Criminal adoption of artificial intelligence (AI) has climbed 40% year-on-year in 2026, according to blockchain intelligence firm TRM Labs. Scams drove most of that growth.

TRM’s new AI-in-Crime Adoption Index scores overall adoption at 54 out of 100, up from about 28 in 2024. Scams are the only category rated Mature.

AI Now Runs the Whole Scam, From Target List to Victim Chat

The index rates four crime types on how common AI use is, how many stages of an operation it touches, and how advanced it is.

Scams top the ranking. TRM says AI now generates target lists and lures, powers deepfakes, and runs the victim conversations themselves.

The share of scam reports in which AI was part of the attack has grown by roughly 13 times since 2022. Among crypto scams with live domains, 17% advertise AI products.

Reported deepfake scam losses in 2026 already exceed the 2025 total by 263%. Narcotics sit at the opposite end. Darknet buyers warn each other away from markets they suspect were AI-generated.

Follow us on X to get the latest news as it happens

Hacks and Ransomware Climb the Attack Chain

Hacking and state-sponsored theft ranked one tier lower, at Emerging. The volume, however, tells a harsher story.

TRM logged 201 hacks in the first half of 2026, against 83 a year earlier. However, 4% of incidents produced 75% of the stolen value.

North Korea accounted for roughly $600 million, or 61% of the half-year total. Two April operations dominate that figure: the $285 million Drift Protocol breach and the $292 million KelpDAO exploit. Both started with social engineering rather than novel code. 

Ransomware sits one step further along. No-code ransomware kits now change hands for $400 to $1,200, TRM noted.

In July, Sysdig documented JadePuffer, which it calls the first fully agentic ransomware. An AI agent handled reconnaissance, credential theft, lateral movement, and encryption without human direction.

TRM’s broader finding is that AI touches every stage of the crime lifecycle. It lowers the barrier to entry, raises the scale and sophistication of attacks, and hands investigators both a harder problem and better tools.

The last part decides the trajectory. TRM says holding the current parity between offense and defense depends on enforcement and compliance tooling scaling at the same pace.

Subscribe to our YouTube channel to watch leaders and journalists provide expert insights

Source: BeInCrypto