Crypto Forensics Got Smarter, But AI Scammers Got There First

Being an entrepreneur and investor means I sit on the other side of many pitches. I get decks on my desk built around roadmaps and teams that swear their traction is real. 

My job is to figure out which parts of those pitches survive contact with the blockchain. So when I tell you the detection side of this industry has genuinely improved, I’m not repeating a vendor’s pitch deck.

Blockchain forensics platforms like Chainalysis, TRM Labs, and Elliptic have frozen or recovered an estimated $34 billion in illicit funds. More than 45 regulators worldwide now use these tools as standard practice. They help recover stolen money, traced through wallet clustering and entity attribution that are good enough to hold up in court.

Thanks to AI, newer generations of these tools do more than trace money after it’s already moved. Today, there are predictive platforms that claim to flag a wallet before it acts at all. 

They score behavior against 50+ features and retrain daily. One vendor claims a 98% accuracy score across 14 million wallets. We’ve got rug-pull scanners sitting directly inside AI trading agents, checking liquidity locks, freeze authority, and deployer history in about five seconds. 

One such service reported scanning over 881,000 token addresses and flagging 271,000 as high-risk. There are even wallet-clustering tools that spot a “sleeper” address that sat dormant for years and only sprang to life right before a liquidation — the digital version of noticing someone’s been casing your street.

So if you only read the vendor pages, you’d walk away thinking crypto fraud is basically solved, because we now have this small army of machine-learning models watching every chain, every wallet, and every transaction around the clock. 

Then you check what that same machine-learning era has done to the other side of the ledger.

The Numbers Behind AI Crypto Scams

According to Chainalysis, total crypto scam and fraud-related losses for 2025 sit at roughly $17 billion, up from $9.9 billion the previous year. The FBI’s own figure for crypto fraud over the same period is $11.36 billion in the US alone, a 22% jump year-on-year.

Those are the numbers that make it onto a panel slide. But the one that actually changed how I run due diligence is this: Chainalysis found that AI-powered scams were 4.5x more profitable than traditional ones. 

Same con, same target, but with AI, scammers can manufacture fake support agents, fake investors, or trusted insiders at scale.

Lior Aizik, co-founder and Chief Operating Officer at crypto exchange XBO, has publicly warned that impersonation scams are increasing and becoming more sophisticated industry-wide. His rule of thumb is simple: never transfer your crypto to anyone you can’t verify, especially if the request comes wrapped in urgency and secrecy.

Impersonation fraud — criminals posing as a bank, an investor, or a crypto influencer — posted 1,400% year-on-year growth. Scammers now use AI to run expensive, targeted cons on people they’ve profiled first, rather than the cheap, high-volume spray-and-pray approach they used before. 

That pushed the average payment size sharply higher, from $782 in 2024 to $2,764 in 2025, a 253% increase. I take this personally, because investors and operators with any public profile are exactly who gets cloned.

Here’s the uncomfortable part: while defensive tooling has gotten dramatically better, the offensive results have gotten better too. 

It’s like a generative adversarial network, where the generator and discriminator share a rivalry that improves the whole model continuously. 

Both offensive and defensive tools draw from the same well of AI capability. Right now, that well favors the first mover, not whoever builds the better model in isolation.

Why Better Detection Keeps Losing the Race

The honest answer is that forensic tools are built for detective work, not prediction. For an investigation to happen, a crime needs to have been committed. 

You need a victim who has already lost money before you can trace a pattern visible enough to flag. Even the predictive models that claim to catch a rug pull before it happens are trained on yesterday’s scams — and tomorrow’s scam is being designed by someone who read the same training data.

This became clear to me in real time with the FBI’s NexFundAI sting: the fake honeypot token federal agents created to catch wash traders. 

The FBI created NexFundAI as a fake token to catch market manipulators.@EvanLuthra exposed how the FBI built a professional website, hired market makers to fake volume, and arrested 18 people across the US, UK, and Portugal. $25M was seized…After Evan posted about it, the… pic.twitter.com/UPCCp9VKEn

— BeInCrypto (@beincrypto) June 1, 2026

A day after the DOJ announced arrests tied to the operation, someone cloned the exact smart contract and launched a copycat token, making $127,000 in a single day using the same tactics the FBI had just exposed in court documents.

