AI adoption in crypto crime rose 40% over the past year, TRM Labs says

AI adoption in crypto crime has risen 40% in the past year, according to a new report from TRM Labs, with the increase driven primarily by scammers.

The firm’s 2026 AI-in-Crime Adoption Index places overall AI use across crypto crime at an "emerging" level of 54 out of 100, up from about 28 in 2024. TRM listed scams at a "mature" level in terms of AI use, while hacking and ransomware remain "emerging" and narcotics and darknet markets stay at the earliest "horizon" stage.

"AI has not invented new crimes. It removed the constraints on old ones. The skill floor collapsed, the scale ceiling lifted, and fake identity went industrial — what used to take a team of operators now takes one person with a subscription," said Ari Redbord, Global Head of Policy and Government Affairs at TRM Labs.

The share of crypto scam reports involving AI, such as deepfakes or AI chatbots, has risen as much as 13 times since 2022. Reported losses from deepfake scams in 2026 to date have already surpassed the full-year total for 2025 by 263%, showing the accelerated adoption of AI in scam operations.

AI-assisted hacks

Crypto hacks are another area that is quickly picking up on AI to enhance their operations — TRM said North Korean cyber actors are using deepfake IT-worker infiltration, AI-run social engineering, and AI-assisted vulnerability discovery to target firms and protocols.

Multiple security experts have recently warned that AI could uncover vulnerabilities that humans cannot or have overlooked. At the Wyoming Blockchain Symposium 2026, Global Settlement Network CEO Ryan Kirkley said AI agents could soon allow hackers to break into Wi-Fi networks, passwords, and wallets at a scale that has previously been impractical.

"It used to be so hard to try to hack a person worth $20,000 because why would you spend all that time going after one person?" Kirkley said. "Now I can have an agent that goes after everyone."

In June, security engineer Taylor Hornby discovered a critical vulnerability in Zcash's Orchard transaction pool using AI, which could have been exploited to create an "unlimited" amount of counterfeit tokens within the pool.

TRM said digital asset hacks reached a record 201 in the first half of 2026, more than double the 2025 figure. Around 75% of losses stemmed from just 4% of incidents, where most of them were infrastructure compromises involving private-key or credential theft. North Korea-linked activity accounted for about $600 million, or 61% of H1 losses.

JadePuffer

Most ransomware operations are already utilizing AI at the phishing and initial access stages, and no-code ransomware kits are sold for $400 to $1,200, TRM noted.

Last month, researchers disclosed JadePuffer, the first fully agentic ransomware attack used for an extortion operation, where an AI agent handled reconnaissance, credential theft, lateral movement, privilege escalation, and encryption end-to-end. 

"JadePuffer shows what ransomware actors are now capable of," Redbord said. "This is the shape of attacks at scale against hospital systems and critical infrastructure ... with no human required in the loop. That is the scale that makes this a civilization-level threat.”

Meanwhile, AI use in narcotics trafficking and darknet markets remains limited, concentrated mainly in marketing, TRM said.

TRM explained that much of the measured criminal activity “ultimately moves value on public blockchains,” making onchain trends a reasonable proxy for broader patterns.