Solana Foundation’s new CISO warns AI is making crypto scams more convincing

Over the last few months, crypto ecosystems have had major security incidents that were not caused by smart contract vulnerabilities, but rather because of more advanced compromises, like fake identities and AI-generated scams.

Those types of vulnerabilities will drive the next wave of blockchain security concerns, according to the chief information security officer (CISO) at the Solana Foundation, Michael Coates.

“You have to do everything that a Web2 company has to do for security, and the incremental uniqueness to Web3,” Coates said in an interview with CoinDesk. “When you have adversaries that are definitely motivated and can take funds irrevocably, they are going to look for any mistake.”

Coates, who was previously the CISO at Twitter, and led security at Mozilla during the browser wars, joined the Solana Foundation earlier this year. That role means that not only is he securing the foundation itself, but he’s also working with Solana ecosystem projects to bring strong security practices to their networks and projects, and meeting with regulators to set up the right cybersecurity standards.

While exploits in crypto often grab headlines because of the sheer amount of money that gets stolen, Coates emphasized that many of these hacks actually originate outside of blockchain compromises themselves. “In many cases, it is an operational security issue or a Web2 issue that led to a key compromise,” he said.

This will only prove to be more difficult as artificial intelligence advances gives attackers better tools to exploit security practices.

“The social engineering piece is going to get a lot worse because of the power of AI and deepfakes,” Coates said. “We should expect full spoofed phone calls with voices of people that we know… there’s really no reason this won’t hyperscale.

To prevent that, Coates thinks crypto needs to come up with better systems that remain secure and work when people fall for these scams.

“You cannot fully prevent anyone from falling victim,” he said. “Eventually, you will be fooled because the cons are that good.” Organizations should thus have multiple layers of various degrees of security controls, so “when someone gets fooled, the other things take over to protect you.”

For the longer-term, the question of quantum computing largely looms on various crypto ecosystem’s futures, including that of Solana.

“The challenge with quantum readiness is we don’t know when the Q-day will hit,” he said. “The way to prepare for this is known. It is adopting the post-quantum algorithms.” As part of that, the Solana Foundation has come out with its own strategy to prepare for that day.

Whether the security exploit comes from AI scams or quantum computing, Coates said the industry’s success will hinge on building systems that protect users by default rather than expecting them to become security experts.

“We need to meet the users where they are, and we need to make the default secure decision for the user, ” he said.

Read more: Solana’s quantum-threat readiness reveals harsh tradeoff: security vs speed