Solana Foundation CISO: AI Deepfakes Are Now a Bigger Crypto Threat Than Smart Contract Bugs

Michael Coates joined the Solana Foundation as Chief Information Security Officer in July 2026. Before that, he was Twitter's first-ever CISO and held a senior security role at Mozilla. In a CoinDesk interview published July 31, he offered a direct threat assessment: AI-generated impersonation of trusted contacts now poses a bigger security risk to crypto users than smart contract bugs.

The attack forms Coates named are real and active. Romance scams, pig-butchering schemes, and deepfake voice calls impersonating trusted contacts already target crypto holders. What changes with AI is the quality of the deception: a generated voice indistinguishable from a family member or colleague raises the success rate of attacks that previously seemed implausible.

Coates told CoinDesk that many high-profile crypto hacks "actually originate outside of blockchain compromises," pointing instead to credential theft, compromised accounts, and Web2-style intrusions as the path attackers most reliably use. While the Solana ecosystem maintains a strong focus on protocol-level security (the Agave 4.2 client shipped with a 50,000 SOL bug bounty), Coates argues the attack surface extends well beyond on-chain code.

Layered Defense Over User Vigilance

Coates' prescription is structural rather than behavioral. Because users cannot realistically identify every AI-generated voice call or deepfake video in real time, he says the industry needs to build security controls that protect even after someone has been deceived. His stated goal is making security that "meets users where they are" rather than demanding a level of vigilance that most people cannot sustain under pressure.

In practice, this means designing wallets, DeFi applications, and exchange flows with circuit-breakers: withdrawal delays, transaction limits, multi-party approval requirements, and recovery mechanisms that remain functional after an attacker has already obtained consent from a deceived user. The Solana Foundation's Accelerate 2025 security track covered adjacent ground on building holistic security programs that assume some attacks will succeed and design for resilience accordingly.

Post-Quantum Cryptography in Parallel

Coates is also tracking a longer-horizon threat. The Solana Foundation has evaluated post-quantum cryptography and published its own quantum-readiness strategy, positioning the network ahead of the timeline for cryptographically relevant quantum computers. That effort sits separately from the AI social engineering focus but reflects the same underlying approach: identify emerging threats before they mature and build systematic defenses rather than reactive patches.

Coates has testified before Congress on AI and cybersecurity, and when he took the CISO role he cited Solana's network footprint as central to why the security function carries genuine stakes: the network processes tens of billions of dollars in daily stablecoin volume. That volume makes it a target for sophisticated adversaries with the resources to build and operate AI-powered scam operations.

Together, the appointment and this interview signal that the Solana Foundation is treating executive-level security as a user-protection and threat-intelligence function alongside its code-quality work.