The use of large language models in scams increased fivefold in 2025, according to TRM Labs, as fraudsters leveraged the technology to boost outreach, make scams more convincing and launch them at scale.
It comes as $35 billion in cryptocurrency was sent to scammer addresses in 2025, a slight decrease from $38 billion in the previous year, TRM Labs said in its 2026 crypto crime report on Wednesday.
“Large language models (LLMs) enable scams to cross language and cultural contexts with less friction, while AI-generated images, voice cloning, and deepfake videos reduce the cost of creating convincing personas,” the firm said.
In March last year, at least three crypto founders reported foiling an attempt from alleged North Korean hackers to steal sensitive data through fake Zoom calls that used deepfakes.
“These capabilities are expanding impersonation-style scams across messaging platforms, recruitment campaigns, and investment fraud — and they increase the likelihood that victims can be deceived even when aware of scam warnings,” TRM Labs said.
AI-powered deepfakes are becoming a standard tool to create more convincing scams. Source: TRM Labs
Scammers are starting to combine fraud tactics
Another trend last year was the convergence of scam tactics, according to TRM Labs, with crypto scammers increasingly using a multifaceted approach to dupe victims.
TRM Labs said this could start with a romance scam to build trust, then transition to offering fake investments once trust is established, and end with a tax scam that demands payment for non-existent tax and administrative fees.
“A defining trend in the current state of crypto fraud is the convergence of distinct scam typologies. Victim journeys increasingly span multiple phases of deception, combining elements of romance scams, investment fraud, and advance fee schemes,” the firm said.
“Although social engineering remains a key component of fraud campaigns, it is now reinforced by technical and organizational innovations that make fraud more scalable and harder to detect.”
Scam networks operating with a businesslike structure
The layered approach by fraudsters reflects a shift toward more sophisticated scam campaigns and a more businesslike model, using efficient structures, specialization, and standardized playbooks to target and exploit victims at scale, it added.
Behind the scenes, there is also a growing ecosystem of illicit service providers offering support with tools, techniques, and recruitment pipelines that resemble legitimate hiring processes.
“Some offer AI-as-a-service tools to automate outreach and engagement, while others sell phishing kits or provide access to breached data. These services lower the barrier to entry for fraud actors and enable them to replicate scams across geographies,” TRM Labs said.
Illicit volume up 146% from 2024
TRM Labs estimates that illicit crypto wallets received about $158 billion in value last year, a roughly 146% increase from 2024’s $64 billion, driven by increased sanctions against countries like Russia and technological advances in monitoring, revealing more activity.
Source: TRM Labs
However, despite the increase in illicit volume, its proportion of overall crypto volume fell in 2025, from 1.3% in 2024 to 1.2% in 2025.