How Law Enforcement Uses AI to Fight AI-Enabled Crypto Crime
AI-enabled crypto crime is no longer a niche concern for specialist fraud units. The FBI's Internet Crime Complaint Center recorded 22,364 complaints and nearly USD 893 million in losses tied to AI in its first year tracking the category, out of nearly USD 21 billion in total reported losses. Law enforcement's response has been to meet the threat with the same technology: agencies in the US, UK, and beyond are now using AI to do in minutes what previously took investigative teams weeks. For accounting firms, auditors, and CFOs with digital asset exposure, understanding how that investigative capability works, and what it can see, is as important as understanding the crimes themselves.
What AI-Enabled Crime Actually Looks Like in 2026
AI-enabled crime covers any criminal activity in which artificial intelligence is used to plan, execute, scale, or conceal the offense. The spectrum runs from a scammer using a chatbot to generate more convincing phishing messages, all the way to full criminal services built around AI infrastructure.
The maturity index and what it signals
TRM Labs tracks adoption through what it calls a criminal AI maturity index, which scored 28 in 2024 and rose to 54 by 2026. Scams and fraud reached the "Mature" category, meaning AI is present across the entire operation: targeting victims, running conversations at scale, generating synthetic identities, and laundering proceeds. No other crime category scored as high.
The deepfake-scam data reinforces this. Reported losses from deepfake scams in the first part of 2026 already exceeded all of 2025 by 263%, according to figures cited in TRM's research.
A case study: EvilTokens
In September 2026, Microsoft's Digital Crimes Unit led a coalition that dismantled EvilTokens, a subscription cybercrime service launched earlier that year. For a USD 1,500 setup fee and USD 500 per month, buyers received an AI chatbot that read compromised inboxes, identified vendor invoices and payment approvals, and flagged the individuals best positioned to move money. The service was linked to more than 12,000 compromised inboxes across more than 10,000 organisations. The takedown combined civil litigation, infrastructure removal, financial tracing, and arrests, illustrating that the most effective enforcement actions target the enabling services, not just individual operators.
Crypto-specific schemes
TRM also documented a scheme in which AI-generated tutorials walked viewers through building what was presented as a "crypto trading bot." The tutorials led victims to deploy drainer contracts themselves, effectively weaponising the victims' own actions. Between February and August 2026, the operation drained 274.60 ETH from 224 victims. The pattern is significant because the criminal infrastructure, the synthetic media and the on-chain mechanics, spanned multiple layers simultaneously. A deepfake investment scam can involve a cloned voice, a rented phishing kit, Telegram channel coordination, funds routed through a shell company, and a stablecoin cash-out, all as part of a single operation.
How Investigators Are Deploying AI
The agencies achieving results are not relying on a single tool. They are applying AI across several distinct functions, with the biggest gains coming from connecting data sources that previously required separate, manual searches.
Evidence triage and document review
Modern investigations generate enormous volumes of phone extractions, video recordings, chat logs, and documents in multiple languages. AI tools transcribe, translate, summarise, and flag relevant material, allowing investigators to start with what matters rather than working through everything sequentially. In the UK, government-cited early trials included reviewing 800 hours of footage from a kidnapping case in three hours. Tools in this category are among the most widely adopted precisely because they accelerate work without substituting machine judgment for human judgment.
Identity resolution across data sources
AI-enabled criminals spread their footprint across usernames, email addresses, phone numbers, wallets, and corporate registrations. Entity resolution uses AI to recognise when scattered identifiers belong to the same person or network. An investigator who starts with a single wallet address or online handle can surface that identifier's links to social accounts, dark web forum activity, corporate filings, and on-chain activity in a single session, rather than running separate searches across multiple systems. For firms managing client due diligence, this is a direct signal: the same entity resolution capability that helps investigators can surface inconsistencies in KYC data that human reviewers might miss.
Case linkage across jurisdictions
AI-enabled scams are industrial operations. The same operators reuse scripts, infrastructure, and payment addresses across thousands of victims in multiple jurisdictions. AI helps cluster victim reports and surface shared identifiers, meaning a local fraud complaint can be connected algorithmically to a larger network operating internationally. Structured scam-reporting platforms give investigators the data to work from, and AI makes the linkage tractable at scale.
Financial tracing and fund recovery
Most AI-enabled crime is financially motivated, and the money has to move. AI compresses tasks like wallet clustering from days to minutes and allows investigators to query transaction data in plain language. Blockchain analytics tools trace funds across chains to exchanges, over-the-counter desks, and other cash-out points where assets can be frozen or seized. This capability is directly relevant to firms using crypto bookkeeping software or digital asset accounting software: the same transaction trails that appear in your ledgers are visible to investigators, and the quality of your documentation determines how quickly you can demonstrate clean provenance if your counterparties come under scrutiny.
Synthetic media detection
AI detection tools analyse images, video, and audio for signs of manipulation, and help financial institutions identify synthetic identities at the onboarding stage. TRM's research notes that detection accuracy drops significantly on real-world fakes, so the most effective investigative approach follows evidence that criminals cannot fake: payment trails and reused infrastructure. Detection tools are one layer of the response, not the whole answer.
Report drafting and OSINT
Generative AI is being used to draft police reports from body-camera audio and notes, though agencies reviewing these tools are clear that officers must review and take ownership of the final document. Open-source intelligence tools and dark web monitoring help investigators attribute online personas and spot emerging threats, feeding into the broader intelligence picture before a criminal operation reaches financial scale.
