Scams with on-chain links to AI vendors extracted $3.2 million per operation on average, against $719,000 for operations without those links, according to Chainalysis. That gap of roughly 4.5 times points to a structural change in how deception gets produced.
When fraud becomes cheaper to build and more productive at the same time, crypto wallet security models designed to catch a user's final mistake start losing on arithmetic.
Deception Now Scales With Compute
For most of crypto's history, a scam operation's output was capped by its staff. Someone had to write the scripts and build the fake sites and keep the conversations going until money moved. Generative AI lifted that cap. TRM Labs sums up the change in two sentences: "Human fraud scales linearly with headcount. AI-enabled fraud scales with compute." The firm observed a roughly 500% increase in AI-enabled scam activity over the past year and puts crypto scam volume at about $30 billion in 2025.
The supply chain shows the same shift. Chainalysis, citing Cisco Talos, describes phishing kits from a vendor called Lighthouse priced in crypto tiers of $50, $30 and $20, with some kits likely bought for under $500. Lighthouse took in more than 7,000 deposits worth over $1.5 million in three years, and scams built on such kits proved 688 times more effective in dollar terms than regular scams. The costly inputs of fraud have turned into commodities, so attack volume now depends far more on compute and distribution than on labor.
"AI is changing the economics of fraud," says Jimmy Su, Chief Security Officer at Binance. "Attackers can now create convincing scams faster, cheaper, and at a scale that simply wasn't possible before. That means security can't start when a user is about to click 'confirm.' By then, we're already too late. We have to disrupt the attack earlier: filter the malicious transfer, identify the dangerous address or contract, simulate the transaction, and surface risky approvals before they become losses."
That conclusion has cost logic behind it. A defense whose expense grows with every warning shown and every decision a user has to make will be outspent by an attacker whose next lure costs almost nothing. Automating the defensive side follows from the same math that drives automation on the offensive side.
The effects of that efficiency already show up on-chain. Chainalysis found the average scam payment rose from $782 in 2024 to $2,764 last year. This is a 253% increase that points to fewer and better-targeted as well as more lucrative attacks.
The Confirm Screen Is the Most Expensive Place to Defend
Consumer protection in crypto has long rested on two steps: educate users, then warn them when they're about to sign. That final checkpoint sits at the moment the attacker has finished the expensive work of persuasion and the victim is most committed to acting. At low volume, a warning that works most of the time is good enough. At the volume AI scams can generate, the number of people who click past it climbs even if the rate holds steady.
Throughput data shows how quickly that volume is building. Chainalysis discovered that AI-linked scam operations averaged 35.1 transfers per day, compared with 3.89 for others. AI scams also earned a median daily revenue of $4,838 versus $518. Immunefi counted a record 207 hack incidents in the first half of 2026. This is the highest incident count it has ever recorded.
Each of those figures measures frequency, the variable AI moves most. A model that depends on every user making the right call every time is exposed to the sheer number of attempts as much as to their quality. The FBI began tracking AI-related complaints in 2025 and recorded $893 million in adjusted losses across 22,364 complaints in its first year of data.
Interrupting the Attack Before the Signature
Moving defense upstream means screening incoming transfers before they appear in a wallet's history and checking addresses and contracts before a user touches them as well as simulating transactions before they're signed and reading behavior instead of waiting for a blacklist to update. Several firms now build this way. Chainalysis, for example, describes its Alterya product as scoring recipient-side risk to block scam-linked transfers in real time, while its Hexagate product runs checks before a transaction is signed.
Siphon tokens show why timing decides the outcome. These tokens carry contract backdoors that can move or zero out a holder's balance without any approval being signed, and Binance's wallet security team describes them as deployed from disposable wallets that stay live for an hour or two before vanishing.
An attack built to exist for two hours can only be stopped by a control that doesn't need a person to recognize it first, so Binance shifted to detecting risk intent from token behavior. The company reported that newly identified malicious entities nearly tripled quarter over quarter in the first half of 2026.
"In the first half of 2026, Binance Wallet Security Center helped users avoid an estimated $540 million in potential losses, while filtering 206 million spam transfers, detecting 4.93 million high-risk transactions and flagging 996,000 malicious approvals," Su says. "As attacks become faster and smarter, security has to move faster and earlier."
Pricing the Defense at Attacker Speed
If fraud now scales with compute, defense has to scale the same way. Getting there across the industry would take shared threat intelligence between platforms, since many scams begin on social media and messaging apps long before they reach a wallet.
It would also mean applying the same pre-signing checks to AI agents that are starting to hold wallet permissions of their own.
Platforms that build for attacker speed may increasingly set the baseline for what users expect—from crypto wallet security.