Data Study · 2026
How AI-industrialized scams, sybil-flooded airdrops, and structurally leaky retention turned community management into crypto's frontline security function. A sourced data study by ProCrypto. Every headline figure carries a real public source and year. Where a widely-circulated statistic could not be traced to a primary source, we flag it rather than repeat it — the discipline that makes this report citable.
Crypto projects still budget for community management the way they did in 2017: as a marketing line item measured in member counts, message volume, and vibes. The 2024–2026 data says that framing is now dangerous. Across four independent categories of evidence — on-chain analytics, federal law-enforcement statistics, consumer-protection regulators, and Web3 security trackers — the losses, the attackers, the fake members, and the fleeting engagement all converge on one venue: the community channel itself. This study assembles the verifiable figures, quarantines the unverifiable ones, and draws the conclusion the data forces: community management has become a security function, and the reactive model most projects run is obsolete.
Crypto fraud is no longer a fringe cost of doing business — it is growing faster than the market it preys on, and the numbers now trace a clear path to where the attacks begin. In 2025, on-chain crypto scam losses reached a record $17 billion, up from roughly $12 billion in 2024, according to Chainalysis (Chainalysis 2026 Crypto Crime Report). That is not a market moving in step with price cycles; it is an attack surface expanding on its own trajectory.
Government fraud data tells the same story from the victim's side. The FBI's Internet Crime Complaint Center recorded $9.3 billion in cryptocurrency-related losses in 2024, a 66% year-over-year increase, with $5.8 billion of that tied to investment fraud — the category that includes the long-con "pig butchering" schemes run through direct messages and group chats (FBI IC3 2024 Annual Report). A two-thirds jump in a single year is the signature of an industry scaling up, not a handful of opportunists.
The most important detail is not the size of the losses but their point of origin. The Federal Trade Commission reported that Americans lost $5.7 billion to investment scams in 2024, and — critically — $1.9 billion to fraud that started on social media, while cryptocurrency ranked as the second-largest fraud payment method at $1.4 billion (FTC 2024 fraud data). Social media is where the pitch lands; crypto is how the money leaves. That is the mechanism community managers watch play out every day — a plausible-looking account in a Telegram group, a "support admin" in a Discord server, a hijacked post pushing a link.
On-chain phishing makes the community vector explicit. Wallet-drainer operations — the malicious "connect wallet" prompts distributed through compromised project accounts, fake announcement posts, and impersonated support channels — stole $494 million from roughly 332,000 victim wallets in 2024, a 67% increase over the prior year, per Scam Sniffer (Scam Sniffer 2024 Web3 Phishing Report). These are not attacks on protocols or smart contracts. They are attacks on people, delivered inside the exact channels where projects gather their members.
Read together, four independent datasets — an on-chain analytics firm, a federal law-enforcement bureau, a consumer-protection regulator, and a Web3 security tracker — converge on one conclusion. The losses are accelerating faster than adoption; the schemes that dominate them (investment cons, impersonation, drainer phishing) are social-first; and the venue for that social layer is the project community. Telegram channels, Discord servers, and X replies are no longer just marketing surfaces. They are the front door through which billions of dollars walk out.
This reframes what a community team is actually defending. When $1.9 billion in fraud begins on social platforms and $494 million drains from wallets that clicked a link served inside a community channel, moderation stops being a matter of tone and engagement and becomes a matter of loss prevention. The threat has physically relocated — out of the code and into the chat.
If Section 1 established that the losses are accelerating, this section explains the engine behind the acceleration: generative AI has turned scamming from a cottage craft into a scalable industry, collapsing the cost of an attack while multiplying its yield.
The clearest evidence is in the unit economics. Chainalysis found scam operations with on-chain links to AI service providers took in an average of $3.2 million per operation, versus $719,000 for those without — roughly 4.5 times more revenue (Chainalysis 2026 Crypto Crime Report). The inputs got cheaper at the same time: off-the-shelf phishing kits can be launched for under $500. Any activity where the cost of one attempt falls while the payoff rises will see more attempts — that is the definition of an industrializing market, and it is now crypto fraud's growth curve.
The behavioral fingerprints match. The average individual scam payment rose 253% year over year, from $782 to $2,764 (Chainalysis) — bigger, more convincing cons extracting more per victim. And the single most community-relevant category exploded: impersonation-based schemes grew more than 1,400% year over year, the admin- and support-impersonation vector that operates inside Telegram groups and Discord servers. AI is what makes a fake support admin cheap to run at scale — convincing copy, fluent in any language, awake around the clock.
Government data has started tracking the same shift. The FBI's IC3 added its first-ever dedicated section on AI-enabled fraud in its 2024 report, logging 22,364 complaints tied to AI-related schemes with roughly $893 million in associated losses (FBI IC3 2024 Annual Report). A federal bureau formally recognizing AI as a distinct fraud category is the institutional signal that this is structural, not a passing trend.
