first-half crypto hacks found smart-contract vulnerabilities remained common, but the biggest losses clustered in infrastructure and operational compromises. Stolen credentials, private keys, other forms of access that let an attacker issue instructions the blockchain accepts as legitimate.
Deepfakes extend that by helping attackers get cooperation instead of just stealing access.
Walk through it at an exchange. An attacker impersonates a customer during account recovery, changes the authentication factors, adds a new withdrawal destination. Every step after the first one looks valid, because the identity decision that governs everything downstream was already compromised.
FinCEN has told financial institutions what to watch for after onboarding: mismatched identity information, suspicious device or location changes, third-party webcam tools, resistance to multifactor authentication and rapid transactions following account changes. A recovery-factor change, then a new device, then a new withdrawal address, then an immediate transfer is a sequence that should trigger stronger verification before anything leaves the platform.
What a hardware wallet can’t tell you
Corporate treasuries have the same exposure with a different surface. A synthetic voice or video of an executive pressures an employee to approve a transfer, swap a signer or add a payment address.
Your hardware wallet will confirm the correct private key signed that transaction. It has no way to know whether the human holding the key was lied to.
The fixes here are procedural, not cryptographic. Multiperson approval. Confirmation channels agreed on in advance. Delays before newly added withdrawal addresses go live. All of them do the same thing: move the decisive moment outside the communication channel the attacker controls.
The FBI has also warned that North Korean IT workers have used false identities, manipulated video, AI tools and remote-access infrastructure to land jobs that hand them privileged access to corporate systems and cryptocurrency.
For individuals, it’s simpler and worse
No account takeover required. A convincing video call, voice message or profile persuades you to send the payment yourself. Blockchain monitoring starts working only after the security failure that mattered has already happened.
On-chain tools still earn their keep. They detect suspicious flows, trace stolen assets and support freezes where a centralized intermediary can step in. But they’re weak against a transaction that looks legitimate because the authorized signer willingly approved it.
TRM’s data points at a gap that sits outside the smart contract entirely.
Keep the contract audits, the private-key protection, the wallet simulation, the transaction monitoring. None of that is optional. But if you’re deciding where to put your next security dollar, put it on the control that challenges who is giving the instruction, before somebody signs something nobody can undo.
![How converting a video to 4K actually works [2026]](https://cryptogames.gg/wp-content/uploads/2026/08/how-converting-a-video-to-4k-actually-works-2026-150x150.jpg "How converting a video to 4K actually works [2026]")
