Solana co-founder Anatoly Yakovenko has warned that phishing and social engineering pose the biggest threat to crypto users, recommending a dedicated iOS device in Lockdown Mode paired with a multisignature wallet as a low-cost security setup.
Summary
- Yakovenko named phishing and social engineering as the main threats facing people holding cryptocurrency.
- His suggested setup combines a dedicated iOS device, Apple’s Lockdown Mode, and a multisignature wallet.
- Binance says fake interviews and compromised developer software helped attackers reach its wallet signing systems.
- Chainalysis recorded $713 million in personal wallet theft during 2025, affecting at least 80,000 victims.
According to Yakovenko’s post on X, the most pressing danger comes from deceiving people, “not AI breaking math or quantum computers.”
His comments follow two major exchange security incidents within days of each other. Binance reported $6.34 billion in affected assets after its Oct. 29 attack, while Mercado Bitcoin suspended deposits and withdrawals after detecting a breach on Nov. 2.
Binance describes how fake interviews reached wallet systems
Binance’s account of its attack describes a months-long operation involving employee deception, malicious development software and stolen credentials.
As crypto.news previously reported, the exchange traced part of the intrusion to fake job interviews in September. An engineer was approached through a legitimate recruitment platform and interviewed by people posing as representatives of a fictitious company.
During the process, the engineer downloaded an assignment repository onto a work computer. Binance said malicious code ran during setup and replaced the legitimate pyenv development tool with a compromised version.
On Oct. 20, the attacker used the infected computer and an internal AI tool to compromise two wallet engineers’ computers. One contained a deployment credential that was later used to reach wallet signing operations.
The exchange said attackers used Ethereum’s EIP-7702 feature to establish malicious permissions that continued working after ordinary withdrawals were suspended. Earlier findings described how those permissions gave an attacker control over Binance’s hot wallet known as Binance 14.
Lockdown Mode limits features attackers could exploit
Yakovenko’s suggested device setup uses an existing Apple security feature alongside a wallet requiring multiple approvals.
Apple describes Lockdown Mode as an optional protection for people who could face highly sophisticated targeted attacks, including mercenary spyware. Enabling it restricts apps, websites, and device features to reduce potential entry points.
Most message attachment types are blocked, while links and link previews become unavailable in Messages. Certain web technologies are restricted, and new configuration profiles cannot be installed while the mode is active.
Apple advises updating devices before enabling the feature. On an iPhone, users can find it under Settings, Privacy & Security, then Lockdown Mode, with a restart required to activate it.
A multisignature wallet applies a separate approval requirement to transactions. Squads’ documentation describes a configurable threshold specifying how many member approvals are needed before a transaction can execute. A two-of-three arrangement, for example, requires approval from two of three signing keys.
Personal wallet theft affected thousands of Solana users
Chainalysis’ theft research recorded 158,000 personal wallet theft incidents during 2025, with at least 80,000 unique victims.
Losses totaled $713 million, down from $1.5 billion in 2024 despite the higher incident count. Personal wallet compromises accounted for 20% of the value stolen in 2025.
Solana recorded roughly 26,500 victims, the largest absolute count identified in the analysis. However, Chainalysis found lower victimization rates on Solana and Base when adjusting for active personal wallets, while Ethereum and Tron had the highest rates.
The firm said attacks against centralized services frequently targeted private key infrastructure and signing processes, including attempts to trick legitimate signers into authorizing malicious transactions.
Mercado Bitcoin tracks assets as US authorities warn of deception
Following Mercado Bitcoin’s incident, Tether CEO Paolo Ardoino confirmed that the stablecoin issuer had frozen 4.5 million USDT connected to the breach.
The exchange said it contained the incident, customers suffered no harm, and no data breach occurred. Its teams were tracking assets and coordinating with authorities.
In the United States, a June 15 FBI warning described cryptocurrency investment scams beginning with unsolicited messages, false professional identities or romantic approaches. Victims were directed to trading applications and websites displaying fictitious returns.