Two further figures point the same direction but rest on secondary sourcing, so we cite them as supporting context rather than headline facts. Analysis in the Chainalysis orbit suggests a large share — on the order of 60% — of deposits into scam wallets now trace to AI-linked infrastructure; and TRM Labs has reported a 456% surge in generative-AI-enabled scams across a recent measurement window. Both are directionally consistent with the verified unit-economics data; neither should be quoted as a precise rate.
The defensive implication is the part community teams feel most acutely. iProov's 2025 research (reported via industry roundups, so attributed cautiously) found humans correctly identified high-quality deepfakes only about a quarter of the time — a figure that matches the lived reality of moderators trying to tell a real team member from a synthetic impostor. When the attacker's content is AI-generated and the human eye is wrong three times out of four, detection cannot rest on individual vigilance alone. It requires systems, verification, and coverage.
Any plan to defend a community has to begin with an accurate map of where the community actually is — and in crypto that map has two large landmasses, not one. Telegram surpassed 1 billion monthly active users in early 2025, up from around 800 million the year before (The Block) — a scale that makes it less a messaging app than the primary town square for crypto projects, especially in the regions where adoption is fastest. Discord, the other pole, reports over 200 million monthly active users and anchors the more structured, role-and-channel style of community that Western projects favor.
These are not interchangeable venues, and the difference is regional as much as functional. Telegram's crypto center of gravity sits in MENA, Asia, the CIS, and Latin America; Discord skews toward the US and Europe. Both patterns are practitioner-observed rather than drawn from a single primary dataset, so we present them as directional. The practical consequence is unambiguous: a project with a global user base cannot pick one. It runs Telegram for one set of communities and Discord for another, and layers X (formerly Twitter) on top as the public announcement channel — and the primary impersonation target.
Scale figures beyond the headline MAU counts round out the picture but carry lighter sourcing, so we hedge them. Discord is frequently cited as hosting tens of millions of active servers (a commonly repeated ~32.6 million figure we could not tie to a current primary release), and Telegram's paid tier, Telegram Premium, has been reported at around 15 million subscribers. Useful as context, attributed and caveated — not load-bearing facts.
The load-bearing fact is structural: the community surface is plural by default. A serious project maintains a real-time presence on at least Telegram, Discord, and X simultaneously — each with its own culture, its own moderation tooling, its own impersonation patterns, and, critically, its own clock. This is the operational reality the rest of the report builds on. The member counts on each platform are inflated by bots (Section 4), the engagement they show is less durable than it looks (Section 5), and covering all of them around the clock is what makes moderation expensive (Section 6). Platform plurality is not a footnote; it is the multiplier on every cost and every risk in this study.
The member count is the first number a crypto project puts in its pitch deck, and it is very often fiction. The clearest evidence comes from airdrops, where a token reward creates a direct financial incentive to fake being many people at once — the definition of a sybil attack. When LayerZero audited applicants for its ZRO airdrop, it identified and removed 803,273 sybil wallets, or 59% of all applicants — the majority of its apparent "community" was one set of actors wearing hundreds of thousands of masks (Cointelegraph / LayerZero). That is not a rounding error at the edge of a clean dataset; it is most of the dataset.
This is a structural feature of open, incentivized systems, not a one-off. Across the wider web the balance has already tipped: automated traffic reached 51% of all internet traffic in 2025 — the first time bots surpassed humans — with 37% classified as outright "bad bots" (Imperva 2025 Bad Bot Report). Crypto communities sit at the extreme end of that curve, because unlike an ordinary website they attach money to participation. A Discord that rewards "active" members, an airdrop that scores on-chain activity, a points program that ranks engagement — each one converts a bot from a nuisance into a paid position.
The economics of faking scale are lopsided in the attacker's favor because one operator can run an army. Chainalysis, tracing wash trading used to manufacture the appearance of organic demand, found the behavior concentrated in a small number of hands: a single operator was linked to 22,832 addresses used to trade against itself and simulate a real market (Chainalysis 2026 Crypto Crime Report). One human, tens of thousands of "participants." The same asymmetry that makes wash trading cheap makes sybil farming cheap: the marginal cost of the ten-thousandth fake wallet rounds to zero, while the marginal reward — if the airdrop pays out — does not.
For community managers, this reframes what a "growing" channel actually is. When more than half of applicants to a marquee airdrop are sybils, the raw membership and activity numbers a project reports are, at best, an unaudited mixture of real people and manufactured ones. Industry practitioners put the fake share of airdrop-eligible wallets even higher — estimates run as high as 70% — though we were unable to trace that figure to a primary published dataset, and it should be read as an unverified practitioner estimate rather than a measured rate. The verified anchors are conservative enough to make the point on their own: a documented 59% at LayerZero, and a documented majority-bot internet at large.
