Artificial intelligence is being adopted across cryptocurrency crime at a rapidly increasing rate, with scammers leading the shift, according to a new report from TRM Labs.
The firm’s 2026 AI-in-Crime Adoption Index rated overall AI use in crypto-related crime as “emerging”, scoring it 54 out of 100. That compares with a score of about 28 in 2024.
Scams were classified as being at a “mature” stage of AI adoption. Hacking and ransomware were rated “emerging”, while the use of AI in narcotics trafficking and darknet markets remained at the earliest “horizon” stage.
“AI has not invented new crimes. It removed the constraints on old ones. The skill floor collapsed, the scale ceiling lifted, and fake identity went industrial what used to take a team of operators now takes one person with a subscription,” said Ari Redbord, Global Head of Policy and Government Affairs at TRM Labs.
The proportion of crypto scam reports involving tools such as deepfakes and AI chatbots has increased by as much as 13 times since 2022.
Losses reported from deepfake scams in 2026 so far have already exceeded the total recorded for the whole of 2025 by 263%, according to TRM Labs. The figures indicate how quickly criminals are incorporating AI into scam operations.
Cyber attacks are also making increasing use of the technology. TRM said North Korean cyber actors were using deepfake IT-worker infiltration, AI-driven social engineering and AI-assisted vulnerability discovery to target companies and protocols.
Security experts have repeatedly warned that AI could identify weaknesses that human researchers have missed or are unable to find. Speaking at the Wyoming Blockchain Symposium 2026, Global Settlement Network chief executive Ryan Kirkley said AI agents could soon enable hackers to attack Wi-Fi networks, passwords and wallets on a previously impractical scale.
“It used to be so hard to try to hack a person worth $20,000 because why would you spend all that time going after one person?” Kirkley said. “Now I can have an agent that goes after everyone.”
In June, security engineer Taylor Hornby used AI to discover a critical vulnerability in Zcash’s Orchard transaction pool. The flaw could have been exploited to create an “unlimited” quantity of counterfeit tokens within the pool.
TRM said digital-asset hacks reached a record 201 incidents during the first half of 2026, more than twice the figure for the whole of 2025. About 75% of losses came from just 4% of incidents, most of which involved infrastructure compromises linked to the theft of private keys or credentials.
Activity connected to North Korea accounted for approximately $600m, representing 61% of losses in the first six months of the year.
The report also found that most ransomware operations were already using AI during phishing and initial-access stages. No-code ransomware kits are being sold for between $400 and $1,200.
Researchers last month disclosed JadePuffer, described as the first fully agentic ransomware attack used in an extortion operation. An AI agent carried out reconnaissance, credential theft, lateral movement, privilege escalation and encryption from start to finish.
“JadePuffer shows what ransomware actors are now capable of,” Redbord said. “This is the shape of attacks at scale against hospital systems and critical infrastructure … with no human required in the loop. That is the scale that makes this a civilization-level threat.”
By contrast, AI use in narcotics trafficking and darknet markets remains limited and is mainly focused on marketing, TRM said.
The company added that much of the criminal activity it measured “ultimately moves value on public blockchains”, meaning on-chain trends can provide a reasonable indication of wider patterns.
The Block is an independent media outlet that provides news, research and data. Since November 2023, Foresight Ventures has been its majority investor. Foresight Ventures invests in other companies in the cryptocurrency sector, while crypto exchange Bitget is an anchor limited partner for Foresight Ventures. The Block says it continues to operate independently to provide objective, impactful and timely coverage of the crypto industry. Its current financial disclosures are available through the publication.
© 2026 The Block. All Rights Reserved. This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.
