Binance Founder CZ Makes Shocking Claim About AI Hacking: “No Crypto Wallet Is 100% Safe”

The comments followed two X posts in which CZ discussed the limits of digital security and AI risks, highlighting phishing and social engineering as potential threats to crypto holders.

On October 23, Zhao challenged concerns that artificial intelligence could directly compromise Bitcoin’s cryptographic protections. He argued that fears about AI hacking cryptocurrency networks overlook the risks facing traditional internet and financial systems.

AI can threaten crypto holders through sophisticated phishing and social engineering attacks that exploit leaked personal data without compromising core cryptography. Source: @cz_binance via X

“Everyone worried about AI hacking crypto, but the internet and banking systems rely on weaker encryption,” CZ wrote.

He also explained how attackers could exploit AI without having to defeat the cryptography protecting digital assets. “AI doesn’t need to break Bitcoin’s cryptography to cause damage; leaked data already enables more phishing, social engineering, etc.,” he added, ending the post with “Stay SAFU.”

The distinction is important. AI-assisted attacks can use personal information exposed through data breaches to create convincing messages, impersonate trusted contacts, or imitate legitimate customer-support teams. A victim who follows a fraudulent link or reveals a wallet recovery phrase can lose funds even when the underlying blockchain and its cryptographic systems remain uncompromised.

Zhao’s comparison between crypto encryption and the protections used by banks and internet services should not be treated as a universal technical assessment. Security depends on the specific algorithms, implementations, account safeguards, and methods used to protect sensitive information.

Zhao’s warning comes amid two separate hardware-wallet security incidents reported in 2026. The cases illustrate how cryptocurrency can be stolen through weaknesses in a device’s supply chain or software, rather than through a direct attack on a blockchain’s cryptographic foundations.

CryptoBilis faces scrutiny after researchers linked a hardware wallet incident to over $90 million in crypto losses. Source: Bloomberg via X

In October, Ledger investigated cryptocurrency thefts linked to devices sold through CryptoBilis, a Southeast Asian reseller. Blockchain analytics firms estimated that the incident involved approximately $93 million to $95 million in stolen assets, although the figures were not confirmed as a final loss total by Ledger.

Ledger confirmed finding an unauthorized hardware implant in at least one affected device. Reports indicated that the tampered hardware could capture users’ recovery phrases during setup and transmit the information to attackers. Tether subsequently froze $10 million in USDT linked to the thefts, according to published reports.

A separate incident involving Coldcard Bitcoin hardware wallets demonstrated a different type of vulnerability. A flaw in seed generation affected certain devices and reduced the randomness protecting wallet keys, potentially making affected wallets vulnerable to brute-force attacks.

TRM Labs reported in August that the exploit had drained approximately 1,816 BTC, worth about $116 million at the time, from more than 5,200 addresses. The vulnerability originated in older firmware, meaning that installing an update alone would not repair recovery phrases generated under the affected conditions.

Neither incident establishes that AI cracked Bitcoin’s cryptography. Instead, they show how implementation errors, compromised hardware, and weaknesses in wallet setup can expose assets even when users choose tools designed for offline storage.

On October 22, Zhao published a broader security reminder stating, “No crypto wallet is 100% safe. No software is bug-free. No tech is 100% secure.”

He also noted that risk exists in both action and inaction, urging users to stay informed, manage risk, and address problems as they arise. The message reflects an important distinction in cryptocurrency security: controlling private keys directly removes reliance on an exchange for custody, but it also places greater responsibility on the wallet owner.

CZ issued a crypto security warning amid reported 2026 hardware wallet incidents involving a Ledger supply-chain attack and a Coldcard firmware flaw, highlighting risks beyond core cryptography. Source: @cz_binance via X

A self-custody wallet does not store cryptocurrency in the same way a physical wallet holds cash. Instead, it manages the private keys or recovery information required to authorize transactions recorded on the blockchain. Anyone who obtains the necessary credentials may be able to transfer the assets, and blockchain transactions generally cannot be reversed simply because a user was deceived.

Hardware wallets can reduce exposure to internet-connected devices, but they are not immune to manufacturing defects, compromised distribution channels, or flawed software. Similarly, software wallets can be affected by malicious applications, device malware, and stolen credentials. The appropriate level of protection depends on how the wallet is created, stored, accessed, and maintained.

Using a centralized exchange introduces a different set of trade-offs. Customers rely on the platform’s custody controls and operational security, while self-custody gives users direct control but requires them to protect their own keys and backups. Neither approach eliminates every form of risk.

Zhao’s warning points to practical precautions rather than a guarantee of perfect security. Users should treat unexpected messages, urgent account warnings and unsolicited requests to verify a wallet with caution, even when the communication appears professionally written or refers to personal details.

Recovery phrases and private keys should never be shared with another person, entered into an unfamiliar website, or sent through email and messaging services. Users should also verify official website addresses, avoid installing wallet applications from untrusted sources, and consider phishing-resistant authentication methods, including compatible hardware security keys, for accounts that support them.

Hardware-wallet buyers should use the manufacturer’s official store or a trusted, authorized distributor and inspect devices for signs of tampering. If a device or recovery phrase may have been compromised, simply updating its software may not be sufficient. Moving assets to a wallet created with a new, secure recovery phrase may be necessary, provided the transfer is carried out safely.

Regularly reviewing security guidance and keeping devices updated can help reduce exposure to known vulnerabilities. However, users should understand what an update fixes and whether existing keys or recovery phrases remain at risk.

CZ’s central message is that cryptocurrency security requires ongoing attention, not blind confidence in a particular device or technology. As AI tools become more capable, the immediate concern for many holders may be increasingly convincing fraud and the exploitation of personal information, rather than an attacker directly breaking blockchain encryption.