Nov 2024Event location unknownChatGPT (reported)
On 21 November 2024 a cryptocurrency user posted on X that he had asked ChatGPT to help write a 'bump bot' for the Pump.fun token platform, and that the code it returned pointed to a scam Solana API website. By his account, the code sent his wallet's private key to that API; he had connected his main wallet, and its assets, about $2,500, were moved out within about half an hour. The founder of the blockchain security firm SlowMist commented that the bot code carried a backdoor and called the case an AI poisoning attack. Heise, ForkLog, Cryptopolitan and Odaily relayed the posts on 22 and 25 November 2024. He said he reported the chat to OpenAI and the source repository to GitHub, which removed it. Heise noted that the code's own comment showed the private key being sent and that he had used his main wallet rather than a test account.
Core concern Medium reported severity
AI involvement reported · Causal attribution alleged · 4 sources, 1 underlying account · Added 25/10/2026
Event date unknownEvent location unknownUnidentified voice-cloning and deepfake tool
The Nigeria Police Force National Cybercrime Centre (NPF-NCCC) said at a press briefing in Abuja on Friday 23 October 2026 that its operatives arrested three suspects in Lekki, Lagos State, on 14 October over alleged identity theft, investment fraud and money laundering. According to the centre's director, the suspects allegedly operated fake social media accounts impersonating prominent personalities to trick victims into transferring money, and were linked to a cryptocurrency investment scheme promoted through a website called Bitcoin Trading Hub. Investigators said one of the suspects used artificial intelligence voice cloning and deepfake technology to impersonate Tesla chief executive Elon Musk and communicate with victims, particularly in the United States and the United Kingdom. The police did not say how they established the AI use or which tools were involved, how many people were deceived or how much they lost. Seized devices were undergoing forensic examination to identify victims and trace the proceeds, and the three suspects remained in custody.
Core concern Medium reported severity Investigation Opened
AI involvement reported · Causal attribution alleged · 2 sources, 1 underlying account · Added 25/10/2026
4 Sept 2026 to 13 Oct 2026RomaniaUnidentified image and document tool
Police in Alba county, Romania, said on 22 October 2026 that an older woman had been persuaded, under the pretext of earning money from stock-market investments, to hand over about 253,600 lei between 4 September and 13 October 2026. According to the police, their investigation found that she had allegedly been misled and her trust won by being shown documents and photographs created with artificial intelligence. A man suspected of collecting the money and feeding it into a cryptocurrency ATM, for a commission of 3,000 lei per operation, was caught in the act on 21 October while coming to collect more and was detained for 24 hours on suspicion of complicity in fraud. The people behind the scheme are unidentified and the investigation continues under the local prosecutor's office. The police do not say what the documents and photographs showed or how they established that AI made them.
Core concern Medium reported severity Criminal Charges
AI involvement reported · Causal attribution alleged · 2 sources, 1 underlying account · Added 23/10/2026
Event date unknownEvent location unknownUnidentified video tool (suspected)
The Ludwigshafen police directorate reported on 3 April 2025 that an older man from the Rhein-Pfalz district had seen a video online of a talk show on the German broadcaster ZDF in which large stock-market gains through a cryptocurrency were promised. The police say the video was presumably generated by AI. He then phoned a supposed personal financial adviser and over six months transferred about 27,000 euros to foreign accounts. He became suspicious when the promised gains were not paid out despite repeated requests and further fees were demanded instead. The police do not say who appeared in the video or how they reached their view.
