Solana (SOL) Co-Founder Yakovenko Recommends Lockdown Mode Phone to Beat Phishing

Deception Over Code-Breaking

Solana (SOL) co-founder Anatoly Yakovenko has placed phishing and social engineering at the top of the risk list for cryptocurrency holders, arguing that the gravest danger is not a technical breakthrough but a convincing message. In a post on X, he wrote that the most pressing threat comes from deceiving people, “not AI breaking math or quantum computers.” The warning concerns security rather than the Solana (SOL) price, but it comes from the network's most prominent engineer, and it lands as Solana ecosystem security is under repeated scrutiny. His proposed defense is deliberately low-cost: a dedicated iPhone running Apple's Lockdown Mode, paired with a multisignature wallet that needs more than one approval before any transaction moves. Lockdown Mode is an optional Apple protection built for people who could face highly sophisticated targeted attacks, including mercenary spyware; enabling it restricts apps, websites and device features to reduce potential entry points. Once active, it blocks most message attachment types, removes links and link previews in Messages, restricts certain web technologies and refuses new configuration profiles. Apple documents the setting under Settings, Privacy & Security and requires a restart to activate it, while cautioning that excluding specific websites, apps or contacts weakens the protection. Ordinary calls and plain text messages keep working. The multisig half works differently: Squads' documentation describes a configurable threshold, so a two-of-three arrangement needs approval from two of three signing keys before anything executes. For users weighing custody options, our ranked comparison of the best Solana wallets covers setups across this range. Yakovenko did not present the pairing as foolproof; he framed it as a practical, low-cost baseline against an attacker who needs only one successful deception.

Binance and Mercado Bitcoin Breaches

The warning follows two exchange security incidents inside a week. Binance disclosed $6.34 billion in affected assets after an Oct. 29 attack, and its account of the intrusion describes a months-long operation built on employee deception, malicious development software and stolen credentials. The chain began in September, when an engineer was approached through a legitimate recruitment platform and interviewed by people posing as staff of a fictitious company. He downloaded an assignment repository onto a work computer, and code that ran during setup replaced the pyenv development tool with a compromised version. On Oct. 20 the attacker used that infected machine and an internal AI tool to compromise the computers of two wallet engineers, one of which held a deployment credential that later reached wallet signing operations. The exchange said the attacker then abused Ethereum's EIP-7702 feature to establish malicious permissions that kept working after ordinary withdrawals were suspended, extending control over the hot wallet known as Binance 14. On Nov. 2, Mercado Bitcoin suspended deposits and withdrawals after detecting a breach of its own. Tether CEO Paolo Ardoino confirmed the issuer froze 4.5 million USDT connected to the incident, and the exchange states that it contained the event, that customers suffered no harm and that no data breach occurred, while its teams track assets and coordinate with authorities. Thefts from individuals make up the other side of the ledger: Chainalysis research recorded 158,000 personal wallet theft incidents during 2025, with at least 80,000 unique victims and $713 million in losses, down from $1.5 billion in 2024 even as the incident count rose. Personal wallet compromises accounted for 20% of the value stolen that year. Roughly 26,500 of the victims were Solana (SOL) users, the largest absolute count identified, though rates adjusted for active personal wallets were lower on Solana and Base than on Ethereum and Tron. In the United States, a June 15 FBI warning described investment scams that open with unsolicited messages, false professional identities or romantic approaches and steer victims toward trading applications and websites displaying fictitious returns.

One Playbook From Engineer to Exchange

The reading here is that the same playbook worked at every scale above, from one engineer's machine to a national exchange, which is why Yakovenko's advice targets the human entry point rather than the code. Chainalysis found that attacks against centralized services frequently went after private key infrastructure and signing processes, including attempts to trick legitimate signers into approving malicious transactions, and Tether's freeze shows stolen funds can be intercepted before they reach a crypto mixer. Recent Solana (SOL) episodes fit the pattern, from a malicious SKR claim app removed from the Solana Mobile store to a validator advisory over CVE-2026-98432. Better tooling, whether a multisig or an AI crypto wallet, still ends at a human approval step. What remains unconfirmed is Mercado Bitcoin's claim that no customer suffered harm; nobody outside the exchange has verified it yet.