Imagine watching a video of a well-known figure endorsing a crypto investment, or receiving a voice message that sounds exactly like someone you trust. The content looks convincing, the opportunity seems credible, and the pressure to act quickly is hard to ignore. Yet none of these details proves that the person or offer is genuine.
In September 2026, the Bank of Italy warned about deepfake videos impersonating its governor to promote fraudulent investment platforms. As AI makes impersonation easier and more convincing, crypto users face risks that go beyond fake promotions to phishing, fraudulent trading platforms, and malicious wallet transactions.
Knowing how these scams work—and how to verify what you see before sending funds or approving a transaction—is essential to protecting your crypto assets.
What Are AI Crypto Scams?
AI crypto scams are fraudulent schemes that use artificial intelligence to deceive cryptocurrency users, steal account credentials, manipulate investment decisions, or obtain unauthorized access to digital assets.
Scammers may use AI-generated images, deepfake videos, cloned voices, convincing phishing pages, and automated chatbots to impersonate exchange employees, project founders, influencers, friends, or investment advisers. AI can also help criminals personalize messages and manage conversations with multiple targets at once.
The underlying fraud is often familiar. A fake investment opportunity, phishing link, or fraudulent giveaway may have existed long before generative AI. What changes is how quickly scammers can create believable content and adapt their approach to individual victims.
The scale of the problem is significant, although not every crypto scam involves AI. In its 2026 Crypto Crime Report on scams, Chainalysis estimated that cryptocurrency scams and fraud received at least $14 billion in on-chain inflows during 2025 at the time of publication. The company projected that the figure could exceed $17 billion as additional illicit addresses were identified.
Chainalysis also found that scams with demonstrable on-chain links to AI vendors generated an average of $3.2 million per operation, compared with $719,000 for operations without those links. That is approximately 4.5 times as much revenue per operation in the dataset analyzed. These figures describe a specific group of observed scams, not every AI-enabled scam or the entire crypto fraud market.
For users, the practical lesson is straightforward: do not rely on how authentic a message looks. Verify the person, the website, and the transaction independently.
The 8 Most Common AI Crypto Scams to Watch For
Eight common AI crypto scams, including deepfakes, phishing, fake exchanges, fraudulent investments, and wallet drainers.
1. AI Deepfake Videos and Voice-Cloning Scams
Deepfakes use AI to create or manipulate video, audio, or images to make someone appear to say or do something they never did. Voice-cloning tools can imitate a person's speech, while face-swapping technology can place that person's likeness into fabricated footage.
In crypto, scammers may use these techniques to:
Promote fake token launches or investment opportunities using a celebrity's likeness.
Broadcast fraudulent giveaways through imitation livestreams.
Impersonate exchange executives or project founders in fake announcements.
Mimic a friend, colleague, or business partner requesting an urgent transfer.
A fabricated livestream might promise to double any cryptocurrency sent to a particular address. A cloned voice might claim that an account needs immediate verification. Both scenarios rely on the same tactic: using apparent familiarity or authority to make the victim act before checking the claim.
How to protect yourself:
Verify announcements on the organization's independently accessed official website or social accounts. If someone you know requests money, contact them through a different channel using contact details you already trust. Do not treat blinking patterns, facial movements, or audio quality as definitive deepfake tests.
2. Fake Crypto Exchange and Customer Support Scams
Fake support scams target users who are already looking for help with a withdrawal, account restriction, wallet error, or missing transaction.
Scammers may create imitation support profiles, sponsored search results, fake help-center pages, or automated chatbots. AI can make their responses sound professional and help them maintain a convincing conversation.
A typical scheme unfolds in stages:
A user searches for help with an exchange or wallet issue.
A fake support account or website offers to resolve the problem.
The supposed agent asks for login details, a verification code, a private key, or a seed phrase.
The attacker uses the information to compromise the account or wallet.
Some scammers also ask victims to install remote-access software or run commands on their computers, potentially exposing credentials and wallet activity.
How to protect yourself:
Open support through the exchange's official website or app, preferably using a saved bookmark or an address you have independently verified. Never share your seed phrase or private key with a support agent. Treat requests for authentication codes, remote access, or unusual software installations with caution.
3. AI-Powered Phishing and Fake Websites
AI can help scammers produce convincing emails, direct messages, advertisements, and websites that imitate legitimate exchanges, wallets, and decentralized applications.
