{"meta":{"exportedAt":"2026-09-30T07:16:30.413Z","formatVersion":2,"selection":{"q":"cryptocurrency","system":"","harm":"","context":"","country":"","role":"","relation":"core","evidence":"","year":"2025","response":"","severity":"","verification":"","view":"incidents","sort":"added"},"totalIncidents":1,"coverage":{"cases":1,"countries":0,"languages":1,"unknownLocation":1,"locationPending":0,"unknownLanguage":0,"unknownDate":0,"lawsuits":0,"regulatory":0,"minors":0,"coreRelations":1,"contextualRelations":0,"mixedRelations":0,"unknownRelations":0,"relationPending":0,"relationUnknown":0},"countingNote":"Distinct public cases in this selection. People counts apply within individual cases only; cross-case person overlap has not been resolved. No population incidence estimate.","affectedCountNote":"Interpret person counts with affectedCountStatus and the reported effects. Unquantified zeros are placeholders, not a measured zero.","source":"AI incidents","publisher":"NOPE","url":"https://nope.net/incidents","license":"CC BY 4.0"},"incidents":[{"id":"2025-mai-fujimoto-reported-deepfake-zoom-call-account-takeover","caseFacts":{"claims":[{"id":"c1","status":"reported","evidence":[{"locator":"was hacked on June 14 by a carefully planned deepfake attack","relation":"supports","source_id":"s1"},{"locator":"The attack began when her friend’s Telegram account was compromised","relation":"supports","source_id":"s1"},{"locator":"During the 10-minute video call, Fujimoto could see what appeared to be the face of her acquaintance, but could not hear.","relation":"supports","source_id":"s1"},{"locator":"Fujimoto believes that this was when malware was installed on her computer, which subsequently led to the theft of her social media account.","relation":"supports","source_id":"s1"},{"locator":"She shared a link for audio settings adjustment, and that's when the attack occurred,","relation":"supports","source_id":"s2"}],"assertion":"Mai Fujimoto reported that her main X account was hacked on 14 June 2025 after a 10-minute Zoom call with what appeared to be an acquaintance whose Telegram account had been compromised, who sent a link to fix an audio problem, and she believes malware was installed at that point.","causal_attribution":"All accounts derive from Fujimoto's own public post. The malware installation is her belief and was not forensically confirmed in the inspected sources."},{"id":"c2","status":"reported","evidence":[{"locator":"with hackers gaining access to Fujimoto’s Telegram and MetaMask accounts","relation":"supports","source_id":"s1"},{"locator":"taking over her official X, Telegram, and Metamask accounts","relation":"supports","source_id":"s3"}],"assertion":"Coin Edition and Crypto.news reported that attackers also gained access to Fujimoto's Telegram and MetaMask accounts after the call.","causal_attribution":"The outlets narrate this access, which derives from Fujimoto's post as they relay it. No loss of funds is stated in the inspected sources."},{"id":"c3","status":"reported","evidence":[{"locator":"When I opened the Zoom link, her face appeared, so I didn’t suspect anything","relation":"supports","source_id":"s3"},{"locator":"During the call, a deepfaked version of the acquaintance told her to click a link to fix an audio issue.","relation":"supports","source_id":"s2"}],"assertion":"Fujimoto said the face on the video call appeared to be her acquaintance and that she suspected nothing, and outlets describe the caller as a deepfake of the acquaintance.","causal_attribution":"The deepfake characterisation comes from the outlets' reading of Fujimoto's account. No analysis of the video is reported, so the use of AI is reported and not established."}],"effects":[{"label":"Cryptocurrency analyst reported losing control of X, Telegram and MetaMask accounts after a video call with a reported deepfake of an acquaintance","claim_id":"c2","direction":"negative"}],"sources":[{"id":"s1","url":"https://coinedition.com/cz-warns-video-verification-out-the-window-after-deepfake-scam-hits-analyst/","kind":"news_report","access":"read","language":"en","translation_note":"","independence_group":"fujimoto-x-post-june-2025"},{"id":"s2","url":"https://www.tradingview.com/news/coinpedia:8c9a65291094b:0-cz-warns-of-ai-deepfake-threat-after-top-crypto-influencer-hacked/","kind":"news_report","access":"read","language":"en","translation_note":"","independence_group":"fujimoto-x-post-june-2025"},{"id":"s3","url":"https://crypto.news/cz-warns-of-ai-deepfakes-as-more-execs-fall-victim-to-lazarus-linked-zoom-hacks/","kind":"news_report","access":"read","language":"en","translation_note":"","independence_group":"fujimoto-x-post-june-2025"}],"version":1,"ai_roles":["others_use"],"contexts":["privacy","finance"],"unknowns":["Whether