Crypto crime is on the rise. From the first epic hack of mighty Mt. Gox to the intricate OneCoin scam orchestrated by nefarious Bulgarian fraudsters, underhanded dealings move in lockstep with digital assets. History has shown that wherever there is value, there is also an ill-intended bystander lurking in the shadows just waiting to snatch it. As the industry grows, so too does the problem, and it becomes increasingly elaborate and hard to ignore.
“We’re watching web3 bleed credibility in real time. A 67% rise in wallet drainer attacks tells you everything: crypto is still a playground for exploiters, not a foundation for mainstream finance. Mass adoption stalls when the average user has to be half-coder, half-paranoid detective just to move funds.”
“The rise in crypto scams doesn’t just affect existing users; it erodes trust and slows broader adoption. Potential newcomers, whether individuals or businesses, may hesitate to engage with crypto after seeing stories about phishing attacks, fake wallets, or impersonation schemes. And while adoption is growing, particularly as crypto gains traction as an alternative to traditional payment and remittance systems, concerns about scams continue to be a barrier.”
The number of so-called ‘pig butchering’ attacks, where the perpetrator ‘fattens up’ the victim before reaching in for the kill, is on the upward curve as well, with revenues increasing by almost 40% YoY from 2023 to 2024.
“It is clear that 2025 is well on track to have potentially twice as many physical attacks as the next highest year on record.”
Just as the experts become aware of one type of attack and implement best practices to safeguard users online, another one pops up, like a game of whack-a-mole, as attacks become increasingly sophisticated over time to prey on unsuspecting victims.
Many scams now leverage AI-generated content, deepfakes, and advanced phishing tactics to bypass detection and pull the wool over the eyes of even the savviest of users (and scare others away from self-custody altogether). Michal “Mehow” Pospieszalski, founder and CEO of MatterFi security infrastructure provider, warned in a comment:
“Scams don’t just slow down adoption, but more importantly, destroy trust. If a user can lose everything by clicking the wrong link or misreading a wallet string, no amount of yield or innovation matters. People don’t onboard into environments where the default assumption is: “Don’t mess up, or you lose it all.”
“In fraud, it’s a game of cat and mouse,” Edwards admits. “Right now, we’re in this swing toward the fraudsters, and I think it’ll get bad, but it always swings backward and forward.”
I’ve heard cybersecurity described in this way before, as the very objective of hackers is to disorient their victims with ever-more convincing and sophisticated techniques to remain one step ahead at all times. So, what are the most common types of attacks to be on the lookout for, and how can you protect yourself from them?
“There’s a Calendly one through Twitter that’s extremely well done. They send you the spoof Calendly link. You go to that link, you book a slot, and you then authenticate using Twitter. They then get access to your Twitter account and use that to send out messages to defraud people.”
A few best practices here include always visiting the official channels of a company, rigorously inspecting links, double-checking wallet addresses, and never clicking on links or attachments in emails.
Unsurprisingly, in an era of explosive AI growth, deepfake scams are on the rise as scammers incorporate AI-generated videos and voices to impersonate trusted figures or company executives.
Verified data, a solution cheqd is pioneering to create verifiable AI, can help solve this problem, as cryptographic signatures can prove when content was generated and how. Edwards explains:
“An example might be that you can create a video, or the content credential was generated straight off when you record a video using a phone. Samsung is thinking of building this into one of their flagship models, where every time you take a picture, it won’t just be the picture. It will have a cryptographic signature straight off the device, so you can prove that you generated this picture or this video and that it wasn’t AI-generated.”
Just as appealing as the name, scammers ruthlessly build personal relationships using social media or dating apps to gain trust before convincing victims to invest in fraudulent crypto projects or accounts. Once large sums are deposited, the proverbial thief in the night vanishes along with the crypto (and the victim’s will to live).
Edwards and his team offer one solution to limit the amount of personal data available in the stratosphere: reusable KYC, which enables users to verify their identity once and securely reuse that verification with multiple services, instead of repeating the KYC process for each one. This reduces the amount of information they share, prevents risky centralized “honeypots” of sensitive data, and combats fraud since only cryptographically signed, trusted credentials are used. He enthuses:
“I’d say that’s probably the biggest thing that we’re seeing is the start of reusable KYC. I think it’s going to accelerate really quickly.”
Ponzi schemes may be well over 100 years old, but hapless investors continue to fall into the honey trap as fraudulent crypto platforms promise guaranteed returns, pay early investors with money from new participants, and eventually implode, leaving most investors out of pocket.
