How AI Is Reshaping Crypto Security, with Michael Coates

What it is

An interview (Bits to Bricks podcast) with Solana Foundation CISO Michael Coates, structured around the July 2026 Coldcard drain. The mechanism, entropy collapse, and named threats (deepfakes, YubiKeys, Anthropic's Nov 2025 Claude espionage disclosure, STRIDE) are already in the summary. What it adds is concrete defensive practice the summary compresses to two nouns.

What to do

Coates's practical prescriptions, beyond "use multi-sig / use a YubiKey":

• Multi-sig topology, not just multi-sig. Concretely 2-of-3 or 3-of-5, with keys on different hardware held by different people. This is what removes the single point of failure and defangs the wrench attack (no single holder can move everything).
• For non-experts, three fallbacks that keep the property without teaching everyone to co-sign: a trusted broker as one signer (e.g. an educated spouse); geographic spread (one device in a safe deposit box across town); and keeping a single-signer wallet for small everyday amounts.
• Don't ignore the endpoint. People go deep on cold storage and multi-sig, then never ask whether the machine in front of them runs antivirus or an updated OS.
• Weigh manufacturer pedigree when choosing hardware — a small well-meaning team misses what a vendor with budget for layered testing catches. Never trust a single review.
• Circuit breakers: code that trips on its own when something goes wrong, the model Coates wants for DeFi (alongside STRIDE, launched April 2026), borrowed from aviation/critical infrastructure.

Caveats

This is an opinion/interview piece — no CVE, patch version, or detection query. Self-custody advice comes with Coates's own qualifier: it only works "if you really know what you're doing," because there is no recourse when it fails.