“Jinkusu” threat actor is selling cybercrime tools designed to bypass Know Your Customer (KYC) checks on banks and crypto platforms using deepfake and voice manipulation. As stated in Dark Web Informer’s X post on Sunday, the tool uses InsightFace -based real-time face swapping and voice modulation to deceive biometric verifications; Vecert Analyzer also confirmed these details.
These tools integrate InsightFace’s open-source face recognition models to swap faces in real-time video streams. Voice modulation generates fake voices using AI models similar to ElevenLabs. Technically, the tools process in seconds with GPU-accelerated inference, thus deceiving KYC even in live video calls. Experts consider their use on BTC detailed analysis platforms particularly risky.
Cyvers CEO Deddy Lavid highlighted the vulnerabilities in KYC systems exposed by deepfake tools and recommended a layered security approach : Liveness detection, behavioral analysis, and device fingerprinting. Binance Chief Security Officer Jimmy Su had warned AI threats capable of breaking KYC with a single photo in 2023. These threats can lead to massive losses in high-volume transactions like BTC futures trading.
The new scam kit facilitates romance scams like pig butchering without requiring technical knowledge. In 2024, there were 200,000 cases resulting in 5.5 billion dollars in losses. The table below summarizes the scam types:
There is suspicion that Jinkusu is related to the actor who released the Starkiller phishing kit in February 2026. This kit mimics real login pages using a Docker-based reverse proxy, particularly effective on crypto exchanges.
According to Scam Sniffer, although crypto phishing losses decreased by 83% in 2025, wallet drainers and new malware remain active. Drainers bypass approval mechanisms to drain funds; the biggest threat for BTC wallet owners.
These developments are pushing crypto users towards more proactive defense.
Strategy Analyst: David Kim
Macro market analysis and portfolio management
This analysis is not investment advice. Do your own research.
Source:
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