any cryptocurrency or other funds were taken is not stated. Coin Edition and TradingView refer to the accounts being accessed, and TradingView says the assets were put at risk.","The account of the call and of the deepfake rests on Fujimoto's post. The original post was not retrieved, and no outlet reports an independent technical analysis.","The acquaintance whose Telegram account was reportedly compromised is not identified and no effect on that person is reported. That person is not counted.","The event date is the hack date given by Coin Edition (14 June 2025). The date of the Zoom call is not separately stated.","Crypto.news mentions other people reporting similar attacks and TradingView mentions a separate North Korean-linked campaign. Those are different events and are not part of this case."],"geography":{"basis":"Two outlets describe Fujimoto as Japanese, which is nationality and is not used as a location. No source states where the call or the accounts were located. No court proceeding is reported.","court_countries":[],"event_countries":[],"affected_person_countries":[]},"publication":{"basis":"Three outlets (Coin Edition, TradingView, Crypto.news) relay one first-person account by Mai Fujimoto, a cryptocurrency analyst who publicly described the event under her own name (relayed by the outlets on 20 June 2025) and is named. All claims are reported. The unnamed acquaintance is not identified.","reviewed_on":"2026-09-29"},"ai_involvement":{"basis":"Three outlets describe the caller as a deepfake of an acquaintance, relaying Fujimoto's account of a video call in which the acquaintance's face appeared. None reports technical analysis, and the original post was not retrieved.","status":"reported"},"person_relations":["communicated_with","depicted_or_impersonated"]},"name":"Cryptocurrency analyst Mai Fujimoto reports losing X, Telegram and MetaMask accounts after Zoom call with reported deepfake of acquaintance","summary":"Coin Edition (20 June 2025), TradingView and Crypto.news relayed a public account by cryptocurrency analyst Mai Fujimoto. She said her main X account was hacked on 14 June 2025 after a 10-minute Zoom call with what appeared to be an acquaintance whose Telegram account had been compromised. The caller could not be heard and sent a link to fix an audio problem. She believes malware was installed at that point, and the outlets report that attackers then also accessed her Telegram and MetaMask accounts. The outlets describe the caller as a deepfake of the acquaintance. Binance founder Changpeng Zhao commented publicly on 20 June 2025 that video verification may become unreliable. No loss of funds is stated.","incidentDate":"2025-06-14","incidentKind":"single_event","incidentDatePrecision":"day","exposurePattern":"single_interaction","reportedDate":"2025-06-20","aiSystem":"Unspecified deepfake (reported by outlets, no tool identified)","aiProduct":"Unidentified video tool","severity":"low","verificationStatus":"unverified","harmCategories":[],"harmOutcomes":["other_material_harm"],"harmOutcomeSummary":"Fujimoto reported losing control of her X account and, according to outlets relaying her post, her Telegram and MetaMask accounts. No loss of funds is reported.","frameworkFacets":[],"causationStatus":"alleged","participantUsersAffectedMin":0,"otherPeopleHarmedMin":1,"affectedCountStatus":"exact","affectedCountEvidence":"One person is reported harmed: Fujimoto, who described the account takeover. The acquaintance whose Telegram account was reportedly compromised is not counted because no effect on that person is reported.","victimAgeRange":"adult","platformType":"other","primarySourceUrl":"https://coinedition.com/cz-warns-video-verification-out-the-window-after-deepfake-scam-hits-analyst/","primarySourceLabel":"Coin Edition, 20 June 2025","firstPublishedAt":"2026-09-29T14:02:41.839863+00:00","updatedAt":"2026-09-30T01:17:09.533372+00:00","scopeVersion":"facts-v3","tags":["historical-2025"]}]}