Adoption of artificial intelligence by crypto-related criminal networks jumped 40 % over the past year, pushing TRM Labs’ AI Crime Index to 54 out of 100, up from just 28 in 2024. The metric, which tracks AI integration across the entire crypto-crime chain, signals a shift into an « emerging » phase that is reshaping fraud and money-laundering patterns worldwide.
🔑 Key Takeaways
- AI Crime Index 2026: 54/100 (+93% vs. 2024), labeled « emerging » by TRM Labs.
- Crypto deepfakes: H1 2026 losses up 263% versus the full 2025 total.
- Crypto hacks: record 201 incidents in H1 2026, more than double the full 2025 total.
- AI-enabled scams: average payout rose from $782 (2024) to $2,764 (2025), a 253% jump.
- Industrialized phishing: China’s Darcula network netted $1B over three years via SMS scams paid in crypto.
An index that enters the « emerging » phase
TRM Labs’ AI Crime Index aggregates several indicators — deepfake usage, phishing automation, hijacked large language models (LLMs), and malicious smart-contract generation — to map AI-enabled crime worldwide. Climbing from 28 out of 100 in 2024 to 54 out of 100 in 2026, it crosses a symbolic threshold: the technology is no longer experimental but systemic in crypto fraud, forcing investigators to recalibrate their methods.
Alongside TRM Labs, blockchain analytics firm Elliptic and the academic ICAIF ’24 conference (an AI-in-finance workshop) reach the same conclusion. A co-authored paper by researchers from Princeton University, Blackrock and Emory University describes the trend as « a troubling recent development » and projects that AI-driven fraud losses could quadruple by 2027, at a compound annual growth rate above 30 %.
« In the face of a growing epidemic of financial fraud, individuals — often vulnerable people — and businesses are being scammed on a massive, global scale. »
Interpol Secretary General, 2024
Deepfakes, chatbots and hacks: the key numbers
AI use in scams has already reached an advanced maturity stage, TRM Labs notes. The share of reported crypto frauds involving deepfakes (synthetic video impersonating a face or voice) and AI-powered chatbots has multiplied by 13 since 2022. In H1 2026 alone, losses tied to deepfake scams surged +263% versus the total recorded for the entire year 2025.
A record half-year for crypto hacks
The number of crypto-asset hacks in H1 2026 hit a historic high of 201 incidents — more than double the full 2025 annual total. Aggregate losses nevertheless remained below the symbolic $1B mark at $972 million, thanks to smaller average theft sizes, per TRM Labs.
| Indicator | 2024 | 2025 | H1 2026 |
|---|---|---|---|
| AI Crime Index (TRM Labs, out of 100) | 28 | — | 54 |
| Crypto hack incidents | — | n (baseline) | 201 (+>100%) |
| Hack losses (USD) | — | — | $972 M |
| Average payout per scam (USD) | $782 | $2,764 | — |
| Impersonation scams (YoY) | — | +1,400% | — |
« Existing risk-management frameworks in financial services may not be adequate to cover emerging AI technologies. »
U.S. Treasury Department, 2024
Cloned celebrities and ready-to-use toolkits
In its report on AI-assisted crypto crime, Elliptic describes an unsettling industrialization. Deepfakes now mimic Elon Musk, former Singapore Prime Minister Lee Hsien Loong, and Taiwanese Presidents Tsai Ing-wen and Lai Ching-te to promote fraudulent investments on TikTok and X. In 2022, former Binance CFO Patrick Hillmann himself was targeted by scammers using his deepfaked likeness to defraud industry participants.
WormGPT and HackedGPT: dark-web LLMs
Hijacked large language models have become core cybercrime tools. WormGPT and HackedGPT — uncensored alternatives to ChatGPT sold on illicit forums — offer carding (reselling stolen card numbers), phishing, malware deployment, vulnerability scanning, malicious smart-contract creation, cyberstalking and identity theft. Microsoft and OpenAI confirmed that Russian and North Korean threat groups have used them; Elliptic reports some services generated nearly 5,000 fake documents in a single month.
The AI-fueled underground economy
According to Chainalysis, crypto-scam flows on-chain reached at least $14 billion in 2025, up from $9.9 billion (later revised to $12 billion) in 2024. Total funds stolen via crypto scams and fraud are estimated at $17 billion for 2025.
The operational efficiency of AI-enabled schemes is unprecedented. Chainalysis data shows these scams extract an average of $3.2 million per operation, compared with $719,000 for non-AI-linked scams — 4.5× more. Median daily revenue climbs to $4,838 (vs. $518), with 9× more transactions: 35.1 transfers per day versus 3.89.
| Operational metric | AI-linked scams | Non-AI scams | Ratio |
|---|---|---|---|
| Avg. revenue per operation (USD) | $3.2 M | $719 k | 4.5× |
| Median daily revenue (USD) | $4,838 | $518 | 9.3× |
| Avg. transfers per day | 35.1 | 3.89 | 9.0× |
The Darcula case: phishing-as-a-service at $1 billion
The Chinese network « Darcula », also known as « Smishing Triad » (a collective specializing in SMS-based phishing, known as « smishing »), illustrates the industrialization of crypto crime. According to Google’s November 2025 lawsuit, the group sent up to 330,000 SMS in a single day, spoofing toll agencies such as E-ZPass to trap millions of Americans. The operation allegedly netted $1 billion over three years and duped more than one million victims across at least 121 countries.
The kits were priced in crypto at absurdly low rates: $50 for a full build, $30 for a proxy deployment, and $20 for updates — a phishing-as-a-service (PaaS) model (a turnkey fraud toolkit resold to other criminals) that puts AI at the heart of the underground economy.
« Crypto-asset fraud continues to grow in scale and sophistication, with organized criminal groups increasingly using impersonation tactics, online infrastructure and AI-powered tools to target victims at high speed and scale. »
Will Lyne, Head of Economic and Cyber Crime, Scotland Yard
Conclusion: an AI-fueled arms race
TRM Labs’ 2026 dashboard confirms that AI is no longer a gadget but a mature criminal infrastructure, applied at every stage of the chain — from targeting (deepfakes) to execution (malicious smart contracts) to monetization (PaaS kits sold in stablecoins). Law enforcement is mobilizing: Brooklyn’s district attorney has pledged to « freeze assets wherever possible », while Scotland Yard points to « a radical shift in law-enforcement response capability ».
For investors and crypto businesses, three scenarios are taking shape: (1) tighter regulation around generative AI and biometric anti-deepfake KYC (Know Your Customer, customer-identification procedures); (2) broader deployment of real-time on-chain detection tools such as Chainalysis or Elliptic; (3) rising cyber-insurance premiums and compliance requirements, especially for exchanges. The next battle in the sector will be fought as much on the quality of defensive AI models as on regulatory maturity across markets.
Sources
- The Block — AI adoption in crypto crime rose 40% over the past year, TRM Labs says
- TRM Labs — AI Crime Index resources
- ACM Digital Library — ICAIF ’24 paper (Princeton / Blackrock / Emory)
- Elliptic — The state of AI-enabled crypto crime
- Chainalysis — Crypto scams 2026
This article is for informational and educational purposes only. It does not constitute investment advice. Do your own research (DYOR) before making any decision.
