Changpeng Zhao, the founder of Binance, has cautioned cryptocurrency holders about the increasing threat of AI-enabled phishing and social engineering attacks. Zhao emphasized that the focus is not on breaking Bitcoin’s encryption but rather on the risks posed by personal data leaks targeting users.
AI Heightens Phishing Threat Concerns
On October 23, Zhao took to social media to argue that fears of AI transcending the core encryption frameworks of crypto networks are exaggerated. He pointed out a nearer threat: cybercriminals exploiting data leaks from the internet and financial systems to devise more convincing traps.
“Everyone worries about AI hacking crypto, but the internet and banking systems rely on weaker encryption.”
Zhao stressed that AI does not need to break Bitcoin’s cryptography to cause harm. Leaked data can be misused to create fake support teams, impersonate trusted individuals, and craft personalized messages. Users duped into sharing their recovery phrases or clicking on scam links could suffer asset loss, even if the blockchain remains secure.
Hardware Wallet Incidents Highlight Security Risks
Zhao’s warning follows two separate hardware wallet incidents reported in 2026. These cases revealed that cryptocurrency assets could be stolen through supply chain vulnerabilities or software flaws, without breaking blockchain encryption.
In October, Ledger began probing thefts linked to devices sold through vendor CryptoBilis in Southeast Asia. Blockchain analysis firms estimated losses between $93 million and $95 million in this case. Ledger identified unauthorized hardware components in at least one affected device that could relay recovery phrases to attackers during setup. Tether subsequently froze $10 million USDT linked to the incident.
Another issue surfaced with Coldcard Bitcoin hardware wallets, where a vulnerability in seed generation reduced key randomness, exposing wallets to brute-force attacks. TRM Labs reported that more than 1,816 BTC was drained from over 5,200 addresses, equating to approximately $116 million at the time.
“No crypto wallet is 100% secure. No software is flawless. No technology is foolproof.”
Risks Persist in Custodial and Non-Custodial Models
On October 22, Zhao remarked that risks endure even when cryptocurrencies remain idle. The self-custody model, where users control their private keys directly, reduces reliance on exchange custody but also places the onus of security on the user.
While hardware wallets can enhance protection compared to internet-connected devices, they are not immune to manufacturing errors, supply chain interferences, or faulty software. Software wallets remain vulnerable to malicious apps, device malware, and stolen credentials. Centralized exchanges offer a different balance, where users trust the platform’s custody and operational security.
Security Best Practices Reinforced for Users
Zhao advised skepticism towards unexpected messages, urgent transaction requests, and wallet verification demands. He highlighted the importance of not sharing recovery phrases or private keys, avoiding unfamiliar websites, and downloading only verified apps.
When purchasing hardware wallets, users should choose from the manufacturer’s official store or authorized distribution channels, inspect devices for signs of tampering, and not rely solely on software updates in case of suspected breach. Instead, assets might need to be transferred to a new wallet generated with a secure recovery phrase.
