Over the last few months, crypto ecosystems have had major security incidents that were not caused by smart contract vulnerabilities, but rather because of more advanced compromises, like fake identities and AI-generated scams.
Those types of vulnerabilities will drive the next wave of blockchain security concerns, according to the chief information security officer (CISO) at the Solana Foundation, Michael Coates.
“You have to do everything that a Web2 company has to do for security, and the incremental uniqueness to Web3,” Coates said in an interview with CoinDesk. “When you have adversaries that are definitely motivated and can take funds irrevocably, they are going to look for any mistake.”
Coates, who was previously the CISO at Twitter, and led security at Mozilla during the browser wars, joined the Solana Foundation earlier this year. That role means that not only is he securing the foundation itself, but he’s also working with Solana ecosystem projects to bring strong security practices to their networks and projects, and meeting with regulators to set up the right cybersecurity standards.
While exploits in crypto often grab headlines because of the sheer amount of money that gets stolen, Coates emphasized that many of these hacks actually originate outside of blockchain compromises themselves. “In many cases, it is an operational security issue or a Web2 issue that led to a key compromise,” he said.
This will only prove to be more difficult as artificial intelligence advances gives attackers better tools to exploit security practices.
“The social engineering piece is going to get a lot worse because of the power of AI and deepfakes,” Coates said. “We should expect full spoofed phone calls with voices of people that we know… there’s really no reason this won’t hyperscale.
To prevent that, Coates thinks crypto needs to come up with better systems that remain secure and work when people fall for these scams.
“You cannot fully prevent anyone from falling victim,” he said. “Eventually, you will be fooled because the cons are that good.” Organizations should thus have multiple layers of various degrees of security controls, so “when someone gets fooled, the other things take over to protect you.”
For the longer-term, the question of quantum computing largely looms on various crypto ecosystem’s futures, including that of Solana.