AI-Powered Crypto Phishing Infrastructure 2026
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·eRAt9A…bqbQSummary
A broad, industrialized criminal ecosystem has emerged in 2025–2026 in which threat actors use generative AI tools — including large language models, deepfake video engines, and voice-cloning services — to produce and operate crypto phishing infrastructure at unprecedented scale. Chainalysis documented $17 billion in crypto scam losses in 2025, with AI-enabled operations generating 4.5 times more revenue per campaign than traditional methods. Law enforcement agencies across the US, UK, and Canada have begun coordinated enforcement actions, but the pace of tool proliferation continues to outpace disruption.
Connected Entities
8 entities · 60 linked investigations- Ethereum→mentioned with→Coinbase(60%)
- wallet drainers→mentioned with→Ethereum(70%)
- AI-Powered Crypto Phishing Infrastructure 2026→mentioned with→Trezor(65%)
- AI-Powered Crypto Phishing Infrastructure 2026→mentioned with→Bitget(65%)
- AI-Powered Crypto Phishing Infrastructure 2026→mentioned with→Binance(65%)
- AI-Powered Crypto Phishing Infrastructure 2026→mentioned with→Coinbase(65%)
- AI-Powered Crypto Phishing Infrastructure 2026→mentioned with→Ethereum(60%)
- Binance→mentioned with→Ethereum(65%)
- Trezor→mentioned with→Ethereum(60%)
- Inferno Drainer→mentioned with→Ethereum(70%)
- + 5 more
Timeline(15 events)
22 July 2023
FraudGPT first documented circulating on dark web and Telegram channels, advertising crypto phishing page generation among its capabilities at $200/month.
Asia Times / IronScalesJune 2024
YouTube livestream featuring an Elon Musk deepfake promoting a crypto giveaway scam draws approximately 30,000 concurrent viewers; face and voice were AI-generated.
EngadgetJuly 2024
Netcraft documents a 5.2x month-over-month increase in websites with AI-generated text used for phishing, concentrated in July 2024; crypto brands are a primary target.
NetcraftSeptember 2024
Netcraft publishes research on over 17,000 AI-written GitBook phishing lure sites targeting more than 30 crypto brands including Coinbase, MetaMask, and Trezor, traced over a one-year tracking window.
NetcraftDecember 2024
GhostGPT identified by Abnormal Security researchers operating through Telegram, providing jailbroken LLM access to criminals with no technical setup required.
Infosecurity Magazine14 January 2025
Chainalysis publishes its 2026 Crypto Crime Report, reporting $17 billion in crypto scam losses in 2025, 1,400%+ growth in impersonation scams, and 4.5x revenue premium for AI-enabled operations.
CoinDesk / ChainalysisJuly 2025
Ripple CTO publicly debunks AI-generated video falsely depicting CEO Brad Garlinghouse endorsing an XRP reward scheme, illustrating executive deepfake targeting of crypto executives.
CloudSEKFebruary 2026
OpenAI identifies and disrupts 'Operation Date Bait,' a Cambodia-based romance and task scam targeting Indonesian men in which ChatGPT was used to generate advertising, brand imagery, and fake personas.
OpenAI26 February 2026
OpenAI publishes its February 2026 threat intelligence update documenting fraudster integration of ChatGPT into global scam campaigns.
Help Net Security12 March 2026
OFAC sanctions six individuals and two entities tied to North Korean IT-worker fraud scheme, which used AI tools and deepfake personas to infiltrate US companies, funneling approximately $800 million to North Korea in 2024.
TRM Labs28 March 2026
Operation Atlantic concludes: US Secret Service, UK NCA, Ontario Provincial Police, and Ontario Securities Commission freeze $12 million in crypto, flag 20,000+ wallet addresses, and shut 120 scam domains in a one-week multinational approval phishing enforcement action.
US Secret Service9 April 2026
US Secret Service announces Operation Atlantic results publicly, calling it the first coordinated multinational enforcement action specifically targeting approval phishing.
The Block23 April 2026
OFAC designates 29 individuals and entities tied to Cambodia's cyber-fraud and human-trafficking scam compound economy, targeting infrastructure used in AI-assisted pig butchering operations.
TRM Labs28 April 2026
FEMITBOT campaign comes to public attention; large-scale Telegram Mini App fraud network impersonating Binance, Bitget, NVIDIA, Netflix, and BBC with fake crypto dashboards and AI chatbot support.
HackRead / Dataconomy31 July 2026
OpenAI publishes major report confirming shutdown of a larger Cambodia-based criminal network using ChatGPT for romance fraud, fake crypto investment platforms, illegal gambling, and law enforcement impersonation.
OpenAI / GBHackersDecision Log
- hash: 3AxgDAMHeXRrCvij5MorcPABBofoSzMhLNsKc4V5a6hj
- hash: JA4t9kxWWMUCeWM1RmeDqbLESugLELPKRYFWnJJ6W1d8
- hash: 6vHYscaumaiuk4vSmNBzbADVZHrJLeAxotQHrbEDbGvn
- hash: 1FdvLYW3Z6rfUVvvz3xrSwwUP3NXKJNzdkpULmcHb2h
This investigation is cryptographically anchored to the Solana blockchain (4 events). 23 of 26 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 8/15/2026, 12:16:28 PM
last updated: 8/25/2026, 7:13:55 AM
5 viewsavoid.net — verified advice for a post-truth world