The message might claim that your account will be suspended, a withdrawal has failed, or a limited-time reward is waiting. Its grammar may be flawless, its branding may look familiar, and its chatbot may answer questions convincingly.
The danger comes from what the fake page asks you to do. You might enter your exchange password, disclose a recovery phrase, download malware, or sign a malicious transaction.
Phishing sites may use domains that resemble legitimate addresses by changing a character, adding a word, or using a misleading subdomain. A familiar logo does not establish that a website is genuine.
How to protect yourself:
Navigate to exchanges and wallets through verified bookmarks or official apps.
Inspect the complete domain before entering credentials.
Never enter a seed phrase into a website claiming to verify, synchronize, or unlock your wallet.
Avoid unsolicited attachments, downloads, browser extensions, and commands.
Verify account alerts through the platform itself rather than the link in the message.
4. Crypto Impersonation and Giveaway Scams
Impersonation scams exploit trust in recognizable people and organizations. A scammer may copy a project's branding, create a lookalike social account, or use AI-generated content to make a fake endorsement more persuasive.
Common examples include:
Fake posts claiming that a prominent trader has launched a token.
Fraudulent giveaways promising extra cryptocurrency in return for an initial transfer.
Fake exchange announcements asking users to migrate funds to a new wallet.
Messages from supposed founders or employees requesting urgent payments.
The scam may be promoted across several channels to create the impression of widespread legitimacy. Fake comments and fabricated testimonials can add to that impression.
How to protect yourself:
Confirm announcements through independently accessed official channels. Check whether the account and domain are genuine, and compare the announcement with the project's official documentation. Never send cryptocurrency to an address simply because a well-known person appears to endorse it.
A genuine-looking profile, verified badge, or video is not sufficient evidence that an offer is legitimate.
5. Fake Investment, Romance, and Trading Signal Scams
Investment scams often build trust over time rather than asking for money immediately. AI can help criminals generate personalized messages, maintain conversations, fabricate trading records, and operate fake investment communities.
Three common variations are worth recognizing.
Fake investment advisers: A supposed expert claims to have an exclusive trading strategy, private signals, or an automated system that generates reliable profits. Victims are encouraged to deposit funds into an unfamiliar platform or transfer cryptocurrency to an address controlled by the scammer.
Romance-based investment scams: A scammer builds a personal relationship and gradually introduces cryptocurrency investing. They may direct the victim to a fraudulent platform that displays fabricated account balances and apparent profits. When the victim tries to withdraw, the platform demands additional payments or fees.
Fake signal groups: A group presents fabricated performance records, coordinated testimonials, and confident trading calls. After building credibility, its operators push members toward a particular token, exchange, or deposit address.
The common thread is not the use of AI itself. It is the manipulation of trust, combined with a financial request that the victim cannot independently verify.
How to protect yourself:
Be skeptical of guaranteed returns, pressure to invest quickly, requests to transfer funds to personal wallets, and platforms you cannot independently verify. Do not allow someone you have met online to control your wallet or make investment decisions on your behalf.
6. Fake Tokens, Airdrops, and Presales
AI-generated websites, white papers, promotional campaigns, and community messages can make a fraudulent token project look established before it has any meaningful track record.
A victim might receive a message announcing an airdrop, discover a token through social media, or be invited to join a presale. The site then asks them to connect a wallet, pay an upfront fee, or approve a transaction to claim the reward.
Not every wallet connection is malicious, and not every airdrop has the same requirements. The important question is what the site asks you to authorize.
A malicious token approval may allow a smart contract to spend certain tokens from your wallet. A deceptive signature may authorize an action that is not immediately obvious from the website's explanation.
How to protect yourself:
Verify token launches and airdrop announcements through official project channels.
Research the project, contract address, and available independent security information.
Review the permissions requested by wallet prompts.
Avoid signing messages or approving transactions you do not understand.
Be wary of unsolicited rewards that require an upfront payment or broad token permissions.
An audit or an established-looking white paper does not, by itself, prove that a project is legitimate.
7. Wallet Drainers and Malicious Smart-Contract Interactions
Wallet drainers are malicious tools or contracts designed to help attackers transfer assets from victims' wallets. Scammers may direct users to them through fake airdrops, phishing websites, imitation DeFi applications, or fraudulent video-call invitations.