The operational consequence is that authenticity verification is no longer an optional back-office task; it is a core community-management function. Every downstream metric a project relies on — engagement rate, retention, sentiment, "share of voice" — is computed over a population that is partly synthetic. A moderation team that cannot distinguish a real member from a farmed wallet is measuring, rewarding, and reporting on ghosts. And the same infrastructure that inflates a member count can be repurposed the moment an incentive appears: coordinated wallets that farmed an airdrop yesterday can amplify a scam link tomorrow. Distinguishing the humans from the machines is, increasingly, the whole job.
Ask a crypto community manager what a "healthy" server looks like and you will hear confident numbers: 15–25% daily-to-monthly active ratio is thriving, under 10% is struggling, 60%-plus of members churn inside 90 days. These figures circulate widely in practitioner blog posts — but they trace back to no locatable primary dataset. The most commonly cited version, a "15–25% DAU/MAU = healthy Discord" rule of thumb, appears in agency guidance without an underlying study behind it (Omni Agency). We flag it here rather than repeat it as fact, because the honest benchmarks that do have primary sources tell a harsher and more useful story.
Start with the one defensible engagement figure. Mixpanel's product-analytics benchmark data puts the crypto vertical's stickiness — the share of monthly active users who return on a given day — at roughly 31% (Mixpanel). That is a genuine, measured DAU/MAU ratio, and notably it sits above the 15–25% band the folk wisdom calls "healthy." The lesson is not that crypto communities are unusually engaged; it is that a same-day return rate and durable membership are different things, and conflating them flatters the numbers.
Durability is where the picture darkens. Across 11 major blockchains, only 15.1% of wallets that were active in a given period were still active one year later, with Ethereum the strongest performer at 26.2% (CoinGecko Research). Read plainly: even on the best-retaining major chain, roughly three of every four active users are gone within twelve months. On-chain activity is not a perfect proxy for community membership, but it is the closest population-scale retention signal the industry has — and it is far below what a 15–25% "healthy" heuristic would imply.
The reason so much engagement evaporates is visible in what happens the moment incentives pay out. Following the ZKsync airdrop, more than 41% of the top recipients sold their entire allocation, and fewer than 29% still held any of the tokens afterward (crypto.news / Nansen). These were, by definition, the community's most-rewarded members — and a plurality exited completely at the first liquidity event. A similar dynamic has been reported around the Uniswap airdrop, where analysis of recipient behavior suggested roughly 93% eventually sold and only about 7% still held; that figure comes from summaries of an academic paper rather than a direct reading of its tables, so treat it as a directional, unverified estimate rather than a hard benchmark (arXiv).
Put together, the sourced data draws a consistent line. Same-day engagement can look reasonable (Mixpanel's 31%), but one-year retention collapses to the mid-teens across chains (CoinGecko's 15.1%), and reward-driven cohorts liquidate and leave almost immediately (ZKsync's 41% full-sell). The comfortable practitioner benchmarks — the ones without primary sources — describe a version of community health that the measurable data does not support. Incentive campaigns and airdrop farming inflate member counts and short-window activity while producing very little of the durable, returning membership those counts are meant to represent.
For anyone using engagement numbers to judge a community, the implication is methodological: distinguish a stickiness snapshot from a retention curve, weight sourced measurements over circulated rules of thumb, and assume that any spike coinciding with a reward event is borrowing from the future rather than building it.
If community management is now a security function, then coverage is its central cost — and the arithmetic of continuous coverage is unforgiving. Start with the unit. A social-media content moderator in the United States earns a median of roughly $38,915 per year (Salary.com). That single hire buys one person working a conventional schedule of about 40 hours out of the 168 hours in a week — under a quarter of the clock.
That gap is the whole problem. A Telegram or Discord channel does not close at 5 p.m., and neither do the attackers targeting it. Covering all 168 weekly hours with human eyes requires roughly 4.5 full-time equivalents once rest days, shift handoffs, and time-zone rotation are accounted for. At the median moderator wage, 4.5 FTEs is on the order of $175,000 per year in base salary alone — before payroll taxes, benefits, management overhead, and the tooling and training that a scam-facing role demands. Benefits and employer costs typically add a further layer on top of base pay, so the loaded figure runs higher still, and that is for a single language and a single platform. Serious crypto projects run Telegram, Discord, and X simultaneously, which multiplies the staffing requirement rather than sharing it.
