Solana co-founder Anatoly Yakovenko says phishing and social engineering pose a more immediate danger to crypto users than attacks on cryptographic math or hypothetical quantum threats. His proposed defenses, a dedicated iOS device with Apple’s Lockdown Mode and a multisignature wallet, can add protection. They cannot make anyone immune to deception.
- Phishing targets people and their decisions, not just software.
- Lockdown Mode and multisig address different risks. Neither is a complete solution.
- Reported theft figures count incidents, victims and money lost separately.
The human route around strong cryptography
Phishing is an attempt to trick someone into revealing sensitive information or taking an action that puts an account or its assets at risk. Social engineering is the broader tactic of manipulating someone into sharing access, running malicious software or approving a transaction.
Yakovenko made the point in a post on X, describing the immediate threat as “not AI breaking math or quantum computers.” The distinction matters in practice. A blockchain can accept a valid signature without knowing that the person behind it was deceived.
The risk affects individuals and organizations, though their threat models differ. A personal-wallet scam might persuade someone to connect a wallet or sign a transaction. An attack on an exchange might target employee devices, credentials or systems used to approve and process transactions. Both can exploit human decisions, but the safeguards are not interchangeable. A sophisticated Zoom phishing attack against a crypto co-founder shows how these schemes can target individuals.
What Lockdown Mode and multisig can do
Yakovenko recommends combining a dedicated iOS device running Apple’s Lockdown Mode with a multisignature, or multisig, wallet. Each measure addresses a different layer of risk.
Apple describes Lockdown Mode as an optional protection for people at risk of highly sophisticated, targeted attacks, including mercenary spyware. It restricts some apps, websites and device features. Most message attachment types are blocked, links and link previews are unavailable in Messages, and some web technologies are limited. Ordinary phone calls and plain text messages still work.
Lockdown Mode cannot stop someone from being talked into revealing a secret or approving a malicious transaction. Apple advises users to update their devices before turning it on. On an iPhone, the setting is under Settings → Privacy & Security → Lockdown Mode. The phone must restart to activate the feature. Excluding websites, apps or contacts reduces its protection.
A multisig wallet requires approvals from multiple signing keys before a transaction can proceed. In a two-of-three setup, for example, two of the three keys must approve. This can limit the damage if one key is lost or one device is compromised.
But multisig is no guarantee. If an attacker compromises enough keys to meet the threshold, or persuades enough signers to approve the same harmful transaction, the wallet can still be drained. A dedicated device and multiple signers raise the bar, but users still need to check what they are authorizing.
Exchange incidents are a different security problem
Binance has described an intrusion involving an engineer’s work environment and access to wallet-signing operations. The company said an engineer was approached through a legitimate recruitment platform by people posing as representatives of a fictitious company. The engineer downloaded an assignment repository, where malicious code allegedly replaced the legitimate pyenv development tool with a compromised version. Binance also said that on Oct. 20, an attacker used the infected computer and an internal AI tool to compromise two wallet engineers’ computers. One contained a deployment credential that was later used to reach wallet-signing operations. The year associated with these dates is not specified in the available account. Similar concerns about employee-targeted deception arose in the Coinbase social-engineering incident.
Other descriptions offer a less detailed, preliminary account involving a compromised DevOps laptop and access to a service container used to submit unauthorized withdrawal transactions. These accounts do not establish one definitive sequence, so the precise route into Binance’s systems remains unclear.
Binance reported $6.34 billion in affected assets following an attack dated Oct. 29. That figure is not a confirmed amount permanently stolen. “Affected assets” does not, by itself, say what was transferred, frozen, recovered or ultimately lost. The year and the full scope of the figure are not specified in the available account.
Binance said attackers used Ethereum’s EIP-7702 feature to establish malicious permissions involving its hot wallet Binance 14. In plain terms, EIP-7702 lets an externally owned account, which is normally controlled directly by a private key, delegate certain behavior to code. According to the reported account, those permissions enabled a sweeper contract to move assets. The account also says automated deposit sweepers kept sending funds to the affected wallet, where they could be drained again.
This description does not show that Ethereum’s cryptography was broken or that EIP-7702 itself had a flaw. It points instead to the risks of compromised signing authority and operational processes. The technical claims and incident sequence should be treated cautiously while details remain unsettled.
Mercado Bitcoin separately suspended deposits and withdrawals after detecting a breach on Nov. 2. The year is not specified in the available account. Tether CEO Paolo Ardoino said Tether froze 4.5 million USDT connected to the breach. Mercado Bitcoin said it contained the incident, customers suffered no harm and no data breach occurred. The company also said its teams were tracking assets and coordinating with authorities.
Personal-wallet theft: incidents are not victims
Chainalysis reported 158, 000 personal-wallet theft incidents in 2025, affecting at least 80, 000 unique victims. Losses totaled $713 million, down from $1.5 billion in 2024. Chainalysis said personal-wallet compromises accounted for 20% of the value stolen in 2025.
These figures measure different things. One person may experience multiple incidents, and an incident count is not the same as a dollar-loss total. Chainalysis identified roughly 26, 500 victims on Solana, the highest absolute count in its analysis. After adjusting for active personal wallets, though, it found lower victimization rates on Solana and Base than on Ethereum and Tron, which had the highest rates. Absolute counts and wallet-adjusted rates answer different questions. Neither alone shows the risk faced by a particular user.
Chainalysis also said attacks on centralized services often targeted private-key infrastructure and signing processes, including attempts to trick authorized signers into approving malicious transactions. This is related to personal-wallet phishing, but the problems differ. One concerns individuals and their wallets. The other can involve employees, internal systems and automated operations.
Scams can start long before a wallet is connected
An FBI warning dated June 15 described investment scams that can begin with unsolicited messages, false professional identities or romantic approaches. Victims may be directed to trading apps or websites that display fictitious returns. The year of the warning is not specified in the available account.
The FBI advises people to verify unfamiliar contacts independently and avoid links or attachments in unsolicited messages. Anyone reporting a scam should preserve communications, platform details and wallet addresses used in the scheme. A convincing interface and a rising balance on a screen do not prove that real funds exist, or that withdrawals will be allowed.
Key questions and answers
-
What threat does Yakovenko identify as most pressing for crypto users?
Phishing and social engineering, which try to deceive people into exposing access or approving actions.
-
What security setup does he recommend?
A dedicated iOS device with Apple’s Lockdown Mode, paired with a multisignature wallet. The two measures address different risks and do not guarantee safety.
-
Does Binance’s $6.34 billion figure mean that amount was permanently lost?
No. The figure refers to affected assets and does not establish how much was stolen, frozen, recovered or ultimately lost.
-
Was EIP-7702 itself hacked?
The reported account says attackers used EIP-7702 permissions. It does not establish a break in Ethereum’s cryptography or a flaw in the feature. The precise incident sequence remains unclear.
-
How many personal-wallet theft incidents did Chainalysis report for 2025?
Chainalysis reported 158, 000 incidents, at least 80, 000 unique victims and $713 million in losses. These are separate measures, not interchangeable totals.
Before approving a transaction, verify who or what is requesting it, and check what the transaction authorizes. Use separate devices and signers where practical. Treat unexpected links, files and job assignments as possible attack paths. Better security can make deception harder, but it cannot replace scrutiny.
