The UAE's crypto boom is turning it into one of the region's biggest fraud targets

The UAE’s rise as a global digital-asset hub has come at a cost — it’s now a bigger target for scammers and hackers. The threats are the same ones fueling the sector’s growth in the first place — and the same ones we reported on earlier this month that have been affecting the UAE's wider financial sector. Gallagher’s Jamie Gee flagged the same shift crypto-sector sources describe below: AI-generated communications are now near-impossible to distinguish from the real thing. Crypto is where that dynamic is sharpest, precisely because of its efficiency and anonymous nature.

From hacks to AML exposure: The primary security threats facing the crypto and blockchain sectors include attacks on exchanges and custodians, smart contract vulnerabilities, social engineering and phishing, financial crime and AML exposure, third-party and supply-chain compromises, and weaknesses in wallet and private key management, Oliver Sykes, Partner in PwC Middle East's blockchain, technology, and cybersecurity practice, tells EnterpriseAM.

Why it matters: As the UAE scales up digital-asset activity, robust cybersecurity, secure custody, and operational resilience aren't nice-to-haves — they're what keeps customer trust in the system intact, Sykes said.

Positioning the country as a global crypto hub “naturally paints a massive regulatory and economic bullseye” on its digital infrastructure, Raed Ahsan, founder of cybersecurity firm Rtelligenc, tells us. Roughly 60% or more of fraud globally is now facilitated through digital assets in some form, Jonathan Benton, founder and CEO of UK-based forensic investigation firm specializing in digital assets iSanctuary, which serves clients in the UAE, tells us. A former head of the UK’s International Corruption Unit, Benton also led the UK Asset Recovery Task Force following the Arab Spring.

Who’s attacking? “Many [global] incidents [of crypto-related fraud] are attributed to organized cybercriminal groups and, in some cases, state-affiliated actors, although attribution is often complex and not always conclusive,” Sykes says.

And who’s the most exposed?

Nine times out of 10, it’s the private sector getting hit, not government or critical infrastructure, Benton says. “They will attack where they think they can get the quickest return, and commercial entities are much easier.”

Financial services carry the heaviest exposure as exchanges, custodians, banks, and payment providers all hold or move digital assets directly, Sykes said. But government, real estate, logistics, and healthcare are increasingly adopting blockchain for tokenization, digital identity, and supply-chain tracking, which widens the target list as adoption grows. In practice, any organization that stores, transacts in, or relies on digital assets is fair game — with fallout that goes beyond financial loss to operational disruption, data compromise, and reputational damage.

SMEs are especially exposed: Many lack the ins., the rapid-response playbook, or the resources to fight back, which pushes them toward paying up just to get data or system access back, Benton said. The real numbers are likely worse than reported — firms often stay quiet about attacks for fear of reputational damage or regulatory scrutiny, which, perversely, can invite repeat attacks, he added.

What makes crypto extra vulnerable?

Crypto's speed and cross-border reach make it an easy vector. “Defrauding someone on the east coast of the US, moving it to a virtual asset service provider in Dubai, all while operating out of Thailand, can take seconds” — and that speed is what makes life hard for law enforcement, Benton said. Anonymity has historically been crypto's biggest shield for bad actors, he said — though there are tools that exist — including those built by iSanctuary — to identify who's behind a wallet and roughly where in the world they are.

Irreversibility is the core risk, according to Dr. Mohammad Reza Beheshti, chief AI and innovation officer at CyberSiara: “Unlike traditional finance, crypto transactions are often immediate and irreversible. A compromised private key, weak access control, an insider threat, or a failure in custody infrastructure can result in rapid and significant financial loss.”

Once an attack happens, responders are working in minutes, not hours. “There’s a finite window before the [funds] start to become so obfuscated,” Benton says, as a transaction deliberately splinters across multiple wallets to hide its trail. The upside: that same on-chain trail creates real potential for detection and recovery, particularly at the off-ramp — the point where stolen crypto gets converted back into banknotes.

Risk depends less on the type of digital asset and more on how it's issued, stored, and managed, Sykes says. Cryptocurrencies are mainly exposed to private key theft, exchange compromise, and fraud, while DeFi applications add exposure through smart contracts, protocol design, and decentralized governance. Tokenized assets, on the other hand, carry the risk of the underlying asset itself, plus whatever platform is used to issue and custody the token. Custody arrangements, identity and access management, and smart contract security tend to matter more than the asset class alone, he says.

AI has become the attacker’s force multiplier, letting bad actors produce near-perfect copies of real communications far faster than before. “The current trend is a move from 'system hacking' to 'trust hacking,'” Beheshti says. “Attackers are no longer only asking, 'How can we break the system?' They're asking, 'How can we make the system trust us?'”

Ahsan sees the same shift in tactics: away from noisy, disruptive attacks and toward “low and slow” stealth infiltrations built to go undetected while quietly siphoning assets. He groups the threats into three buckets: advanced social engineering and adversary-in-the-middle phishing capable of bypassing standard multi-factor authentication; automated smart contract exploits; and custodial theft via compromised wallets and infrastructure.

The preparedness gap is structural, not just technical: Crypto firms often have security tools without a complete security architecture behind them, and traditional awareness training alone no longer cuts it, Beheshti says. A lot of it depends on the firm’s maturity, Ahsan says. He says tier-one exchanges and regulated custodians are building fast-evolving defenses, while younger firms chasing growth over governance tend to still lean on reactive incident response instead of proactive resilience.

The positives: The UAE’s regulatory framework for crypto is ahead of many others

The UAE built one of the world's most comprehensive digital-asset regulatory regimes early and was home to the first regulator dedicated specifically to virtual assets, with rules now covering everything from exchange-traded derivatives to security and commodity tokens. Sykes says that the risk-based framework, covering licensing, governance, custody, cybersecurity, and AML controls, gives investors real protection and supports market integrity, even though no regulatory regime eliminates fraud risk entirely.

Regulation, he says, will need to keep adapting alongside new technology and an evolving threat landscape. Benton agrees that the UAE is “significantly further ahead than many other jurisdictions” — but adds, “that doesn't mean it's immune to exploitation.”

What defense looks like now

Some of the fixes are technical. Authentication tools like FIDO2 and WebAuthn protect against adversary-in-the-middle phishing by shifting the trust burden from the human to the device, Ahsan says.

SOUND SMART- FIDO2 and WebAuthn swap passwords for hardware-based verification — a security key or a biometric check tied to your device — making it much harder for a phishing site to intercept a login, even if it perfectly mimics the real one.

Some of it comes down to governance: Dedicated risk committees and independent security boards to slow down rushed security sign-offs, plus regular audits and penetration testing, Ahsan says.

And some of it is a mindset shift — away from endpoint detection and toward forensic readiness that can spot on-chain anomalies in real time and trigger asset freezes or tracing the moment something looks wrong, he adds.