Solana CISO Warns AI-Powered Deepfakes Pose Major Social Engineering Threat in Crypto

Solana Foundation CISO Michael Coates is sounding the alarm: AI is making crypto scams far more convincing, and attackers are increasingly exploiting people — not protocol bugs — to steal funds. Why it matters - Coates stresses this is not a critique of Solana’s blockchain or smart contracts. The danger is social engineering: phishing, impersonation and voice deepfakes that trick users, employees and support teams into handing over access or approving harmful transactions. - In crypto, those mistakes are often irreversible. A malicious transaction, a shared seed phrase, or an approved wallet connection can instantly drain funds. There’s no chargeback and usually no central authority to undo the damage. How AI changes the game - AI can generate polished messages, believable fake identities, convincing voice calls and targeted scripts tailored to a victim — all at scale. - The classic scam email with spelling errors is disappearing. Today’s attacks can mimic support staff, impersonate executives, tailor lures to individual victims and run high-volume, highly credible campaigns. Why users and teams are both at risk - Retail users face realistic fake mints, spoofed airdrops, malicious token approvals, impersonation accounts and wallet-draining sites. - Crypto teams are targeted too. Fake vendors, investors, journalists or job applicants can be used to harvest credentials, gain system access, or trick employees into approving transfers. Voice deepfakes add urgency and plausibility, making it easier to bypass routine checks. What needs to change Coates argues security can’t rely on users always being perfect. He calls for secure-by-default design across the ecosystem: - Wallet UX: make risky approvals clearer and reduce blind signing. - Protocols: limit permissions and minimize broad approval scopes. - Exchanges & custodians: strengthen withdrawal controls and treasury procedures. - Teams: enforce out-of-band verification, strict multisig discipline, hardware keys, robust access controls and formal internal verification for sensitive actions. - Communities: reduce reliance on direct messages and create trusted communication channels. Broad implications - Solana’s growing mainstream footprint — DeFi, consumer apps, meme trading, NFTs, payments and mobile tooling — raises its user-facing attack surface. But Coates’ warning applies to every blockchain ecosystem: AI doesn’t invent new fraud, it makes existing scams cheaper, faster and more professional. - The takeaway for builders and users: move beyond “be careful.” Product defaults must be safer, wallets and protocols must warn and limit risk, teams must harden internal processes, and communities must establish trusted channels for communication. Source and credits This report summarizes public comments by Solana Foundation CISO Michael Coates about AI-driven crypto scams. Written by the News Desk; edited by Samuel Rae. Based on disclosures and primary-source remarks.