The cryptocurrency ecosystem faced its most devastating year for scam-related losses in 2025, with Chainalysis estimating a record $17 billion stolen through fraudulent schemes. Published on January 13, 2026, the firm’s annual Crypto Crime Report reveals a threat landscape that has fundamentally transformed from opportunistic phishing to industrialized, AI-enabled fraud operations.
At least $14 billion in on-chain scam inflows were tracked during 2025, a significant increase from the $9.9 billion initially reported for 2024. Chainalysis projects this figure could exceed $17 billion as investigators identify additional illicit wallet addresses in the coming months. The average payment per scam jumped from $782 in 2024 to $2,764 in 2025 — a staggering 253% year-over-year increase that reflects both the sophistication of attacks and the growing wealth of crypto users. Bitcoin traded at approximately $95,300 as the report was released, underscoring the magnitude of assets at risk.
The Exploit Mechanics
The most alarming trend documented in the report is the explosive growth of impersonation scams, which surged more than 1,400% compared to 2024. These scams leverage the inherent trust people place in official communications, with fraudsters posing as government agencies, financial institutions, and cryptocurrency platforms.
The report highlights the E-ZPass phishing campaign as a case study in industrialized fraud. Attributed to a Chinese-speaking cybercriminal group known as “Darcula” or the “Smishing Triad,” the operation distributed SMS messages impersonating toll collection agencies across at least eight U.S. states. The group used phishing-as-a-service tools from a vendor called “Lighthouse,” which offered hundreds of templates for fake websites at staggeringly low prices — some phishing kits were available for as little as $50 in cryptocurrency.
AI-enabled scams proved particularly devastating, generating 4.5 times more revenue per operation than traditional fraud. Scammers deployed AI-generated deepfakes, automated social engineering scripts, and machine learning algorithms to identify high-value targets. The convergence of multiple scam types — pig butchering, high-yield investment programs, and impersonation — created a force multiplier effect that made individual attacks harder to detect and resist.
Affected Systems
The attack surface has expanded far beyond individual wallet users. The report documents strong connections to East and Southeast Asian crime networks, particularly through forced labor compounds in Cambodia and Myanmar, where trafficking victims are coerced into operating scam centers. These operations function as industrial-scale fraud factories with professional infrastructure including dedicated money laundering networks, phishing kit development teams, and customer service operations designed to build trust with victims.
Cryptocurrency infrastructure itself serves as both the attack vector and the enabler. Lighthouse, the phishing-as-a-service vendor, received over 7,000 cryptocurrency deposits totaling more than $1.5 million across three years. The E-ZPass scheme alone amassed approximately $1 billion over three years, duping over one million people across 121 countries through 330,000 fraudulent text messages in a single day during peak operations.
Chinese-language money laundering networks processed illicit proceeds through stablecoin conversions, with services like “Black U” facilitating the laundering of stolen U.S.-denominated stablecoins. These networks connect cybercriminal groups like Taihe Gong to distribution channels for phishing kits and credential theft tools.
The Mitigation Strategy
Chainalysis notes that law enforcement agencies achieved record-breaking seizures in 2025, demonstrating improved capability to combat crypto fraud. A 61,000 bitcoin recovery in the United Kingdom and a $15 billion seizure linked to the Prince Group criminal organization represent significant milestones in the fight against cryptocurrency crime.
However, the report emphasizes that reactive measures alone are insufficient against threats that evolve at machine speed. The 253% increase in average scam payment size indicates that fraudsters are becoming more effective at extracting larger sums from individual victims, likely through AI-optimized targeting and the use of deepfake technology to impersonate trusted figures.
Industry-wide recommendations include implementing real-time transaction monitoring systems, deploying AI-powered fraud detection tools that can match the sophistication of AI-powered scams, and establishing cross-chain analytics capabilities to track laundered funds across multiple blockchains. Ethereum, trading near $3,322 at the time of the report, remains the primary network for scam-related smart contract interactions.
Lessons Learned
The 2025 data reveals several critical shifts in the crypto threat landscape that demand attention. First, the line between traditional cybercrime and crypto fraud has blurred almost completely. The E-ZPass campaign demonstrates that cryptocurrency is now embedded in broader criminal operations that target everyday consumers, not just crypto enthusiasts.
Second, the industrialization of scam infrastructure means that low-cost attack tools are available to a wider range of threat actors. A phishing kit purchased for $50 can generate millions in stolen funds when deployed at scale. Third, AI has become a force multiplier for both attackers and defenders, but the attackers currently hold the initiative.
The report warns that traditional scam categorizations are becoming less relevant as fraudsters blend multiple tactics into single operations. Pig butchering schemes now incorporate elements of impersonation, social engineering, and wallet-focused technical scams, making them harder to classify and combat through single-track countermeasures.
User Action Required
Cryptocurrency users should immediately adopt several defensive measures in response to these findings. Enable hardware two-factor authentication on all exchange accounts and avoid SMS-based 2FA, which is vulnerable to SIM-swapping attacks. Verify all communications purporting to be from cryptocurrency platforms by navigating directly to official websites rather than clicking links in emails or text messages.
Be particularly wary of unsolicited investment opportunities, especially those promoted through social media or messaging apps. The 1,400% growth in impersonation scams means that even communications appearing to come from legitimate sources should be treated with skepticism. Use dedicated email addresses for cryptocurrency accounts and consider using a password manager to generate and store unique credentials for each platform.
Monitor wallet activity regularly and set up transaction alerts for any movement of funds. Report suspected scams to the relevant cryptocurrency exchange and to law enforcement agencies. The improving seizure statistics show that reports do lead to recoveries, even if the process takes time.
Disclaimer: This article is for informational purposes only and does not constitute financial or security advice. Always conduct your own research and consult with qualified professionals before making security decisions regarding cryptocurrency holdings.
1400% surge in impersonation scams is wild. the deepfake stuff is getting scary good too, saw a fake Saylor video last week that looked legit
the saylor deepfakes are just the beginning. wait until ai can clone voices in real time for phone scams. the $17B figure will look small
the avg payment jumping from $782 to $2,764 is the part that worries me. people are losing more per incident now
ai made scamming scaleable. used to be one guy in a basement now its a whole factory
$2764 avg loss means these arent just beginners getting hit. experienced users are falling for sophisticated attacks too
14 billion on-chain tracked and they think it could hit 17. These numbers keep climbing every time they re-estimate.
$17B and yet regulators still chase the honest builders. Make it make sense.
253% jump in average payment per scam in one year. ai didnt just make scams more frequent, it made each one way more effective