AI-Powered Crypto Scams
Deepfaked founders, hallucinated audits, agents that sign for you. Fraud at machine speed.
AI did not invent a new crime. It removed the two bottlenecks that used to limit the old ones: the cost of being convincing, and the cost of doing it at scale. A face, a voice, a term sheet and a plausible audit report are now commodities.
The investigations here cover both directions of the problem — attackers using models to impersonate, and users trusting models that confidently produce nonsense. The second is the quieter loss, and the one that ships to production.
How it works
Synthetic identity
A recorded founder becomes a live video call. Voice cloning needs seconds of audio; the call needs no more than plausibility.
Agentic access
An AI agent with wallet permissions reads untrusted text. Prompt injection turns that text into an instruction it will happily sign.
Confident fabrication
A model returns findings with no basis, or a clean bill of health it never verified. The output looks like a report because reports are what it was trained on.
Investigations in this vector
Fake AI Trading Bot Scam: You Deploy the Drainer
Fake AI trading bot tutorials swap clean code for a wallet drainer. See how the contract trap works and verify a bot before funding it.
Read the investigationHallucinated Audits: AI Invents Bugs, Misses Real Ones
AI audit tools invent vulnerabilities that do not exist, propose fixes that introduce real ones, and scam projects wear the 'AI audited' badge.
Read the investigationPrompt Injection: The Drain Your AI Agent Signs
How a sentence hidden in a token, a webpage or an MCP tool makes your AI agent sign a transfer. Documented attacks and the defences that actually work.
Read the investigationFake VC Emails: AI Agents Drain Web3 Founders
Scammers cloned founders' AI fundraising stack, impersonated tier-1 VCs and drained wallets with deepfake calls and one bad signature.
Read the investigationAI Deepfake Job Interviews: The Recruiter Who Never Existed
The "Google recruiter" on your video call is AI-generated. Real npm malware, real wallet drains, real victim losses of $43K+.
Read the investigationRed flags
- A video call where the face never occludes, turns fully sideways, or reacts to an unexpected request.
- Investment or partnership contact that starts with a familiar name and ends at a fresh domain.
- An 'AI-audited' badge with no auditor, no scope and no reproducible findings.
- An agent that can both read arbitrary web content and sign transactions.
- A security tool whose report has zero false positives and zero cited evidence.
If it already happened
- 1.Verify identity on a channel the impersonator does not control, then invalidate the compromised one.
- 2.Revoke any permissions granted to an agent, and rotate its API keys.
- 3.Have a human re-check every finding an AI tool cleared before you shipped.
- 4.Report the deepfake to the platform: takedowns are slow, but attribution accumulates.
Related vocabulary
Got a suspicious message, link or token?
Paste it into the free detector. No signup, no cost, answer in seconds.