AI-Powered Crypto Phishing Changes the Economics of Attacks

AI has altered the unit economics of crypto phishing. Attackers can now produce convincing lures at near-zero marginal cost, personalize them at scale, and convert more targets. The clearest signals are rising average payments, explosive growth in impersonation scams, and the tight coupling of AI with phishing-as-a-service kits.

Chainalysis estimates at least $14 billion flowed to on-chain scam addresses in 2025 and projects total scam and fraud losses could reach $17 billion. The average scam payment jumped 253% year over year from $782 in 2024 to $2,764 in 2025. Impersonation scams grew about 1,400% year over year, and Chainalysis found AI-enabled scams were roughly 4.5 times more profitable than traditional scams (Chainalysis).

Broader cybercrime telemetry points the same way. The FBI’s IC3 recorded 1,008,597 total complaints in 2025 and flagged 181,565 cryptocurrency-related complaints with reported losses of $11.366 billion. It also tracked AI-related complaints for the first time, logging 22,364 complaints and $893.346 million in reported losses (FBI IC3 2025 Annual Report). On the distribution side, Barracuda’s analysis of more than 3.1 billion emails found one in three email messages were malicious or unwanted, 48% of malicious email was phishing, and 90% of high-volume phishing campaigns used phishing-as-a-service. Barracuda reports adversaries are pairing AI-driven social engineering with PhaaS to scale targeted credential harvesting (Barracuda).

These datapoints do not prove every crypto scam now relies on AI, nor that attackers face no friction. Law enforcement and compliance controls have scaled at the same time, complicating the picture. But taken together, the evidence supports a shift in the cost curve and payout profile for crypto phishing.

How AI and PhaaS changed the cost curve

The material change is the combination of content-generation AI with turnkey delivery infrastructure. Language and image models reduce the time and skill needed to write targeted copy, build fake support chats, and fabricate identity documents. PhaaS kits provide distribution, hosting, templates, and credential-stealing logic that historically required bespoke effort.

Barracuda’s telemetry shows that PhaaS underpins 90% of high-volume phishing campaigns and that adversaries are now layering AI social engineering on top of those kits (Barracuda). Cisco Talos’ investigation into the Lighthouse smishing and phishing ecosystem illustrates how low the barrier is, documenting pricing tiers in threat channels where kits and features sell for roughly $20 to $50, with similar subscription and upgrade pricing. That supports Chainalysis’ conclusion that inexpensive kits enable high-volume operations (Cisco Talos; Chainalysis).

On the persuasion side, Elliptic’s Delphi study catalogs 16 AI-enabled crypto-crime trends, including deepfakes, AI chatbots for romance and investment scams, automated scam-site generation, and AI identity generators. Practitioners caution that deepfake and video scams still show identifiable red flags that limit success today, yet they expect rapid improvement. The study emphasizes AI-powered detection, stronger KYC, and platform controls as priority defenses (Elliptic).

What the strongest data say

Several recent datasets quantify how profitability and reach have shifted. The picture below blends crypto-native flows, complaint volumes, email telemetry, and kit economics.

Metric
2025 result or finding
Source

On-chain inflows to scam addresses
At least $14 billion
Chainalysis

Projected total scam/fraud losses
Could reach $17 billion
Chainalysis

Average scam payment
$782 in 2024 to $2,764 in 2025, up 253%
Chainalysis

Impersonation scams
~1,400% year-over-year growth
Chainalysis

Profitability of AI-enabled scams
~4.5× higher than traditional scams
Chainalysis

Crypto-related complaints
181,565 complaints; $11.366B in reported losses
FBI IC3

AI-related complaints
22,364 complaints; $893.346M in reported losses
FBI IC3

Malicious/unwanted email share
1 in 3 messages
Barracuda

Malicious email that is phishing
48%
Barracuda

High-volume phishing using PhaaS
90%
Barracuda

PhaaS kit pricing
~$20–$50 per kit/feature tier
Cisco Talos

Crypto assets seized/frozen
~$34B as of year-end 2025
Chainalysis

Losses prevented by enforcement initiative
Operation Level Up reduced potential losses by more than $500M
FBI IC3

Verified data shows two things at once. First, the revenue side for attackers looks better: larger average payments and much higher profitability for AI-assisted operations. Second, the fixed and variable costs of distribution have come down through kits and automation. The inference is straightforward. When both conversion and scale improve, the marginal campaign becomes worth running. That helps explain the surge in impersonation campaigns and the persistence of credential theft pipelines.

