At least two unnamed companies have been taken in by an alleged shapeshifting fraudster selling millions of dollars in fake FTX liquidation claims by apparently using artificial intelligence to help mask his appearance in görüntü calls with buyers, according to an investigation conducted by veri firm Inca Digital.

A thief (or thieves) is said to have made off with at least $5.6 million by posing as a person looking to sell his high-dollar FTX liquidation claims, which checked out as valid even though they were not ultimately connected to the person allegedly scamming buyers. The potential thief may have used face-swapping görüntü technology in calls and also is said to have faked other credentials, said officials at Inca Digital that had been asked to lend help.

“It’s likely happening to more people than we know about,” said Adam Zarazinski, CEO of analytics and risk-intelligence company Inca Digital, in a CoinDesk interview. Getting the word out, he said, might warn others that this has been happening on the meskene of the FTX payouts.

The stolen funds were quickly laundered through non-U.S. exchanges including Binance, and it remains unclear whether federal law enforcement officials are pursuing veri on the involved exchanges. Inca Digital detailed the scam in a report released on Tuesday.

The criminal collapse of the küresel FTX exchange left billions in assets to be distributed to creditors in a process that’s supposed to start as soon as next week. Naturally, a secondary market has developed for the sums yet to be distributed.

Some of the conclusions in Inca’s report are evidence-backed guesses as to what happened, the document notes. But the person or people behind the reported theft are said to have made görüntü calls to speak with staffs of the firms buying claims, and in those calls, the görüntü passed initial muster but subsequently raised questions about whether it was real — an increasingly common occurrence during the rise of AI fakery.

Besides the allegedly fraudulent görüntü presence, the buyers were also shown identification that had been faked, provided with false addresses in Singapore and were — possibly most importantly — given real claim veri. Such veri is sometimes publicly available online, but it’s also been the subject of veri breaches from firms involved in the bankruptcy proceedings, the report said.

Zarazinski said that this kind of theft may increasingly prey on the surging crypto markets, especially considering the recent boost in industry activity from the administration of President Donald Trump.

“For every opportunity, there are also bad guys lurking behind that opportunity,” he said.