TL;DR
AI scams earn 4.5x more per operation ($3.2M vs $719K) and run 9x more transfers per day. Deepfakes alone cost $3.7B recorded. LLMs appear in 7 of the 10 largest 2025 AI-crypto frauds (~$1.8B); bots in 6 (~$1.9B). The new surface: prompt-injected agents, vibe-coded wallet malware, x402 payment rails without human review, and synthetic identities that pass video verification. Crypto safety and AI safety are now one curriculum.
| LAYER | WHAT ATTACKERS DO | DEFENSE |
|---|---|---|
| Identity (deepfake) | Face-swap + voice clone defeats video checks; celebrity fake endorsements | Second-channel verify. Family code word. Never attest by video alone. |
| Language (LLM) | Fluent multi-language pig-butchering, support, and phishing at scale | Assume any DM/chat can be synthetic. Slow down under rapport. |
| Code (vibe malware) | AI-generated drainers, wallet stealers repackaged as “AI tools” | Install only audited software. Simulate every new contract. |
| Agents | Prompt injection via docs/pages → agent signs/transfers | Scoped session keys. Human approval for value-moving calls. |
| Payments (x402) | Machine micropayments that bypass human review habits | Agent budgets + allow-lists. Alerts on unfamiliar recipients. |
| Automation (bots) | Flash-loan orchestration, oracle games, rapid laundering | MEV-aware routing. Slippage caps. Halt on anomaly. |
The mental shift: AI does not just generate scams — it generates scam operators. A single actor with an LLM, a face-swap tool, and a Telegram vendor list can run what used to take a call center. TRM’s figures show deepfake-scam losses in 2026 year-to-date already exceeding all of 2025 by 263%, with AI-scam losses jumping ~400x quarter-over-quarter on a small base. Directionally, that is the story: believability and scale, together, for the first time.
Agent wallets change the threat model in the other direction. When your agent can sign, it can be prompt-injected — a malicious webpage, doc, or tool output instructs the agent to send funds. The fix is architecture, not vigilance: least-privilege sessions (spend caps, contract allow-lists, short expiry), human approval for irreversible calls, and separate wallets for agents vs humans. An agent should be able to propose, not dispose, above a threshold.
For builders: ship provenance and simulation by default. Every agent action that moves value should be simulatable (what will this contract actually do?) and attributable (which model, which input, which policy). For users: vet AI “trading bots” and “yield optimizers” like any new protocol — if you cannot find an audit, a multisig, and a revoke path, you are the product.
AI adoption across crypto crime is Emerging at 54/100 (up from 28 in 2024) — scams are already Mature. The share of scams where AI was part of the operation has grown ~13x since 2022.
TRM LABS · 2026 AI-IN-CRIME INDEX
NEVER GIVE AN AGENT
Your seed phrase or long-lived private key. Ever. No matter how “helpful” it seems.
Unlimited approvals or a wallet with 90% of your funds.
Authority to act on untrusted text (pages, DMs, docs) without human confirmation.
ALWAYS GIVE AN AGENT
A dedicated, low-balance session wallet with spend caps and allow-lists.
Short-lived keys with explicit expiry and a one-click revoke.
A simulation step before any signature, and an alert on every recipient.
THE AI VETTING QUESTION
For any AI crypto tool, ask: which wallet does it control, what can it sign, how do I revoke it, and what does it do with my data? If the tool cannot answer in one page, do not connect it. “Vibe-coded” does not mean “safe to sign.”
DEFENSE CHECKLIST — MODULE 04
[01] Agents get session keys + caps, never seeds. Human confirms above threshold.
[02] Verify AI “support” and “video” via second channel. Deepfake ≠ proof.
[03] Vet AI tools: audit, multisig, revoke path — or do not connect.
[04] Treat all untrusted text as untrusted input to agents. Quote it, do not obey it.
[05] Log agent actions. If it moved money, you should be able to replay why.
SCHOOL INDEX
← PREVIOUS · MODULE 03
Phishing & Impersonation
Fake sites, fake support, fake airdrops, clipboard hijackers, and approval phishing — how a $500 phishing kit scales to 330,000 texts a day.
NEXT · MODULE 05 →
Privacy Is Not Pseudonymity
How chain analytics clusters your wallets, why Tornado Cash still leaks 34.7%, and what real OPSEC looks like on transparent chains.
PNTHR SCHOOL · FREE + OPEN · SOURCES: FBI IC3 2025 · CHAINALYSIS 2026 · TRM LABS · CERTIK · IMMUNEFI · TUTELA · EDUCATION ONLY · NOT FINANCIAL ADVICE · NOT LEGAL ADVICE