Press play to start listening
Picture a composite case drawn from documented scams where a tech professional spends forty minutes on a video call with a “compliance officer” whose face and voice were generated by software.
The scenario is a composite, but each technique in it is real.
Chainalysis found impersonation scams grew more than 1,400% in 2025 while the average payment to impersonation clusters rose more than 600%. Nothing about the person was the weakness. Everything about the moment was.
Why Knowing Better Doesn’t Stop the Transfer
Social engineering targets states of mind. Urgency and fear of loss as well as deference to authority and the wish to fix a problem quickly all narrow judgment, and technical knowledge cures none of them. Crypto wallet security that assumes informed users will spot the trap is working from an outdated premise. Someone who knows how real support processes run can even find a well-made fake more convincing.
The case record bears that out. Chainalysis describes a scheme in which callers posing as Coinbase customer support defrauded victims of nearly $16 million; they sounded credible because customer data had been obtained through a bribed insider, a breach that exposed nearly 70,000 customers. In the UK, one holder lost nearly $2.5 million in 2025 to a scheme that local police said exploited “fear” and “panic.”
“AI is changing the economics of fraud,” says Jimmy Su, Chief Security Officer at Binance. “Attackers can now create convincing scams faster, cheaper, and at a scale that simply wasn’t possible before. That means security can’t start when a user is about to click ‘confirm.’ By then, we’re already too late.”
Cheaper production means a sophisticated target now meets a lure built specifically for them. Any defense that depends on the target noticing the deception has to assume it will sometimes fail.
The national numbers show the scale. The FBI’s Internet Crime Complaint Center recorded $7.2 billion in crypto investment fraud losses across 61,559 complaints in 2025, and Americans over 60 reported $4.4 billion in crypto-related losses.
The Attack Families Running at Scale
Three families dominate here. The first one is the impersonation of exchanges and officials as well as executives. And then come romance-investment hybrids that groom a target for weeks before introducing a fake trading platform. Finally, fake-support takeovers fall into the third category here, attackers talk users into moving funds to a “secure” wallet.
Chainalysis reports that scam operations buy face-swap software and deepfake tools and large language models from vendors and that the categories increasingly blend into one another. Modular tooling also lets technically unsophisticated groups run campaigns that once required specialist skills.
Hardware doesn’t settle the matter either. Hacken’s first-quarter 2026 data attributed $306 million in losses to phishing and social engineering, including a single $282 million hardware-wallet scam in January. Keeping keys offline didn’t help once the holder was persuaded to act.
Lior Aizik, co-founder and Chief Operating Officer at XBO, has been impersonated by name himself. “These attacks rely on urgency and trust, not technology,” he told CoinDesk. Fewer attempts with larger payoffs is what targeting looks like once deception becomes cheap to personalize. And the phishing data reflects it. CertiK counted 63 phishing incidents in the first half of 2026 down 52.3% YoY. But despite that, losses fell only 10.8% to $366.3 million and four incidents accounted for about 85% of the total.
Where Automated Controls Catch What Persuasion Wins
A scam can win the conversation but the persuaded user still has to move funds through a wallet. The transfer passes through screening, the destination contract through simulation and the approval request through analysis, and none of those checkpoints depend on the user’s state of mind.
“We have to disrupt the attack earlier,” Su says, listing the sequence: “filter the malicious transfer, identify the dangerous address or contract, simulate the transaction, and surface risky approvals before they become losses.”
Binance reports its Wallet Security Center identified around 4.93 million high-risk transactions across 19 chains in the first half of 2026. Some were blocked automatically; others were abandoned after users saw a risk alert.
The company doesn’t break out how many followed a social engineering contact, so the data can’t answer that. What it does show is that an alert gives a persuaded user a second chance to stop, while an automatic block doesn’t need one.
Binance’s own post acknowledges that no security tool can protect a decision a user insists on making, which is why these controls work as a backstop. Over the same six months, Binance’s wallet systems also flagged around 996,000 malicious approvals, the kind of standing permission attackers use to drain a wallet after the conversation ends.
Verify Out of Band, Every Time
Human skepticism remains necessary, and on its own it’s no longer enough. Platform controls act as the seatbelt for the moment persuasion wins, and one user habit still matters on top of them.
Before acting on any request to move funds or change a wallet address, verify it independently through an official channel you already trust. Don’t use contact details or links supplied by the person making the request. Urgency calls for more scrutiny, and a well-built AI scam will always supply plenty of it.