The Defensibility Requirement
AI-enabled crime rarely leaves its evidence in one place. Connecting that evidence across sources, and doing so in a way that holds up in court, is the central challenge. Agencies getting results apply what the intelligence community calls an all-source approach: combining on-chain data, open-source intelligence, corporate records, sanctions lists, device extractions, and communications into a single evidential picture, with no single source treated as conclusive and conflicts between sources treated as findings in their own right.
What courts require
Every step must be documented with enough clarity to support cross-examination. That means documented provenance for each data source, a repeatable methodology, and a human investigator exercising judgment at every material decision point. AI tools that produce outputs without auditable reasoning are difficult to rely on in adversarial proceedings. This requirement shapes which tools agencies actually deploy versus which they test and set aside.
The FBI's Operation Level Up illustrates a preventive application of the same principle. Rather than waiting for financial loss to be complete, the operation uses intelligence to notify people who are being scammed while it is happening. The FBI reports that it has reached more than 8,000 victims and reduced losses by more than USD 500 million since the operation began. The underlying capability is AI-assisted pattern recognition applied early enough to intervene.
AML and Compliance Implications for Firms
The shift in law enforcement capability has direct implications for accounting firms, auditors, and CFOs managing digital asset exposure. Understanding these implications helps firms calibrate their own AML controls and documentation standards against what investigators can now see.
Transaction records and audit trails
Blockchain analytics at investigative speed means that wallet clustering and fund tracing that once required weeks of specialist work can now be run in minutes. Firms maintaining crypto ledgers through crypto accounting software need to ensure that wallet attribution, transaction categorisation, and counterparty identification are documented to a standard that survives investigative review, not just internal audit. If a client or counterparty comes under scrutiny, your records will be examined against the on-chain evidence.
For a broader view of how AI is already being applied to blockchain analytics in an AML context, see our coverage of how AI is being applied to Bitcoin money laundering detection at scale. Firms handling cross-chain transactions should also review the AML red flags compliance teams must know for crypto bridge hacks, as bridge activity is a recurring feature in multi-layer laundering schemes of the kind law enforcement is now equipped to trace end-to-end.
KYC and synthetic identity risk
Entity resolution at investigative scale means that inconsistencies in onboarding data, mismatched identifiers across documents, wallets that link to sanctioned addresses through intermediate hops, or corporate structures that resolve to the same beneficial owner under different names, are all more visible to regulators and law enforcement than they were two years ago. Firms should review whether their KYC procedures are calibrated to flag the same patterns that AI-assisted entity resolution is designed to surface.
SAR quality and timing
When AI links a local transaction pattern to a larger international network, the Suspicious Activity Report that a firm filed weeks ago can suddenly become central evidence in a much larger investigation. The quality of that SAR, its specificity, the indicators documented, the timeline, determines whether it supports or complicates the investigation. Firms should treat SAR drafting as a forensic document, not an administrative one.
Sanctions exposure through AI-linked infrastructure
The EvilTokens case shows that criminal infrastructure can connect thousands of organisations without their knowledge. Firms whose clients or counterparties used compromised infrastructure, processed payments through addresses later identified as linked to sanctioned networks, or received funds from drainer-contract victims, can face questions about what their AML controls detected and when. Digital asset accounting software that provides real-time sanctions screening and counterparty flagging reduces that exposure materially.
Frequently Asked Questions
What is AI-enabled crime and why does it matter for compliance teams?
AI-enabled crime is any offense in which artificial intelligence is used to plan, execute, scale, or conceal the activity. For compliance teams, the relevance is that AI dramatically lowers the cost and skill threshold for fraud, synthetic identity creation, and large-scale money laundering. Schemes that previously required specialist technical knowledge can now be deployed as subscription services, which means the volume and sophistication of threats arriving at a firm's AML controls has increased significantly.
How does AI-assisted financial tracing affect my firm's crypto transaction records?
Blockchain analytics tools, accelerated by AI, can trace funds across multiple chains to exchanges and cash-out points in minutes rather than days. This means that transaction records your firm holds, including wallet attributions and counterparty identifications, are subject to a level of investigative scrutiny that was not practically achievable before. Records that are incomplete or inconsistently categorised create risk when investigators examine the same on-chain data independently.
What does the defensibility requirement mean for AI tools used in compliance?
Courts require that every step in an AI-assisted investigation be documented with auditable provenance and a repeatable methodology, with a human making each material judgment. The same principle applies to compliance: AI-generated outputs used in AML decisions, KYC reviews, or SAR filings should have documented reasoning and human sign-off. Outputs that cannot be explained or reproduced are difficult to defend in regulatory inquiries or legal proceedings.
Is synthetic media detection reliable enough to rely on at onboarding?
TRM's research indicates that deepfake detection tools lose significant accuracy on real-world fakes. They are a useful first layer but should not be the sole control. Following corroborating evidence, such as payment behaviour, device consistency, and network identifiers, provides a more robust picture than any single detection output. Firms should treat synthetic media detection as one signal among several, not as a conclusive check.
What operational steps should accounting firms take now?
Three areas are most pressing. First, review wallet attribution and transaction categorisation in your crypto bookkeeping software to ensure records are complete and counterparty-identified. Second, audit KYC procedures against the entity resolution patterns that AI-assisted investigators now surface routinely, particularly mismatched identifiers and layered corporate structures. Third, review SAR quality standards: SARs should be specific, indicator-rich, and timed accurately, because they may become material evidence in investigations that are much larger than the individual transaction that prompted the filing.
Source: TRM Labs