Binance founder Changpeng Zhao has issued a stark security warning for crypto holders, arguing that no crypto wallet is completely safe and that artificial intelligence is more likely to enable phishing and social engineering than to break blockchain cryptography.
In posts on X on October 22 and 23, Zhao pushed back against fears that AI could directly compromise Bitcoin’s cryptographic protections. “Everyone worried about AI hacking crypto, but the internet and banking systems rely on weaker encryption,” he wrote. He added that attackers using AI do not need to defeat cryptography because leaked personal data already enables more sophisticated phishing and social engineering, ending with “Stay SAFU.”
The warning followed two major hardware wallet incidents in 2026. In October, Ledger investigated thefts linked to devices sold through Southeast Asian reseller CryptoBilis, with blockchain analytics firms estimating $93 million to $95 million in stolen assets. Ledger confirmed finding an unauthorized hardware implant in at least one affected device, and reports said tampered hardware could capture recovery phrases during setup. Tether subsequently froze $10 million in USDT tied to the thefts.
A separate incident involving Coldcard Bitcoin hardware wallets stemmed from a flaw in seed generation in older firmware. This reduced the randomness protecting wallet keys, potentially enabling brute-force attacks. TRM Labs reported in August that the exploit drained approximately 1,816 BTC, worth about $116 million at the time, from more than 5,200 addresses. Installing an update alone would not repair compromised recovery phrases generated under the affected conditions.
Zhao summarized the broader lesson: “No crypto wallet is 100% safe. No software is bug-free. No tech is 100% secure.” He said self-custody removes reliance on exchange custody but places greater responsibility on the wallet owner. Hardware wallets can reduce internet exposure, but remain vulnerable to manufacturing defects, compromised distribution channels, or flawed software. Centralized exchanges introduce different custody trade-offs; neither approach eliminates every risk.
To reduce risk, Zhao and security guidance advise users to treat urgent messages and unsolicited wallet-verification requests with caution, never share recovery phrases or private keys, verify official sites, avoid untrusted wallet apps, and buy hardware wallets only from official or trusted distributors. If a device or recovery phrase may be compromised, updating software may not be enough; moving assets to a wallet created with a new, secure recovery phrase may be necessary.
