TRM Labs, a blockchain intelligence firm, said in its 2026 AI-in-Crime Adoption Index that AI is moving deeper into the attack process, helping criminals analyze smart contracts, identify known vulnerability patterns and even adapt previously disclosed exploits to new targets.
- But that doesn't mean AI is independently finding the sophisticated exploit chains behind crypto's largest thefts.
- As TRM Labs said, it hasn't seen evidence of that yet, with AI instead making more routine vulnerability research and exploit development faster and accessible to less-skilled attackers.
- And once funds are stolen, the picture looks considerably more familiar.
The San Francisco-headquartered blockchain intel firm, backed by Goldman Sachs and others, said the laundering of stolen crypto has changed far less than the compromises themselves.
TRM Labs
AI deepfakes as plan B for asset recovery
In ransomware specifically, the firm said it hasn't yet observed AI being used in the on-chain laundering stage at all. The firm suggested there may simply be little need for it because moving funds through instant swaps, bridges and mixing services is already highly automated.
Instead, AI appears to become useful again when criminals need to turn those assets into money they can actually use.
TRM Labs described identity verification at crypto on- and off-ramps as a key bottleneck, with criminals using AI-generated documents, deepfakes and liveness-bypass tools to open exchange accounts or regain access when funds are frozen.
TRM Labs recorded 201 hacks in the first half of 2026, more than double the 83 incidents recorded a year earlier.
Still, losses were heavily concentrated as roughly 75% of stolen funds came from just 4% of attacks, with the largest losses continuing to stem from compromising people rather than breaking cryptography.