Solana co-founder Anatoly Yakovenko said phishing and social engineering attacks are the biggest threat to crypto and advised investors to worry more about social engineering attacks than about AI or quantum computers breaking crypto security.
"Phishing and social engineering is the biggest threat to crypto. Not AI breaking math or quantum computers," he wrote on X.
The Solana co-founder also suggested having a separate iOS device with Apple's Lockdown Mode turned on and using a multisignature crypto wallet.
This is one of the cheapest ways for investors to safeguard their digital assets, according to Yakovenko.
Fundamental weakness
The Solana co-founder's statement highlights a fundamental weakness in crypto security: hackers don't need to break blockchain security to steal digital assets.
What they can do is fool crypto holders into giving them access to their assets.
Phishing involves using malicious emails, sites or messages to trick people into revealing sensitive information such as crypto wallet recovery phrases, account information, etc.
Social engineering is a broader term that describes attacks in which hackers manipulate victims into doing something that can compromise their security.
Binance hack and other incidents
Yakovenko's point becomes crystal clear with the recent massive hack at Binance.
The world's largest crypto exchange, Binance, faced a security breach on Oct. 29 that affected around $6.34 billion in digital assets.
According to Binance's Nov. 3 investigation update, the hackers carried out a sophisticated social engineering attack, which included fake job interviews to compromise Binance employees.
A Binance software engineer was targeted by people pretending to be representatives of a fake company. The Binance employee went through some fake job interviews. The employee was convinced to download what seemed to be a legitimate technical assignment.
But the downloaded file contained malicious code that helped the hackers compromise the employee's computer.
Then, the hackers used the compromised devices, stolen credentials and an internal AI tool to access Binance's wallet infrastructure.
Eventually, this helped the hackers execute unauthorized crypto transfers from the exchange's hot wallets.
The Security Alliance (SEAL) released a report on Nov. 4 stating that its security team handled 99 incidents from Oct. 28 to Nov. 3.
In three of those incidents involving fraudulent customer support calls, victims lost roughly $1.57 million and 1.12 BTC from Oct. 28 to Nov. 3.
One of the scams involved fake Apple support representatives stealing a victim's Apple ID credentials. The victim had saved their crypto recovery phrase in cloud storage. Another victim shared their wallet recovery phrase during a fake Telegram support call.
The group also tracked 5,137 phishing domains during this reporting period.