The attack does not always begin with an obvious transfer. A website might request a token approval or a signature that authorizes a later transaction. In some cases, attackers use deceptive permit signatures, which can pre-authorize token transfers without an immediate on-chain transaction from the victim.
A July 2026 advisory from the Singapore Police Force on cryptocurrency scams involving malicious links and unauthorized transactions described cases in which victims were induced to install malicious software and approve permit signatures, potentially allowing future transactions without further approval.
It is important to distinguish three actions:
Connecting a wallet: Establishes a connection between the wallet and a website. It does not automatically give that site unrestricted control over all assets.
Approving token spending: Grants a contract permission to spend a specified token, potentially up to the approved allowance.
Signing a transaction or message: Authorizes a particular action or statement, whose consequences depend on what is being signed.
How to protect yourself:
Read transaction and signature details before approving them. Be especially cautious when a site asks you to install software to join a video call, verify a wallet, or unlock a reward. Regularly review token approvals and revoke permissions you no longer need, using a trusted wallet interface or blockchain tool.
A hardware wallet can protect private keys from certain remote attacks, but it cannot make a malicious transaction safe if you authorize it.
8. Hardware-Wallet and Fake Firmware Scams
Hardware wallets keep private keys isolated from many internet-connected threats, but they do not eliminate the risk of social engineering.
Scammers may impersonate a hardware-wallet manufacturer and send messages claiming that a firmware update, security check, or recovery procedure is urgently required. A linked website then asks the user to enter their seed phrase.
Another possible attack involves counterfeit or tampered devices, including devices supplied with recovery information that the buyer does not control.
The scammer's objective is to obtain the recovery phrase or persuade the victim to approve a malicious transaction. Once an attacker has the seed phrase, they may be able to reconstruct the wallet and transfer its assets.
How to protect yourself:
Purchase hardware wallets from the manufacturer or an authorized seller.
Follow update and recovery instructions obtained from the manufacturer's independently verified website.
Never enter a seed phrase into a website or share it with supposed support staff.
Inspect transaction details on the device before approving them.
If your recovery phrase may have been exposed, treat the wallet as compromised.
A hardware wallet is a security tool, not a substitute for verifying what you sign.
How to Spot an AI Crypto Scam
AI-generated content can be convincing enough that visual inspection alone is unreliable. Instead of trying to identify every fake by appearance, focus on whether the identity, request, website, and transaction can be independently verified.
Four ways to spot AI crypto scams: verify identities, check URLs, review wallet permissions, and recognize pressure tactics.
Verify Identity Through a Separate Channel
If a friend, colleague, exchange employee, or project founder asks you to send cryptocurrency, share sensitive information, or take urgent action, verify the request through a separate channel.
For example, call the person using a number already saved in your contacts. If a message claims to come from an exchange, open its official app or website yourself and check for the same notification.
Do not use the phone number, email address, or verification link supplied in the suspicious message as your only source of confirmation.
Check URLs, Accounts, and Announcements
Look at the complete domain, not just the brand name or logo. Watch for misspellings, extra words, misleading subdomains, and unexpected redirects.
Also check whether the announcement appears on the project's official website or other independently verified channels. A social account's follower count, polished design, or verification badge should not be treated as conclusive proof.
If you cannot independently confirm a claim, do not transfer funds or provide credentials.
Review Wallet Connections, Signatures, and Approvals
A wallet prompt is a request to authorize an action, not simply a routine step to dismiss.
Before approving anything, ask:
Which asset or account is involved?
Is this a transaction, a token approval, or a message signature?
What permissions are being granted?
Does the requested action match what you intended to do?
Can you verify the contract address and application independently?
If the wallet interface does not provide enough information to understand a request, pause rather than approving it blindly. Do not rely exclusively on a website's explanation of what the signature does.
Recognize Pressure and Unrealistic Promises
Scammers often try to prevent victims from checking their claims. Warning signs include:
Claims that you must act immediately to avoid losing access or missing a reward.
Guaranteed profits or claims of risk-free cryptocurrency trading.
Requests to keep an investment or transfer secret.
Pressure to move a conversation to a private messaging channel.
Requests for a seed phrase, private key, authentication code, or remote access.
Demands for additional payments to release supposedly earned profits.
One warning sign alone may not establish fraud. But when a financial request comes with urgency, secrecy, or unverifiable claims, stop and investigate before proceeding.
How to Protect Your Crypto From AI Scams
No single security measure can prevent every scam. The strongest approach combines account security, careful transaction review, and independent verification.