If you’ve been in crypto for more than a minute, you’ll be familiar with unscrupulous rug pulls. Merciless developers or project founders tirelessly shill their new token, attract millions of dollars of investment, then suddenly remove all liquidity and exit stage left, leaving the audience feeling as if the rug has literally been pulled from under their feet. Edwards sighs:
“It really comes down to people not doing their due diligence and just aping into these things. You’ve got a lot of anonymous teams.”
He says that verified data may help investors to choose projects more wisely, as legitimate founding team members can use decentralized IDs to build up verified contributions to projects and positive, provable reputations.
Of the rising number of physical attacks on Bitcoiners documented by Lopp, there’s an emerging trend of more incidents being carried out by organized crime. Wrench attacks have occurred on known industry figures such as Ledger co-founder, David Balland, and Lopp himself, which propelled him to erase himself from the internet. But they also target so-called crypto influencers who flaunt their wealth on platforms like TikTok and Instagram.
One of the best ways to protect yourself from physical attacks (beyond elaborate schemes to make yourself disappear like a Bond villain) is to be discreet about your lifestyle. Never tell anyone how much BTC you hold, and please, don’t taunt your followers to have fun staying poor while you’re dripping in diamonds and a Rolex. Edwards remarks:
“Obviously, as your wealth increases, you need to start looking at personal security about this, but I think one of the bigger problems is some people, whether deliberate or just through ignorance, make it very visible what their wealth is, because all of it is on the ledger. As a result, you can know someone’s net worth in a way that you wouldn’t in traditional banking systems.”
“Currently, 2025 is 17.27% worse than 2022 at the end of June. If this trend continues, we could see 2025 end with more than $4.3 billion stolen from services alone.”
Yikes. And with the proliferation of AI agents, cybercrime will take on a life of its own, no longer reliant on a human mastermind behind it. Edwards explains:
“All of this [cybercrime] is currently largely being done by people, so there is someone somewhere who is going and doing this. Where it’s going to get really terrifying is where this can get outsourced to AI agents, and they can do it at mass scale. That’s where it’s going to get really scary, because you’re no longer limited by human capacity.”
“1. The Test of Time: To see which projects can deliver truly reliable and stable products, thereby building a trusted brand for security.
2. Learning from Incidents: To collectively learn from security breaches and iterate on product designs to patch exploitable flaws.
3. Gaining User Trust: For mature, secure solutions to gradually replace outdated ones and earn widespread user adoption.”
But with AI developing at the speed of a bullet, and cybercrime so rampantly up, do we have time for the test of time? Are the solutions to combat online crime being rolled out fast enough? Edwards reflects:
“Ideally, quick enough means that you’re getting the tech out before the fraudsters even really make hay with it. I think we’re only seeing that they’re making hay. It’s probably going to get worse. I think then there’ll be a swing back the other way, hopefully, but I don’t think it’s quick enough.”
Fortunately, all is not lost. You may be able to take your head out of the sand for a little while and venture out online after all. James Toledano, COO of self-custodial web3 wallet, Unity Wallet, pointed out that, while AI may exacerbate the problem, it can also be harnessed for good. He wrote:
“This isn’t a losing battle. It’s a moment to strengthen the foundation. Self-custodial wallets remain inherently secure; most breaches result from deception, not technical failure. The solution begins with education: if in doubt, don’t engage.
Just as AI is being leveraged by bad actors, it also holds enormous potential as a defense, enabling real-time scam detection, user behavior monitoring, and adaptive threat response to restore confidence and drive safe web3 adoption.”
Edwards agrees, commenting:
“The tech is there to solve this. The good thing is it’s not like we have this problem and we don’t know what to do about it.”
One example of a project leveraging AI to combat fraud and scams is Algebra Labs, that’s building a new decentralized exchange (DEX) governed completely by bots. Co-founder Vladimir Tikhimorov provided some details, saying:
“We expect that AI will change many things about the industry, including threat detection and mitigation. When security can be automated to react in real-time rather than post-alert, often when funds have been stolen, we believe the future of digital assets will migrate towards these types of platforms rather than the ones that continue to go it the way they traditionally have.”
As crypto adoption accelerates and the technology matures, the shadows of crime remain an unavoidable threat. Yet with a mix of vigilance, user education, smarter security practices, and evolving technology like AI, there’s still a fighting chance of avoiding an online apocalypse. The race between defenders and attackers may be a relentless cat-and-mouse chase, but just remember who wound up with the cream.