This cost structure is precisely why an outsourced-moderation market exists. Managed community-operations retainers span a wide band, starting near $3,000 per month for lighter coverage and reaching $20,000 or more per month at the enterprise, round-the-clock tier (NeoWork). The upper end of that range is not a luxury markup; it is the market price of the 4.5-FTE, always-on staffing model that in-house teams struggle to build and retain. Outsourcing firms argue the trade is favorable — NeoWork, for instance, markets savings of up to 70% versus in-house hiring (NeoWork) — though that figure is a vendor's own claim rather than an independently measured benchmark, and should be read as a sales estimate, not verified research. Vendor marketing that promises specific loss-reduction percentages from moderation belongs in the same skeptical category and is omitted here for lack of any underlying study.
What makes the crypto case distinct is not the wage math, which is broadly the same as any 24/7 support operation, but the cost of the hours left uncovered. In most industries an unmoderated overnight window produces a backlog of unanswered questions. In a crypto community it produces a window for impersonators to pose as admins and drain wallets — the same admin- and support-impersonation vector whose reported volume grew more than 1,400% year over year (Chainalysis 2026 Crypto Crime Report). When a fake-support message and a live drainer can move funds in the minutes before a moderator wakes up, the overnight shift stops being a customer-service nicety and becomes loss prevention. The 4.5-FTE clock is, in effect, a security perimeter priced as a payroll line.
That reframing changes how the spend should be judged. Evaluated as engagement staffing, continuous moderation looks expensive relative to the community it serves. Evaluated as security staffing — measured against record scam losses and attackers made materially more efficient by AI — the same headcount looks like one of the cheaper controls a project can buy. The economics do not favor doing it cheaply; they favor doing it completely, because partial coverage in this environment is functionally no coverage at all.
Read end to end, the six sections describe a single structural shift. The losses have moved into the community channel (Section 1): $1.9 billion in fraud now begins on social media, and wallet-drainers ride hijacked project posts. The attackers have been industrialized by AI (Section 2): 4.5x more revenue per operation, kits under $500, impersonation up more than 1,400%. The community surface is plural and partly synthetic (Sections 3 and 4): projects run Telegram, Discord, and X at once, and a single airdrop can be 59% sybil wallets against an internet that is already majority bot. The engagement those channels display is not durable (Section 5): one-year on-chain retention collapses to the mid-teens, and reward cohorts liquidate on day one. And the one control that actually prevents loss — genuine around-the-clock human coverage — is the single most expensive thing to build in-house (Section 6): roughly 4.5 FTEs, or an enterprise outsourced tier north of $20,000 a month.
Put those together and the conclusion is unavoidable. Community management is no longer a marketing or engagement discipline; it is a security function. The channel is the attack surface, the member list is an unaudited population, and the window between a fake-support message and a drained wallet is measured in minutes. Moderation that optimizes for tone and activity is measuring the wrong thing. The job now is loss prevention and impersonation enforcement, performed by people who can tell a real member from a farmed wallet, awake in every timezone the community spans.
That is precisely the operating model the data points to, and it is the model ProCrypto has run since 2016: real human moderators on a genuine 24/7 clock, doing proactive anti-scam and anti-impersonation enforcement across the exact platforms — Telegram, Discord, X — where these attacks land. Nearly a decade of continuous operation, reflected in a 5.0 rating on Clutch, is the track record; the external data assembled in this report is the case for why that model is now the requirement rather than a premium. When impersonation grows fourteenfold and deepfakes beat the human eye three times out of four, the differentiator is not a bot that sybils can pass at scale — it is verified humans who never go offline.
How this study was built. Every figure in the corpus was sorted into one of three confidence tiers before writing, and the report was deliberately constructed so that its argument stands entirely on the verified tier. Nothing was headlined that could not be traced to a primary or authoritative source.
Confidence tiers.
What was dropped, and why.
On ProCrypto's own claims. ProCrypto contributes qualitative positioning only — "24/7 human moderation," "anti-scam / anti-impersonation enforcement," and its operating history. The only ProCrypto facts stated are that it has operated continuously since 2016 and holds a 5.0 rating on Clutch. No response-time percentage, losses-prevented percentage, or client count is asserted, because none could be independently sourced. That restraint is intentional: a study about distinguishing real signal from inflated numbers cannot afford to inflate its own.
These are the verified, quotable figures a journalist or AI answer engine would pull. All are verified-tier unless otherwise noted.
Two runner-ups worth citing: Telegram surpassed 1 billion MAU in Q1 2025 (The Block — https://www.theblock.co/post/348630/telegram-surpasses-1-billion-monthly-active-users-fueling-bombies-rise-as-the-top-earning-game-on-the-ton-ecosystem); Mixpanel's crypto-vertical ~31% DAU/MAU stickiness benchmark (https://mixpanel.com/blog/mau/).
ProCrypto has run real human, 24/7 anti-scam and anti-impersonation moderation across Telegram, Discord, and X since 2016. Talk to us about protecting your community.