Adoption of artificial intelligence in crypto crime rose 40% over the past year, driven primarily by scammers, according to a new report from blockchain intelligence firm TRM Labs.
The index moves to “emerging”
TRM’s 2026 AI-in-Crime Adoption Index places overall AI use across crypto crime at an “emerging” level of 54 out of 100, up from about 28 in 2024. The firm rated scams at a “mature” level of AI adoption, while hacking and ransomware remain “emerging” and narcotics and darknet markets sit at the earliest “horizon” stage.
“AI has not invented new crimes. It removed the constraints on old ones,” said Ari Redbord, TRM’s global head of policy. “The skill floor collapsed, the scale ceiling lifted, and fake identity went industrial — what used to take a team of operators now takes one person with a subscription.”
The share of crypto scam reports involving AI, such as deepfakes or chatbots, has risen as much as 13 times since 2022, and losses from deepfake scams in 2026 have already surpassed the full-year 2025 total by 263%.
AI-assisted hacks and agentic ransomware
TRM said North Korean cyber actors are using deepfake IT-worker infiltration, AI-run social engineering and AI-assisted vulnerability discovery to target firms. In June, security engineer Taylor Hornby used AI to discover a critical vulnerability in Zcash’s Orchard transaction pool that could have enabled the creation of an unlimited amount of counterfeit tokens. Digital-asset hacks reached a record 201 in the first half of 2026, more than double the prior year, with North Korea-linked activity accounting for about $600 million, or 61% of first-half losses.
The firm also flagged JadePuffer, disclosed last month as the first fully agentic ransomware attack, in which an AI agent handled reconnaissance, credential theft, lateral movement and encryption end-to-end. “This is the shape of attacks at scale against hospital systems and critical infrastructure … with no human required in the loop,” Redbord said. “That is the scale that makes this a civilization-level threat.”
Onchain data as the proxy
TRM noted that no-code ransomware kits now sell for $400 to $1,200, and that much of the measured criminal activity ultimately moves value on public blockchains, making onchain trends a reasonable proxy for broader patterns.
