Co-founder Anatoly Yakovenko stated that phishing and social engineering attacks represent the greatest threats to cryptocurrencies, and advised investors to be more vigilant against social engineering attacks than to worry about AI or quantum computers cracking encryption security.
"Phishing and social engineering are the greatest threats to cryptocurrencies, not AI cracking mathematics, nor are they quantum computers," he wrote on X.
This co-founder, Solana, also suggested using a separate iOS device and enabling the Lockdown Mode feature of Apple, while also utilizing a multi-signature encrypted wallet.
Yakovenko believes that these are one of the cheapest ways to protect investors' digital assets.
Fundamental Weakness
The statement from the co-founder Solana highlights a fundamental weakness in encryption security: hackers do not need to break through blockchain security in order to steal digital assets.
What they can do is to trick cryptocurrency holders into voluntarily handing over their access rights to their assets.
Phishing typically involves using malicious emails, websites, or messages to trick people into revealing sensitive information, such as recovery phrases for encrypted wallets or account details.
Social engineering is a broader term that refers to hackers manipulating victims into performing actions that may jeopardize their security.
Binance Hacker Incidents and Other Cases
The views of Yakovenko were particularly evident in the recent large-scale hacking incident involving Binance.
The world's largest cryptocurrency exchange, Binance, encountered a security vulnerability on October 29th, which affected approximately $6.34 billion in digital assets.
According to the investigation update released by Binance on November 3rd, hackers carried out a complex social engineering attack that included impersonating job interview candidates in order to infiltrate employees of Binance.
A Binance software engineer was targeted by someone pretending to be from a fictitious company. The employee went through several rounds of fake job interviews and was persuaded to download what appeared to be a legitimate technical assignment document.
However, the downloaded file contained malicious code that helped hackers invade this employee's computer.
Subsequently, the hackers used the compromised devices, stolen credentials, and internal AI tools to access the wallet infrastructure of Binance.
Ultimately, this allowed hackers to execute unauthorized cryptocurrency transfers from the exchanges' hot wallets.
Security Alliance ( SEAL ) reported on November 4th that its security team handled 99 incidents between October 28th and November 3rd.
In three incidents involving fraudulent customer service calls, victims lost a total of approximately $1.57 million and 1.12 BTC between October 28th and November 3rd.
One of the scams involved impersonating Apple support personnel, who stole the victim's Apple ID credentials. The victim had previously saved their encryption recovery phrase in cloud storage. Another victim revealed their wallet recovery phrase during a call that impersonated Telegram support.
During this reporting period, the organization also tracked 5,137 phishing domain names.
