AI scammers no longer need to hack your wallet if they can convince you to use it for them

Taken together, these datasets show why AI is increasingly useful to scammers: it can make impersonation cheaper, more convincing, and easier to operate at scale.

A single attacker can maintain conversations with victims in multiple languages. Synthetic video can strengthen a false identity during remote verification. Voice cloning can imitate an executive or family member. AI-generated documents, profiles and communications can make a fraudulent request appear consistent across several channels.

The breach increasingly happens before the signature

The problem becomes more consequential in crypto because transactions are difficult to reverse once authorized.

TRM’s separate review of first-half crypto hacks showed that smart-contract vulnerabilities remained common, but the largest losses were concentrated in infrastructure and operational compromises.

Such attacks can involve stolen credentials, private keys, or other forms of access that allow an attacker to issue instructions the underlying blockchain accepts as legitimate.

Deepfakes extend that problem by helping attackers obtain cooperation rather than merely stealing access.

At an exchange, an attacker could impersonate a customer during account recovery, change authentication factors, and add a new withdrawal destination. Each subsequent step may appear valid because the attacker has already compromised the identity decision that controls access.

That makes post-onboarding identity checks increasingly important. FinCEN has warned financial institutions to watch for mismatched identity information, suspicious device or location changes, third-party webcam tools, resistance to multifactor authentication, and rapid transactions following account changes.

A recovery-factor change followed by a new device, new withdrawal address, and immediate transfer can therefore require stronger verification before assets leave the platform.

Corporate treasuries also face a similar risk.

A synthetic voice or video of an executive can pressure an employee to approve a transfer, alter a signer or add a new payment address. Hardware wallets can confirm that the correct private key signed the transaction, but they cannot determine whether the human controlling that key was deceived.

Multiperson approval, pre-established confirmation channels and delays before newly added withdrawal addresses become active can move the critical decision outside the communication channel controlled by the attacker.

The FBI has also warned that North Korean IT workers have used false identities, manipulated video, AI tools and remote-access infrastructure to gain positions that can provide privileged access to corporate systems and cryptocurrency.

For individual holders, the attack can be even simpler. A convincing video call, voice message, or profile can persuade the victim to make the payment personally. In that case, blockchain monitoring begins only after the decisive security failure has occurred.

On-chain tools remain useful for detecting suspicious flows, tracing stolen assets, and supporting freezes where centralized intermediaries can intervene. However, they are less effective at stopping a transaction that appears legitimate because the victim or authorized signer willingly approved it.

TRM’s data therefore points to a security gap that sits outside the smart contract itself.

Crypto companies still need contract audits, private-key protection, wallet simulation, and transaction monitoring. But as AI makes impersonation more effective, the more consequential control may increasingly be the one that challenges who is giving the instruction before an irreversible transaction is signed.