Solana Foundation's New CISO Warns AI-Powered Deepfakes and Social Engineering Surpass Smart Contract Bugs as Top Crypto Security Threat

Solana Foundation's new CISO, Michael Coates, warns that AI-powered deepfakes and social engineering have overtaken smart contract bugs as the top security threat in crypto. Coates, former CISO of Twitter, emphasizes that most major incidents stem from Web2 operational failures and key compromises. Because AI-driven scams are becoming too sophisticated for users to detect, Coates advocates for multi-layered security frameworks that protect users by default rather than expecting them to be security experts.

AI-powered social engineering threats

• ▪Artificial intelligence and deepfake technologies enable highly sophisticated social engineering schemes, including romance scams, pig-butchering scams, and spoofed phone calls mimicking familiar voices
• ▪Solana Foundation Chief Information Security Officer Michael Coates warned that artificial intelligence and deepfakes are escalating social engineering attacks beyond smart contract bugs as top crypto security threats

Operational security vulnerabilities

• ▪The irreversibility of blockchain transactions highly motivates attackers to exploit human errors and operational mistakes to permanently drain funds
• ▪Many major cryptocurrency security incidents in recent months originated from operational security failures, Web2 domain vulnerabilities, or compromised credentials rather than flaws in blockchain protocols

Layered security controls

• ▪Michael Coates proposed a multi-layered security framework with overlapping controls so that other safeguards prevent asset losses even when a user is successfully deceived
• ▪It is realistically impossible for cryptocurrency users to perfectly identify and avoid every scam because modern fraud tactics have become too sophisticated

Post-quantum cryptography preparation

• ▪The Solana Foundation has developed and announced its own quantum threat preparedness strategy to transition toward post-quantum cryptographic algorithms
• ▪The exact timing of Q-day, the point at which quantum computers render current cryptographic systems obsolete, remains unknown to the blockchain industry

User protection by design

• ▪Michael Coates joined the Solana Foundation as Chief Information Security Officer earlier in 2026, having previously served as CISO of Twitter and security lead at Mozilla
• ▪Michael Coates advocated that the cryptocurrency industry must build systems that protect users by default rather than expecting them to act as security experts