Solana Co-Founder Warns Phishing Threatens Crypto Most

Phishing and social engineering is the biggest threat to crypto. Not AI breaking math or quantum computers, Yakovenko wrote on X.

His suggested defenses are short and practical. He recommends a dedicated iOS device with Apple’s Lockdown Mode switched on, paired with a multisignature wallet. Yakovenko describes both as some of the most cost-effective protections an investor can add.

The logic follows a pattern researchers have been describing for months: hackers target users, not code. Phishing relies on deceptive emails, websites, or messages built to extract sensitive data such as wallet recovery phrases. Social engineering is the wider category, where attackers exploit trust to push a victim into compromising their own security.

A Fake Job Interview Reached Binance’s Wallets

The clearest recent example is Binance. The exchange suffered a major breach on October 29, with roughly $6.34 billion in digital assets affected. An investigation Binance updated on November 3 traced the attack to a social engineering scheme.

Hackers ran fake job interviews to target employees. One software engineer downloaded malicious code disguised as a technical assignment, which gave the attackers access to the device and its credentials. They then used an internal AI tool to reach Binance’s wallet infrastructure, and unauthorized transfers from hot wallets followed. Separate reports say the Binance hacker is still buying Bitcoin aggressively.

Scam Calls Are Doing Damage at Smaller Scale

The SEAL group logged 99 incidents between October 28 and November 3. Three fraudulent customer support calls alone cost victims about $1.57 million and 1.12 BTC. The cases show how ordinary the hooks are:

• A fake Apple support call stole credentials from a victim who had saved a recovery phrase in cloud storage
• Another victim read out their wallet recovery phrase during a deceptive Telegram call
• SEAL tracked 5,137 phishing domains in a single week

Hashlytics Take

Yakovenko’s advice is aimed at individuals, but the Binance case shows why it matters beyond them. In the reported chain, nobody broke encryption. One engineer was persuaded to run code, and an internal AI tool then turned a compromised machine into wallet access. The weak point was a person with legitimate permissions, plus a tool that trusted what that person’s device could reach. Multisig works on the same principle at personal scale: no single deceived human, or single stolen device, should be able to move funds alone. Telling users to “be vigilant” will not fix this. Designing so that one successful trick is not enough will.