Crypto phishing is a growing threat: Kaspersky reported an 83.4% rise in crypto-related phishing detections from 2023 to 2024.

These scams trick users into disclosing private keys, wallet details or account credentials, or into approving transactions that can drain their funds.

Common tactics include convincing emails that lead to cloned websites, social-media messages impersonating exchanges or traders, malicious links or files that install malware, and calls seeking sensitive information or remote access.

Often, an urgent account-security warning directs a victim to a fake support site or prompts approval of a malicious wallet transaction; because blockchain transfers are generally irreversible, stolen assets can be difficult to recover.

AI is making fraud more convincing through personalized phishing, synthetic identities, voice imitation and deepfake endorsements, while social engineering exploits trust to obtain credentials or trigger transfers.

Chainalysis estimated that crypto scams generated up to USD 17 billion in 2025; impersonation scams rose more than 1,400% year over year, and operations with identified AI involvement generated 4.5 times the revenue of those without it.

The average scam payment climbed to USD 2,764 in 2025 from USD 782 in 2024, underscoring how profitable it can be to manipulate victims into authorizing transfers without breaking blockchain protocols.

On November 4, India’s CERT-In warned that an AI-assisted campaign called CRAFTY FALCON was targeting financial institutions, including cryptocurrency services, with stolen wallet keys, unauthorized transfers and automated exploitation of payment systems.

CertiK reported USD 1.31 billion in losses across 344 Web3 incidents in the first half of 2026, including about USD 444.5 million from wallet compromises and USD 366.3 million from phishing.

Although phishing incidents fell 52.3% from the first half of the previous year, losses declined only 10.8%; four attacks accounted for about 85% of phishing losses, highlighting the outsized damage targeted attacks can cause.

To avoid fake sites, check domain spelling and inspect URLs carefully; HTTPS and a padlock are not substitutes for verifying the domain.

Verify support requests independently, never share seed phrases, inspect wallet permissions before signing, and use hardware wallets, phishing-resistant authentication and transaction limits.