Implications for platforms and users

For wallets, exchanges, and consumer apps, AI-augmented phishing shifts exposure from sporadic mass blasts to continuous, targeted pressure. Barracuda’s finding that 90% of high-volume phishing runs on PhaaS suggests crypto brands will face near-instant cloning of customer communications. Elliptic’s catalog of AI chatbot scams and automated site generators points to faster setup and localization, which narrows the window for takedowns (Barracuda; Elliptic).

Inference: customer acquisition and support channels become risk surfaces as much as marketing assets. Default controls will matter more than optional settings. Platform-side content verification, transaction simulation, withdrawal risk scoring, and AI-powered detection align with the defenses Elliptic prioritizes. Stronger KYC and platform controls can also raise the cost of cashing out, which can offset some of the attacker’s economic advantage, although it will not remove the initial social engineering risk (Elliptic).

For users, the rise in average payment size documented by Chainalysis means individual incidents carry heavier downside even if overall prevalence is uneven across regions or user cohorts. Opinion: education that once relied on spotting broken English or crude visuals will be less effective as models improve, which shifts emphasis to process safeguards such as verified support channels and out-of-band confirmations for high-risk actions.

Policy and enforcement consequences

Policy debates will increasingly center on two levers: platform accountability and rapid asset freezing. Chainalysis reports that it helped partners seize or freeze roughly $34 billion in crypto assets as of year-end 2025, a sign that public-private coordination can claw back value at scale (Chainalysis). The FBI highlights initiatives such as Operation Level Up that reduced potential losses by more than $500 million, indicating that fast response and coordination change outcomes even as attacks proliferate (FBI IC3).

Inference: regulators may push for broader adoption of AI-powered monitoring, stronger KYC, and platform controls that Elliptic practitioners prioritize. That could tighten exit ramps and shorten time-to-freeze for compromised funds. A likely side effect is more scrutiny of communications security, brand impersonation takedowns, and data-sharing frameworks between email providers, domain registrars, and crypto platforms.

Why AI is not the whole story

There are credible constraints and alternative explanations. Verified: deepfake and video scams still show identifiable red flags, which limits their current hit rate according to practitioners (Elliptic). Verified: enforcement and compliance activity have scaled, yielding asset seizures and loss prevention that contradict any narrative that AI made scams risk-free (Chainalysis; FBI IC3).

Inference: increases in losses or complaints can reflect multiple forces, including broader adoption, better reporting, and shifts in target demographics, not solely model performance. Opinion: the most durable AI advantage for attackers today is not cinematic deepfakes but cheaper, better-written social engineering at scale. That still matters. It raises conversion just enough, across many more touches, to change the margin math on campaigns powered by very low-cost PhaaS kits.

What to watch next

Several concrete indicators will confirm or weaken the thesis that AI has structurally improved phishing economics in crypto:

• Updates from Chainalysis on average scam payment size, impersonation scam growth, and the relative profitability of AI-enabled scams in upcoming crime reports.
• FBI IC3’s next annual breakdown of cryptocurrency-related and AI-related complaints and reported losses, including any shift in the ratio between the two.
• Email telemetry from firms like Barracuda on the share of malicious email that is phishing and the proportion of high-volume campaigns using PhaaS.
• Threat intelligence on PhaaS kit pricing and feature tiers similar to Cisco Talos’ Lighthouse analysis, which indicates whether attacker costs are falling further.
• Law enforcement and analytics disclosures on crypto asset seizures and time-to-freeze, plus initiatives comparable to Operation Level Up.
• Vendor and practitioner reporting, such as Elliptic’s studies, on the quality of AI-generated lures and the effectiveness of AI-powered detection, KYC, and platform controls.

Editorial conclusion: Verified data shows larger payments, more impersonation, and higher profitability for AI-assisted scams alongside cheap delivery via PhaaS. Enforcement and platform defenses are improving, which keeps the outcome uncertain. The balance to watch is whether attacker conversion and scale keep outpacing the speed and reach of detection, freezing, and user safeguards.

Disclaimer: This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.