CASE STUDY: How our investigation discovered the ZondaCrypto liquidity issues, one of Europe's largest crypto scandals. [Read the case study]

News // 11.03.2026 // 3 min read // recoveris-team

The democratization of deception: how generative AI is lowering the barrier to crypto crime

Generative AI is industrializing crypto fraud, lowering technical barriers for attackers. Learn how AI-driven deception is evolving and how Recoveris is responding.

The landscape of digital asset crime is undergoing a fundamental economic shift. Historically, executing a high-yield crypto scam, deploying a sophisticated phishing campaign, or bypassing institutional KYC required specialized technical knowledge, multilingual operators, and significant human capital. Today, generative AI has entirely removed that human ceiling. We are witnessing the industrialization of fraud, where the barrier to entry has collapsed, allowing low-skill threat actors to execute machine-scaled deception.

The financial impact of this shift is unprecedented. In 2025, illicit crypto volume reached an all-time high of $158 billion, with scam-related activity alone accounting for roughly $30 billion. Simultaneously, the industry witnessed a staggering 500% increase in AI-enabled scam activity over the past year. Scams with on-chain links to AI vendors are now extracting 4.5 times more revenue than traditional fraud models, generating 9 times the transaction velocity. (Sources: TRM Labs 2026 Crypto Crime Report, Chainalysis 2026 Crypto Crime Report)

Bar chart comparing fraud transaction volume: Traditional Fraud has a short bar, while AI-Enabled Scams has a much taller, glowing bar with a 9x transaction velocity label and upward arrow between them.

“The use of generative AI definitively lowers the technical threshold required to execute sophisticated attacks,” notes Umberto Buonora, Head of Investigations at Recoveris. “We expect to see a sharp increase in thefts driven by hyper-realistic phishing pages, novel malware, and smart contract vulnerabilities that are discovered and exploited in seconds by automated systems.”

In our work, we see that AI is currently deployed most heavily in the initial manipulation phase, targeting the human element before the blockchain is even involved. Threat actors are using large language models to create “synthetic trust”—maintaining coherent, long-term emotional engagements with hundreds of victims simultaneously without the need for manual call centers.

Infographic showing the Synthetic Trust Cycle: AI Model Generation, Automated Engagement, and Multi-Victim Luring, illustrating an automated process flow for digital influence with icons and brief descriptions for each stage.

“Currently, AI is used predominantly to lure victims,” explains Dominik Konopacki, Blockchain Investigations Manager at Recoveris. “While it is still difficult to gather concrete evidence of AI driving complex money-laundering processes, we are seeing it weaponized extensively through deepfakes and automated social engineering to initiate the crime.”

This automated luring is proving highly effective. Deepfakes and synthetic identity generators are now driving approximately 40% of all high-value crypto scams, resulting in an estimated $4.6 billion in losses. Furthermore, fraudsters are utilizing these same generative tools to bypass Virtual Asset Service Provider (VASP) liveness checks and compliance onboarding. (Sources: Elliptic The State of Crypto Scams 2025)

Comparison graphic of traditional phishing (manual, targeted, slower) versus AI-driven luring attack (automated, scalable, faster). Includes icons for each and lists differences in speed, targeting, personalization, and reach.

For compliance teams at crypto exchanges and traditional financial institutions, this democratization of deception poses a severe operational threat. As the volume of sophisticated, AI-driven attacks increases, internal compliance teams risk being overwhelmed by victim reports and incident alerts.

“We will definitely see the numbers go up when it comes to hacks and drainers,” notes Dawid Koperski, Blockchain Investigations Manager at Recoveris. “AI makes it easier to find weak spots, build better phishing websites, deploy smarter contracts, and run more convincing distribution campaigns. In our work, timing is crucial. Fraudsters are getting quicker and smarter, and without better cooperation between Virtual Asset Service Providers and recovery experts, defenders are often left banging at the door while the threat actors slip out the window.”

At Recoveris, we are solving this exact bottleneck. Through our 24-hour Aftercare Protocol and the upcoming BIMS (Blockchain Investigations Management System) platform, we provide VASPs and legal professionals with the law enforcement-grade intelligence and automated triage necessary to handle high-volume compromise events, equipping them to verify, trace, and freeze assets at the speed of the threat.

If your institution is facing an increasing volume of AI-driven fraud attempts, schedule a consultation with our team to discuss how BIMS can automate your incident response.

Read more

Crypto theft: why incident response must be ready before an attack
20.10.2026

Crypto theft: why incident response must be ready before an attack

Hardware wallet incidents, data leaks and UK crypto robberies show why crypto incident response must be ready before theft occurs.

Does MiCA help recover stolen crypto? What EU victims and advisers need to know
05.10.2026

Does MiCA help recover stolen crypto? What EU victims and advisers need to know

Does MiCA help recover stolen crypto in the EU? Learn what provider rules cover, what they cannot reverse, and which steps still matter.

Recoveris Monthly – September 2026
30.09.2026

Recoveris Monthly – September 2026

The civil route in crypto cases, September’s investigation lessons, CoTrace, our NCA/FCA workshop and October events.