Bitcoin security debate turns to AI phishing after CZ’s warning

Binance founder Changpeng Zhao has warned that artificial intelligence can harm Bitcoin users through leaked personal data and social engineering without breaking the cryptocurrency’s cryptography, according to posts from CoinMarketCap and Bitcoin Archive.

CoinMarketCap described Zhao’s warning as a concern about more advanced phishing enabled by exposed information, while Bitcoin Archive attributed to him a claim that banks rely on weaker encryption than Bitcoin. Neither post in the screenshot provides the algorithms, key lengths, or bank systems needed to check that comparison.

LATEST: 🚨 CZ says AI doesn’t need to crack Bitcoin’s encryption to cause damage, warning that leaked data already enables more advanced phishing and social engineering attacks. pic.twitter.com/elSMeeBePL

— CoinMarketCap (@CoinMarketCap) October 23, 2026

FBI guidance documents AI-assisted financial deception

The FBI’s December 2024 warning describes criminals using generative AI to make fraud more convincing and reach potential victims with less effort. Its examples include fake cryptocurrency investment websites, fabricated social media profiles, and chatbots that direct visitors toward malicious links.

Criminals can use generated text and translations to remove spelling and grammar mistakes that might otherwise expose a scam, the agency said. Its guidance describes synthetic images used for false identities and fraudulent identification documents, alongside video calls impersonating executives or other authority figures.

The FBI warned that cloned audio can imitate relatives seeking emergency payments or be used to impersonate bank customers. Such examples concern deception and identity abuse; the advisory does not report AI breaking Bitcoin’s cryptographic protections.

For households, the agency recommends agreeing on a private word or phrase to check a relative’s identity. It advises limiting publicly available personal images and voice recordings that criminals could use to create convincing impersonations.

Bitcoin security claims require a specific comparison

OWASP’s Application Security Verification Standard lists cryptographic strength by algorithm and key size, using a comparison table drawn from guidance issued by the US National Institute of Standards and Technology. The table places AES-128, 3,072-bit RSA and elliptic-curve cryptography using keys of 256 to 383 bits in the same 128-bit security category.

OWASP’s framework does not rank banks and Bitcoin as two uniform systems. Its guidance calls for organizations to identify and document their cryptographic assets, including algorithms, keys, and certificates, and assess them as cryptographic research and requirements change.

The bank comparison attributed to Zhao remains an assertion without that system-level evidence. The two posts do not identify a bank, describe a cryptographic weakness, or document an AI attack that recovered a Bitcoin private key.

Quantum computing presents a separate technical question in NIST’s published guidance. In August 2024, the agency finalized three post-quantum standards intended to protect electronic information against attacks from sufficiently capable quantum computers. Its announcement describes machines that operate differently from conventional computers and could defeat widely used cryptographic methods.

NIST said the standards cover general encryption and digital signatures, with applications ranging from confidential communications to online commerce. The agency encouraged administrators to begin integrating the standards because deployment takes time.

Coinbase disclosed how stolen records supported impersonation

A US exchange has documented a customer-data attack with a similar mechanism. In May 2025, Coinbase said criminals bribed overseas support personnel to obtain information they could use while pretending to represent the company, as crypto.news previously reported in its account of the customer data breach.

Coinbase’s own disclosure listed contact details, government identification images, masked financial identifiers and account information among the stolen records. The company said the attackers did not obtain private keys or login credentials, and the stolen access did not itself allow them to move customer funds.

The exchange rejected a ransom demand and announced a matching $20 million bounty for information leading to the attackers’ arrest and conviction. Its disclosure described safeguards including extra identity checks on large withdrawals and scam warnings for flagged accounts.

Coinbase said its voluntary reimbursement covered retail customers who sent funds to the scammer as a direct result of the incident before the announcement, subject to review. The disclosure did not establish that AI was used in those attacks.

Ledger phishing pages sought wallet recovery phrases

Hardware-wallet users have faced impersonation through search advertising. A Sep. 25 investigation by Zscaler, covered in an Oct. 11 article about fake Ledger websites, described fraudulent Google advertisements leading users toward a counterfeit wallet interface.

Zscaler documented a campaign it analyzed in August, with redirects passing through Google Cloud Storage and Vercel before displaying a phishing page hosted through Google Sites. Researchers observed redirect addresses changing every 15 to 20 minutes.

The fake verification process asked visitors for their recovery phrases, which attackers could use to access wallets without possessing the physical devices, the researchers said. Zscaler’s account described credential theft and did not establish AI involvement in the campaign.

Ledger’s own campaign warnings describe physical letters that ask recipients to scan a QR code or visit a website before entering their 24 recovery words. The company says anyone holding that phrase can access the accounts created from it, and warns users never to enter it into a computer.

The wallet maker’s guidance says it does not send emails asking customers to update device firmware, enable two-factor authentication, or take similar steps. Its warning page includes examples of fraudulent letters and emails used to solicit recovery information.