Secure Your Exchange and Email Accounts
Use unique, strong passwords for your email, exchange, and wallet-related accounts. A password manager can help you avoid reusing credentials across services.
Enable two-factor authentication where available. An authenticator app or a supported passkey can provide stronger protection than relying solely on SMS codes in some circumstances.
Your email account deserves particular attention because access to it may allow an attacker to reset passwords or intercept account notifications. Keep recovery methods secure and review account activity for unfamiliar sessions or forwarding rules.
Protect Your Seed Phrase and Private Keys
A seed phrase can give someone control over the assets associated with a self-custody wallet. Never disclose it to someone claiming to be an exchange employee, project representative, or wallet support agent.
Store recovery information securely offline. Do not paste it into websites, online forms, chatbots, or unsolicited wallet-recovery tools.
If you suspect your seed phrase has been exposed, changing your exchange password is not enough. You may need to move remaining assets to a new wallet generated with a secure, uncompromised recovery phrase.
Verify Apps, Websites, and Downloads
Install wallet software and browser extensions only from sources you have independently verified. Keep your operating system, browser, and wallet software updated, but do not install an update from a suspicious message or unfamiliar website.
Be especially careful with unexpected video-call invitations that ask you to download a special codec, browser extension, or meeting application. A request to run commands on your computer to fix a supposed connection problem is another serious warning sign.
Limit Wallet Permissions and Review Transactions
Use separate wallets for different purposes where practical, such as keeping long-term holdings apart from funds used for frequent DeFi interactions.
Review token approvals periodically and revoke unnecessary permissions using trusted tools. Remember that revoking an approval may prevent future transfers under that permission, but it does not reverse transactions that have already been completed.
When interacting with a new protocol, verify the application and contract address through reliable sources. Do not approve transactions solely because a website claims they are required to receive an airdrop or validate your wallet.
For broader guidance on recognizing common cryptocurrency fraud, see this guide to avoiding Bitcoin scams.
Slow Down Before Sending Funds
Scammers benefit when victims act before thinking. Build a simple verification habit for unexpected transfers:
Stop and identify exactly who is requesting the payment.
Verify the request through an independent channel.
Check the recipient address and transaction details.
Confirm the purpose and amount before signing.
If anything remains unclear, do not proceed.
For a new recipient or unfamiliar application, a small test transaction may help confirm that the destination is correct, but it does not prove that the recipient or platform is legitimate.
What to Do If You Suspect an AI Crypto Scam
If you clicked a suspicious link, disclosed credentials, approved a questionable transaction, or sent cryptocurrency to a scammer, respond according to what may have been compromised. Do not send more money to someone promising to recover your funds. Recovery-fee scams often target victims a second time.
If Your Exchange Account May Be Compromised
Access the exchange through its verified app or website.
Change compromised passwords and secure the associated email account.
Revoke unfamiliar sessions or devices and reset affected authentication methods.
Contact the exchange's official support team and ask whether it can restrict withdrawals or secure the account.
Preserve account alerts, suspicious messages, and relevant transaction records.
If you can no longer access the account, use the platform's official recovery process rather than contacting support accounts found through unsolicited messages or search advertisements.
If You Approved a Suspicious Wallet Transaction
Stop interacting with the suspicious website or application.
Use a trusted wallet interface or blockchain tool to review the transaction and any related token approvals.
Revoke suspicious or unnecessary approvals where possible.
If your seed phrase or private keys may have been exposed, create a new wallet in a secure environment and move remaining assets to it, provided you can do so safely.
Avoid signing further messages or transactions presented by the suspected scammer.
Disconnecting a wallet from a website alone may not revoke previously granted token allowances or cancel a signed authorization. The appropriate response depends on what you approved and whether the wallet's recovery phrase has been compromised.
If You Have Already Sent Cryptocurrency
Save the transaction hash, recipient address, amount, time, screenshots, messages, and any website or account details associated with the incident. Contact the exchange or service involved and report the transaction to the appropriate law-enforcement agency.
If you suspect a cryptocurrency scam, report it to your local law enforcement agency and notify the relevant exchange or platform. Follow official guidance in your jurisdiction for additional precautions and reporting procedures.
Cryptocurrency transfers are generally difficult to reverse once confirmed on-chain. Prompt reporting may help an investigation, but it does not guarantee that funds will be recovered.
