Michael Coates, the newly appointed chief information security officer at the Solana Foundation, has raised alarms about how artificial intelligence is transforming cryptocurrency-related fraud into something far more convincing and harder to detect.
In a recent interview, Coates stressed that the industry’s most pressing risks are shifting away from traditional smart contract flaws toward sophisticated social-engineering tactics powered by AI tools such as deepfakes. Coates previously served as Twitter’s first CISO and held a senior security position at Mozilla.
Recent high-profile incidents in crypto, Coates observed, often stem not from vulnerabilities in blockchain code but from offline weaknesses. These include compromised credentials, operational security lapses, and traditional Web2-style attacks that ultimately allow attackers to seize private keys or seed phrases.
“You have to do everything that a Web2 company has to do for security, and the incremental uniqueness to Web3,” he explained.
Motivated adversaries who can irreversibly drain funds will exploit any available opening. What concerns Coates most is the accelerating impact of AI. Social-engineering attacks, he warned, are poised to intensify thanks to deepfake technology.
Scammers will increasingly generate fully spoofed phone calls that replicate the voices of people victims know and trust.
Romance scams and so-called pig-butchering schemes already target crypto holders; AI simply makes the deception more polished and persuasive, raising success rates for schemes that once appeared implausible. Coates is realistic about human limitations. It is impossible to ensure that no one ever falls victim, because the cons are becoming exceptionally sophisticated.
“Eventually, you will be fooled because the cons are that good,” he said.
Therefore, the industry must design systems that remain protective even after a user has been deceived.
Organizations need multiple layers of security controls so that when one layer fails, others continue to safeguard assets.
This could include features such as withdrawal delays, transaction limits, multi-party approvals, and recovery mechanisms that function after an attacker has obtained apparent consent.
Looking further ahead, Coates also addressed the longer-term challenge of quantum computing.
While the exact timing of a cryptographically relevant quantum computer remains uncertain, the path to readiness is clear: adopt post-quantum algorithms.
The Solana Foundation has already outlined its own strategy for quantum readiness.
Ultimately, Coates argued that success depends on building defenses that protect users by default rather than requiring them to become security experts.
“We need to meet the users where they are, and we need to make the default secure decision for the user,” he stated. By combining proper technical measures with an understanding that people can be tricked, the crypto sector can better withstand the evolving threats posed by AI-enhanced fraud.