AI-enabled crypto scams rose fivefold in 2025, TRM Labs says

TRM Labs’ 2026 Crypto Crime Report, released Wednesday, finds AI-enabled crypto scams increased fivefold in 2025 and $35 billion in cryptocurrency went to known scam addresses worldwide. The total was slightly below the $38 billion recorded in 2024.

The firm links the rise in activity to the use of large language models that broaden outreach, craft more convincing messages across languages, and scale campaigns. The report notes: “Large language models (LLMs) enable scams to cross language and cultural contexts with less friction, while AI-generated images, voice cloning, and deepfake videos reduce the cost of creating convincing personas.”

An incident highlighted in the report shows the use of deepfakes in real time. In March 2025, at least three crypto founders foiled attempts by alleged North Korean actors who used fake Zoom video calls to seek sensitive data.

TRM Labs describes a shift to multi-stage schemes that combine tactics. A typical path starts with a romance approach to build trust, moves to a false investment offer once contact is established, and ends with a demand for taxes or fees to release non-existent gains. The report states: “Victim journeys increasingly span multiple phases of deception, combining elements of romance scams, investment fraud, and advance fee schemes.”

Behind the scenes, fraud operations are adopting businesslike structures with standardized playbooks and specialized roles. A growing market of illicit service providers offers tools and recruiting channels. “Some offer AI-as-a-service tools to automate outreach and engagement, while others sell phishing kits or provide access to breached data. These services lower the barrier to entry for fraud actors and enable them to replicate scams across geographies,” the report notes.

The report estimates that addresses labeled illicit received about $158 billion in 2025, up roughly 146% from an estimated $64 billion in 2024. TRM Labs links the increase to expanded sanctions, including measures affecting Russia, and advances in monitoring that revealed more activity. Despite the jump in dollar terms, the share of illicit transactions in total crypto volume ticked down to 1.2% in 2025 from 1.3% in 2024.

TRM Labs characterizes social engineering as the core of most frauds but notes it is now reinforced by technical and organizational methods that make campaigns larger and harder to detect.

The firm adds that measurement can reflect both real growth and better visibility. The 2025 figures incorporate analytics advances used to map more networks and label more addresses, and sanctions and geopolitical events concentrated activity in flagged jurisdictions.

As we reported earlier, the Justice Department’s 2025 Year in Review detailed three crypto-linked prosecutions and 265 defendants tied to more than $16 billion in intended losses, with faster, AI‑enabled schemes and growing use of digital assets to move or hide proceeds.