Solana Foundation's new CISO warns AI is making crypto scams more convincing

I have spent a lot of time talking to founders who think security is a checklist item you handle right before a mainnet launch. They treat it like a house inspection. You check the pipes, look for mold, sign the papers, and move in. But in the current landscape, especially on high-velocity chains like Solana, security is less like a house inspection and more like a biological immune system that has to evolve in real-time. If it stops learning, the organism dies.

The New Guard at Solana

The Solana Foundation recently brought on Michael Coates as their Chief Information Security Officer. Coates isn't a crypto native in the way most people in this space are; he comes from the broader tech world, having held senior roles at places like Twitter and Mozilla. This matters. When you bring in someone who has seen how security scales at a billion-user level, you get a different perspective than the one provided by your average smart contract auditor.

Coates is sounding an alarm that I think most builders are currently ignoring because they are too busy chasing the next pump or debugging their Rust code. His primary concern isn't just about a bug in a program. It is about how Artificial Intelligence is weaponizing the human element of blockchain security.

The Identity Crisis

For years, we have told users that the code is law and the private key is the ultimate authority. That remains true, but the way we interact with that code is mediated by interfaces that are becoming increasingly easy to spoof. Coates points out that AI is making crypto scams significantly more convincing. We are moving past the era of the Nigerian Prince email with broken English. We are entering the era of the deep-fake founder.

If you are a builder, you probably rely on Discord, Telegram, and X to communicate with your community. You likely use video calls to coordinate with other founders or to pitch VCs. AI now allows bad actors to synthesize voices and faces with terrifying accuracy. We have already seen reports of employees at major firms being tricked into transferring millions by what they thought was their CEO on a Zoom call. In crypto, where transactions are irreversible, this is a nightmare scenario.

Why Builders Should Care

Most developers think security is just about preventing reentrancy attacks or flash loan exploits. Those are technical failures. But the next wave of failures will be social. If a hacker can use AI to impersonate a lead developer and convince a junior dev to push a malicious update to a front-end, the underlying smart contract might be perfectly secure, but the users still lose everything.

This shifts the burden of responsibility. As a founder, you can no longer just say your contracts were audited by a top-tier firm. You have to ask yourself: how robust is our operational security against synthetic identity fraud? If my face and voice can be cloned, how does my team verify that a high-stakes command is actually coming from me?

The Scalability of Malice

The real danger Coates highlights is scale. In the past, a scammer had to manually chat with a victim to build trust. It was a one-to-one ratio of effort to potential reward. AI changes that math. A single attacker can now run a thousand personalized, high-fidelity scams simultaneously. They can scrape your social media, learn your speech patterns, and deploy a bot that sounds exactly like you to thousands of your followers.

On a high-throughput chain like Solana, where speed is the primary feature, this creates a velocity problem. When transactions happen in milliseconds and the community moves at the speed of light, there is very little time for a user to pause and wonder if the person they are interacting with is a hallucination created by a GPU farm.

Building for a Post-Trust World

We often use the term trustless in crypto, but that is a misnomer. We trust the math, we trust the consensus, and we trust the interfaces. Coates is essentially saying that we need to start building as if we can't trust our own eyes and ears. This means leaning harder into multi-signature requirements for even minor operational changes. It means establishing out-of-band communication protocols that don't rely on the standard web2 stack.

For builders, this might feel like friction. It slows things down. But the alternative is a total collapse of user confidence. If the average user can't tell the difference between an official foundation announcement and an AI-generated lure, the ecosystem becomes a playground for predators rather than a platform for innovation.

Practical Steps for Founders

Start by auditing your internal communications. Do you have a process for verifying identity that isn't just seeing a name on a screen? If not, you are vulnerable. Consider moving away from single-point-of-failure management. If one person’s identity being compromised can drain a treasury or compromise a front-end, you aren't decentralized; you are just a target.

Second, educate your community without the hype. Don't just tell them to stay safe. Show them how to verify signatures and how to use hardware wallets that provide a physical layer of security that AI cannot touch. The physical world is becoming our best defense against the digital deception of AI.

The Takeaway

The appointment of someone like Michael Coates suggests the Solana Foundation is waking up to the reality that blockchain security is now a subset of the broader AI arms race. The technical vulnerabilities are being patched, but the human vulnerabilities are being scaled by large language models. The founders who survive the next few years will be the ones who treat identity as a cryptographic problem, not a social one.

Read the original at CoinDesk →