Cryptocurrency scams surge – AI phishing losses hit $893 M

A recent FBI report shows cryptocurrency crime now tops all internet fraud at $7.2 billion, driven by a spike in AI‑powered phishing scams that alone have generated $893 million in losses【1】. The scale of the threat forces users to rethink basic security habits.

How the scams work

Phishing attacks target wallet credentials, seed phrases, or transaction approvals. Fraudsters often disguise fake airdrop or token‑claim pages as legitimate services; once a user links a wallet and signs a transaction, the attacker can drain the account instantly【1】. Fake sites copy the look of popular exchanges, tweaking domains with misspellings, extra hyphens, or unusual extensions to lure victims【1】. A newer variant—address poisoning—sends tiny transactions from look‑alike addresses, hoping users copy the wrong address from their history and send funds to the attacker【1】.

Why users are vulnerable

Most losses stem from operational mistakes rather than blockchain flaws. Weak passwords, reused credentials, and poor seed‑phrase storage enable credential‑stuffing and SIM‑swap attacks【2】. Token approvals, a convenience feature in DeFi, can be abused when a malicious contract is signed; the approval remains active until manually revoked, allowing funds to be siphoned months later【2】. Because blockchain transactions are irreversible, a single erroneous signature can expose the entire wallet.

Scale of the problem

The FBI data cited by the Wall Street Journal identifies crypto crime as the costliest internet fraud, with $7.2 billion in losses overall【1】. AI‑driven scams alone have produced 22,000 complaints and nearly $893 million in losses【1】. A 2025 study estimates 270 million address‑poisoning attempts affecting 17 million victims, resulting in at least $83.8 million in losses【1】. These figures underscore that the primary attack vector is human error, not blockchain vulnerability.

What to watch

• Credential hygiene – monitor for any reuse of passwords across exchange and wallet accounts.
• Token approvals – regularly review and revoke unused or unlimited approvals in wallet permission screens.
• Address verification – be alert for small, unfamiliar transactions that could indicate address‑poisoning attempts.

The surge in AI‑enabled phishing and address‑poisoning attacks shows that the weakest link remains the individual user. As scammers refine their tactics, the onus is on investors to adopt layered security practices and treat every wallet interaction as a potential entry point for theft.