Cryptocurrency scam operations that build artificial intelligence into their playbook are pulling in dramatically more money than those that do not, according to data from blockchain analytics firms Chainalysis and TRM Labs that maps a sharp escalation in digital-asset fraud through 2025.
In its 2026 Crypto Crime Report, published in January, Chainalysis found that scam networks with visible on-chain links to AI tool providers collected an average of $3.2 million per operation last year, against $719,000 for operations without such links — a gap of roughly 4.5 times. The AI-linked networks also moved money far more aggressively, executing an average of 35.1 transfers a day compared with 3.89 for their non-AI counterparts, or close to nine times the transaction volume. TRM Labs, a separate blockchain intelligence firm, reported an approximate 500% increase in AI-enabled scam activity over the past year, saying generative AI is letting criminals automate phishing, impersonation and synthetic-identity creation that once required much larger teams.
A record year for crypto fraud overall
The AI effect sits on top of a broader surge. Chainalysis estimates that at least $14 billion flowed into crypto scams on-chain in 2025, a number the firm expects could eventually exceed $17 billion as investigators identify more illicit wallets. The average payment made to a scam climbed from $782 in 2024 to $2,764 in 2025. Within that total, impersonation scams — in which criminals pose as banks, government agencies or crypto exchanges — grew by more than 1,400% year-on-year, with the average payment tied to those schemes rising even faster.
None of this reflects new categories of fraud, Chainalysis’s report suggests; the underlying scams, from high-yield investment schemes to romance fraud, are largely familiar. What has fallen is the price and effort required to fabricate a believable identity and reach victims in volume.
AI-generated identities are slipping past verification
The same tools reshaping scam operations are also being turned against the identity checks crypto platforms use to screen new users. Research cited by identity-security vendors suggests a synthetic identity capable of challenging know-your-customer (KYC) systems can now be produced for under $20 in about 30 minutes. Rather than holding a forged document up to a camera, attackers increasingly rely on “injection attacks” that feed AI-generated video straight into a verification system, sidestepping the physical camera altogether. One 2026 benchmark found that this kind of attack defeated basic, single-layer liveness checks 58% of the time.
Binance Research puts the scale of the problem in context: cryptocurrency accounts for 88% of all detected deepfake fraud cases worldwide, and roughly 80% of attacks aimed at Binance itself involve some form of KYC fraud. Exchanges say they are fighting back with the same technology — Binance says AI has driven up to a 100-fold improvement in the efficiency of its KYC processing, with its liveness and face-attack detection models retrained on an ongoing basis.
Frozen funds and cross-border arrests
Recovery and enforcement efforts have scaled up in parallel. Tether, the stablecoin issuer, says it had frozen more than $4.4 billion in assets tied to illicit activity by April 2026, while the T3 Financial Crime Unit, a public-private partnership focused on stablecoin-related crime, froze over $300 million in its first year. INTERPOL’s Operation First Light 2026 led to 5,811 arrests across 97 countries and territories and the interception of $293 million in illicit assets. Europol’s Operation Endgame, meanwhile, disrupted 326 servers and 142 domains, recovered 27 million stolen credentials, and restricted more than €41 million — roughly $47 million — in criminal crypto assets.
What it means for Pakistan
The trend lands at a delicate moment for Pakistan, which has moved within a few years from barring cryptocurrency activity outright to actively regulating it. The country restricted crypto dealings in 2018 over financial-stability concerns. That position reversed decisively this year: parliament passed the Virtual Assets Act, 2026, which has since been signed into law, putting the Pakistan Virtual Assets Regulatory Authority (PVARA) — first constituted through a presidential ordinance in July 2025 — on permanent statutory footing. The State Bank of Pakistan followed with a circular applying strict anti-money-laundering and counter-terrorism-financing rules to banks and licensed virtual asset service providers (VASPs).
Under the new law, operating as an unlicensed VASP carries fines of up to PKR 50 million (about $179,000) and up to five years’ imprisonment, while unauthorised promotion of virtual assets draws fines of up to PKR 25 million (about $89,000) and up to three years in prison. PVARA, chaired by Bilal Bin Saqib, opened licence applications to crypto firms in September 2025, targeting a Pakistani user base estimated at 40 million; its draft Pakistan Virtual Asset Services Regulations, 2026, went out for public consultation earlier this year and had not been finalised as of this writing. Separately, Pakistan ranked third worldwide in Chainalysis’s 2025 Global Crypto Adoption Index — a scale of retail participation that underlines how much exposure the new licensing regime, and the fraud risks the same firm has now quantified, will eventually cover.
Enforcement responsibilities are split across agencies. The Federal Investigation Agency (FIA) set up a dedicated Cryptocurrency Investigation Unit inside its National Command and Control Centre in July, focused specifically on money laundering and terrorism financing conducted through digital assets; PVARA continues to handle licensing and market supervision separately. General online fraud complaints, including the impersonation and fake-website scams described in the Chainalysis report, fall instead to the National Cyber Crime Investigation Agency (NCCIA), which operates under the Prevention of Electronic Crimes Act, 2016.
For Pakistani exchanges, and for the freelancers, overseas-remittance recipients and retail investors who use them, the practical implication is straightforward: identity checks built around a selfie and a national ID scan can no longer be assumed secure against a well-resourced attacker. Platforms operating under PVARA’s forthcoming licence regime will likely need verification standards built for that reality rather than the one crypto services were designed around a few years ago.
The telecom regulator has already flagged the specific threat vector behind much of the AI-scam surge. The Pakistan Telecommunication Authority issued a public advisory in late July urging citizens to watch for signs of manipulated video and images, such as irregular blinking, mismatched lighting or shadows, and blurred facial edges, as deepfake-enabled fraud increases. The advisory suggests Pakistani authorities are already treating AI-generated impersonation as an active consumer-protection issue rather than a distant risk.
What happens next
PVARA’s licensing framework is still being finalised, with regulations covering exchanges, custodians and other VASPs open for comment before they take final form. Chainalysis, for its part, expects AI to become a standard feature of scam operations rather than a niche tactic, which means platforms and regulators alike will need verification systems that no longer take video or images at face value. For a market the size of Pakistan’s, where legal access to crypto services is only now being formalised, how quickly that infrastructure matures may decide how much of the fraud wave documented globally in 2025 repeats itself locally.
Leave a Reply