Core concern Medium reported severity Investigation Opened
AI involvement suspected · Causal attribution alleged · 1 source · Added 20/10/2026
2026UkraineUnidentified voice-changing tool
Ukrainian prosecutors, the SBU security service and the National Police announced on 14 October 2026 that they had shut down a fraudulent call centre in the Lviv region of Ukraine. According to the Lviv regional prosecutor's office and the Office of the Prosecutor General, the group created fake women's accounts on dating services and messengers and, to make the conversations more convincing, used software with a neural network that changed a male voice to a female one in real time. Victims were persuaded to download a file disguised as a photograph that contained remote-access malware and to share their screens; the group then took control of their banking apps and moved the money to accounts it controlled or into cryptocurrency. Prosecutors say that, on preliminary data, at least 50 Ukrainian citizens and 30 foreigners, including people in Poland, Germany and Georgia, were victims. Three men were notified of suspicion, including under a new criminal-code article on fraudulent call centres in force since September 2026, and were remanded in custody with the option of bail. The statements do not say how many victims heard the altered voice or how much each lost.
Core concern Medium reported severity Criminal Charges
AI involvement reported · Causal attribution alleged · 3 sources, 1 underlying account · Added 15/10/2026
Aug 2025South KoreaUnidentified image tool
The Busan Eastern District branch of the prosecutors' office in South Korea announced on 11 February 2026 that it had indicted a man under detention on 6 February for fraud, forging and using private documents, and obstructing official duties by deception. According to the prosecutors, from August to October 2025 he used AI to make fake images of a medical licensing examination certificate and of cryptocurrency holdings, posed as a doctor and businessman with billions of won in assets, and took about 320 million won from victims for supposed cryptocurrency, cruise-ship and medical-centre investments. When police sought his arrest in December 2025, he gave the warrant judge a bank balance certificate showing about 904 million won, which prosecutors say he made by uploading his real certificate to an AI platform and asking it to change the balance; his real balance was 23 won. The judge refused the warrant. Prosecutors later found the certificate was forged and obtained a new warrant. The accused and the victims are not named here.
Core concern High reported severity Criminal Charges
AI involvement reported · Causal attribution alleged · 3 sources, 1 underlying account · Added 13/10/2026
Jan 2026 to Mar 2026Event location unknownGoogle Antigravity
In a post on Google's AI developer forum on 7 March 2026, a developer says the Antigravity agent had for the second time deleted the contents of an entire C: drive. The poster says that about two months earlier it deleted the C: drive of a laptop, losing projects, photos and videos and seed phrases kept on the desktop for cryptocurrency savings of 0.4 bitcoin and 3,200 XRP, which file-recovery software could not usefully restore. The poster says that on the day of the post, after asking Antigravity to close any process using a workspace folder so the folder could be deleted, the agent instead ran destructive commands and deleted the project the poster had been building for two months on a new desktop, including git folders with recent commits. The poster says an investor was paying for the project and might withdraw. A reply from an account carrying the forum title Google said the issue had been escalated and asked for an in-app bug report.
Core concern Medium reported severity
AI involvement reported · Causal attribution alleged · 2 sources · Added 11/10/2026
Event date unknownUnited Kingdom, GeorgiaUnidentified video tool
A man in his 30s from East Anglia, England, told the Guardian (pseudonym used) that he watched a video of broadcaster Ben Fogle apparently promoting cryptocurrency trading on a site called AdmiralsFX, entered his details, was called by what turned out to be a Tbilisi call centre, paid a £250 buy-in and within a month had handed over £27,000, about a year's salary. The Guardian describes the clip as a deepfake, a digitally doctored video Fogle had publicly warned about in spring 2024. The account was published in March 2025 as part of a Guardian, SVT and OCCRP investigation of a leak from the Georgian operation, which the Guardian says duped at least 6,179 people and whose victims frequently cited the deepfake ads as the reason they went ahead.
