AI-Powered Crypto Scams
AI did not invent a new crime. It removed the two bottlenecks that used to limit the old ones: the cost of being convincing, and the cost of doing it at scale. A face, a voice, a term sheet and a plausible audit report are now commodities.
How this vector actually works
The investigations here cover both directions of the problem — attackers using models to impersonate, and users trusting models that confidently produce nonsense. The second is the quieter loss, and the one that ships to production.
- Synthetic identity — A recorded founder becomes a live video call. Voice cloning needs seconds of audio; the call needs no more than plausibility.
- Agentic access — An AI agent with wallet permissions reads untrusted text. Prompt injection turns that text into an instruction it will happily sign.
- Confident fabrication — A model returns findings with no basis, or a clean bill of health it never verified. The output looks like a report because reports are what it was trained on.
Red flags you can check in a minute
Any single item below is enough to stop and verify before you sign, send or install anything. Deepfaked founders, hallucinated audits, agents that sign for you. Fraud at machine speed.
- A video call where the face never occludes, turns fully sideways, or reacts to an unexpected request.
- Investment or partnership contact that starts with a familiar name and ends at a fresh domain.
- An 'AI-audited' badge with no auditor, no scope and no reproducible findings.
- An agent that can both read arbitrary web content and sign transactions.
- A security tool whose report has zero false positives and zero cited evidence.
If it already happened
Order matters more than speed of panic: contain the wallet first, preserve the evidence second, report third. Recovery services that contact you after the fact are the follow-up scam.
- Verify identity on a channel the impersonator does not control, then invalidate the compromised one.
- Revoke any permissions granted to an agent, and rotate its API keys.
- Have a human re-check every finding an AI tool cleared before you shipped.
- Report the deepfake to the platform: takedowns are slow, but attribution accumulates.
Related vectors and tools
Most real cases mix two vectors, so read the neighbouring hubs, and run anything suspicious through the detector before you act on it.