Any LP who asked me whether “the worst behavior in this market was finally getting cleaned up” would have had their answer within twenty-four hours. 

The FBI operation became the blueprint for the attacker. Every disclosure that helps the defender also hands the attacker a working template — and attackers read faster than regulators patch.

The Attack Side Just Got Cheaper and Faster

You can see the same asymmetry in how little effort an attack now takes. Software developer Peter Steinberger built a popular open-source project that lets you run an AI assistant on your computer with full system access via apps like Telegram, WhatsApp, and Discord. 

The product had to be rebranded after a trademark dispute.

Within minutes of the rebrand announcement, someone had hijacked his old GitHub and X accounts and used them to launch and pump a token that reached a $16 million market cap before crashing over 90%. 

No malware, no stolen keys. Just someone fast enough to exploit a gap in attention that no forensic tool was watching for. The tools weren’t watching because nothing illegal had happened yet.

The man behind Clawdbot– Peter Steinberger– Austrian software engineer and founder– deeply technical, low-ego, builder-first profileEarly formation:– studies medical computer science at TU Vienna– becomes a tutor while still a student– later runs iOS and Mac development… pic.twitter.com/J9xxiPX30l

— StarPlatinum (@StarPlatinum_) January 27, 2026

When the AI Agent Is the One Getting Rugged

It’s not just humans falling for this that worries me, because so many of the pitches I get are some version of “let our AI agent trade for you.” Those agents can lose money on your behalf too. 

A developer described how an AI agent on Solana bought a token that rugged 94% after twenty minutes, costing the agent’s wallet $12,000. 

On investigation, the token had freeze authority enabled, the top 10 holders controlled 91% of the supply. The deployer had already launched three previous scam tokens.

Every one of those red flags was supposed to be checkable in seconds by the detection tools I’ve described here. But the agent didn’t check. It simply saw a token and a price and bought it — because nobody wired the safety layer to the decision layer. 

That’s the exact failure mode I now stress-test in every agent-based fund pitch that crosses my desk.

The Part No Tool Can Fix

What worries me most is that some of this damage never touches a smart contract at all. I have a public profile and a following, which makes me exactly the kind of face that gets cloned. 

In May, it was reported that a woman in Guelph, Ontario, lost $14,000 to scammers after thinking she was speaking with YouTuber Mr Beast about a crypto investment. She wasn’t. Mr Beast has been fighting AI-generated videos that use his likeness to push fake giveaways for years.

Lots of people are getting this deepfake scam ad of me… are social media platforms ready to handle the rise of AI deepfakes? This is a serious problem pic.twitter.com/llkhxswQSw

— MrBeast (@MrBeast) October 3, 2023

Forensic tools don’t flag these interactions, because nothing about them touches the chain until the money is already moving. The fraud happens in a video call, in a moment of trust. By the time a transaction exists for an analytics platform to score, the decision that costs the victim has already been made.

AI has gotten better at manufacturing that false trust faster than it has gotten at flagging it. And that’s where most of the $17 billion actually went.

AI Crypto Scams: So Who’s Actually Winning?

Neither side.

That’s the most honest answer I can give. Both sets of tools, forensic and predictive, are real. The recoveries are real. Dismissing them because fraud has also grown would be its own kind of dishonesty. 

But “real and improving” isn’t the same as “ahead.” The 2025 data is clear: in dollar terms, offense has improved faster than defense.

If there’s one reason for that, it’s this. Detection tools mainly answer the question “is this wallet suspicious?” — and that question is only asked after someone decides to check. 

Then there are cases like Guelph, where there’s no wallet to scan in the first place. AI has made those cases more common, which is why I’ve stopped treating AI as a selling point in any pitch and started treating it as the first thing I want to stress-test.

The blockchain can confirm a wallet’s history. It can’t confirm a phone call,