Yakovenko says phishing is crypto's biggest threat

What happened

Solana co-founder Anatoly Yakovenko said phishing and social engineering are the most serious risks facing cryptocurrency holders, according to reports from crypto.news and U.Today. In a post on X, he argued that deception poses a greater danger than artificial intelligence breaking mathematics or quantum computers undermining cryptography. He recommended a dedicated iOS device with Apple's Lockdown Mode enabled alongside a multisignature wallet, describing the combination as one of the cheapest ways for users to protect digital assets.

The comments came after two exchange incidents within days. Binance reported that its Oct. 29 attack affected $6.34 billion in assets, while Mercado Bitcoin suspended deposits and withdrawals after detecting a breach on Nov. 2. Tether CEO Paolo Ardoino confirmed that the stablecoin issuer froze 4.5 million USDT connected to the Mercado Bitcoin breach, according to crypto.news. Mercado Bitcoin said it contained the incident, customers suffered no harm and no data breach occurred.

Binance's account described a months-long operation involving employee deception, malicious development software and stolen credentials. The engineer downloaded an assignment repository onto a work computer; Binance said malicious code ran during setup and replaced the legitimate pyenv development tool with a compromised version. On Oct. 20, the attacker used the infected computer and an internal AI tool to compromise two wallet engineers' computers, one of which held a deployment credential later used to reach wallet signing operations. Binance also said attackers used Ethereum's EIP-7702 feature to create malicious permissions that continued working after ordinary withdrawals were suspended; earlier findings said those permissions gave an attacker control over the hot wallet known as Binance 14.

Why it matters

The episode highlights a practical weakness in crypto security: attackers do not need to break a blockchain's cryptography if they can persuade a person to hand over access. Phishing uses malicious emails, websites or messages to trick people into revealing sensitive information such as wallet recovery phrases or account details. Social engineering is broader, covering manipulation that leads victims to compromise their own security.

For exchanges, the risk extends beyond individual users. Chainalysis said attacks on centralized services frequently targeted private key infrastructure and signing processes, including attempts to trick legitimate signers into authorizing malicious transactions. Binance's breach shows how a single compromised employee machine can become a route into wallet signing systems.

What the data shows

Chainalysis recorded 158,000 personal wallet theft incidents in 2025, with at least 80,000 unique victims and $713 million in losses. That was down from $1.5 billion in 2024 despite a higher incident count, and personal wallet compromises accounted for 20% of the value stolen in 2025. Solana had roughly 26,500 victims, the largest absolute count in the analysis, although Chainalysis found lower victimization rates on Solana and Base when adjusting for active personal wallets; Ethereum and Tron had the highest rates.

The Security Alliance said its security team handled 99 incidents from Oct. 28 to Nov. 3. In three incidents involving fraudulent customer support calls, victims lost roughly $1.57 million and 1.12 BTC. One scam involved fake Apple support representatives stealing a victim's Apple ID credentials; the victim had stored a crypto recovery phrase in cloud storage. Another victim shared a wallet recovery phrase during a fake Telegram support call. The group tracked 5,137 phishing domains during the period.

Background

Apple describes Lockdown Mode as an optional protection for people who could face highly sophisticated targeted attacks, including mercenary spyware. It restricts apps, websites and device features to reduce potential entry points. Most message attachment types are blocked, links and link previews become unavailable in Messages, certain web technologies are restricted, and new configuration profiles cannot be installed. Apple advises updating devices before enabling it; on an iPhone, users can find it under Settings, Privacy & Security, then Lockdown Mode, with a restart required. The company warns that excluding websites, apps or contacts reduces the protections, while ordinary calls and plain text messages continue working.

A multisignature wallet applies a separate approval requirement to transactions. In the United States, a June 15 FBI warning described cryptocurrency investment scams beginning with unsolicited messages, false professional identities or romantic approaches, with victims directed to applications and websites displaying fictitious returns.

What to watch

Investigators and exchanges are still tracing assets and assessing how the incidents unfolded. Mercado Bitcoin said it was coordinating with authorities, and Binance published an investigation update. Further details may show how attackers moved funds, whether other services report related compromises, and whether exchanges change signing and employee-security practices. Yakovenko's setup is a defensive measure, not a guarantee; Apple warns that excluding websites, apps or contacts reduces Lockdown Mode's protections.

Questions readers ask