Core concern Medium reported severity Investigation Opened
AI involvement reported · Causal attribution alleged · 1 source · Added 09/10/2026
23 Feb 2026 to 25 Feb 2026ItalyUnidentified voice-cloning tool
On 23 February 2026 Paolo Molesini, then chairman of Fideuram (the private-banking subsidiary of Intesa Sanpaolo), received a WhatsApp message from an unknown number from someone claiming to be Intesa's chief executive Carlo Messina, announcing a confidential acquisition that had to be executed through Fideuram. The same day a caller presenting as a lawyer of A&O Shearman whom Molesini knew, whose voice ANSA, Il Fatto Quotidiano and Corriere della Sera, reporting from the Milan court papers, describe as created with artificial intelligence (today.it, which also cites the seizure decree, writes that the court papers do not yet answer whether the voice was imitated), had him sign a confidentiality agreement and sent eleven payment instructions; Fideuram's treasury head was separately contacted by someone posing as Fideuram's CEO. Between 23 and 25 February eleven transfers totalling about 95 million euros went to accounts in Portugal and at Bank of China; the bank's alarm systems and the Milan prosecutors recovered about 40-42 million from China and 13 million seized in Portugal, leaving at least 36 million (39.5 million per the court papers) missing after conversion into cryptocurrency. Molesini, who Corriere writes is not under investigation, resigned as chairman on 12 March 2026, which Fideuram announced as being for personal reasons; a 48-year-old Israeli citizen is under investigation as a member of the gang.
Core concern Medium reported severity Investigation Opened
AI involvement reported · Causal attribution supported · 8 sources, 5 underlying accounts · Added 30/09/2026
Event date unknownCanadaUnidentified video tool
A report relaying W5's investigation describes a Prince Edward Island man who lost C$600,000 after an online video falsely presented a cryptocurrency investment as associated with Dragon's Den. The report identifies the two Canadian accounts as deepfake scams. He reportedly increased his payments while being shown fake profits and could not withdraw the funds. His first contact date and the specific generation method are unknown.
Core concern High reported severity
AI involvement reported · Causal attribution alleged · 1 source · Added 30/09/2026
Event date unknownUnited StatesUnidentified voice-cloning tool
A Chicago-area man told ABC7 that he sent $10,000 in cryptocurrency to someone posing as Elon Musk. The outlet reports that the scammer used AI-assembled voice messages using Musk's voice, alongside social media messages, apparent investment returns and a promised vehicle. The man said he could not retrieve the money after several months and was struggling to pay ordinary bills. The beginning of the contact and the technical creation of the messages remain unknown.
Core concern Medium reported severity
AI involvement reported · Causal attribution alleged · 1 source · Added 30/09/2026
14 Jun 2025Event location unknownUnidentified video tool
Coin Edition (20 June 2025), TradingView and Crypto.news relayed a public account by cryptocurrency analyst Mai Fujimoto. She said her main X account was hacked on 14 June 2025 after a 10-minute Zoom call with what appeared to be an acquaintance whose Telegram account had been compromised. The caller could not be heard and sent a link to fix an audio problem. She believes malware was installed at that point, and the outlets report that attackers then also accessed her Telegram and MetaMask accounts. The outlets describe the caller as a deepfake of the acquaintance. Binance founder Changpeng Zhao commented publicly on 20 June 2025 that video verification may become unreliable. No loss of funds is stated.
Core concern Low reported severity
AI involvement reported · Causal attribution alleged · 3 sources, 1 underlying account · Added 29/09/2026
2025United StatesUnidentified website tool
A retired couple in Gwinnett County, Georgia, told FOX 5 Atlanta and the Atlanta Journal-Constitution in June 2025 that they had lost about $800,000 ($802,000 per the AJC), their life savings, in a cryptocurrency scam that began when a stranger contacted the husband on WhatsApp and encouraged him to trade through a mobile app. He traded and withdrew small amounts before investing more, and discovered the fraud when he could not withdraw and called 911. According to FOX 5, Gwinnett County police explained that the app was real but the scammers had created an AI-generated "ghost site" that manipulated what he saw on the screen; the husband said police identified that what he was seeing on the wallet was not there. The 74-year-old said he felt sick and ashamed; the couple's children started a fundraiser for day-to-day expenses, and police said such funds are rarely recovered. The tool is not described; the AI element appears in no independently reported source (a Cobb County government page of January 2026 repeats FOX 5's summary, and the AJC's legible text does not mention AI).
Core concern High reported severity Investigation Opened
AI involvement reported · Causal attribution alleged · 2 sources · Added 29/09/2026