CZ says AI hacking fears in crypto are overblown, warns phishing is the real threat

Binance founder Changpeng “CZ” Zhao has a message for anyone losing sleep over AI cracking crypto’s encryption. That is probably not the problem you should be worried about.

In a post on X on October 23, 2026, CZ argued that fears about AI hacking crypto are overblown. He added a caveat: AI can still cause real damage through leaked data, smarter phishing, and social engineering.

What CZ actually said

CZ’s core point was that AI does not need to defeat crypto’s encryption to have an impact. The cryptography protecting crypto systems is not the weak link in his view.

AI makes phishing tactics better. Scam messages that once gave themselves away with clumsy grammar can now read like they came from a real colleague. When attackers pair that with personal details from old data leaks, a fake message can feel convincingly personal.

CZ also noted that systems used by banks and the broader internet often rely on weaker encryption standards than those found in crypto, arguing that if AI-driven code-breaking ever becomes a serious threat, legacy systems with older protections would be the softer target.

He signed off with a familiar catchphrase.

“Stay SAFU!”

A week of security warnings

The AI comments did not come out of nowhere. A day earlier, on October 22, CZ flagged a pair of PHP vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619.

PHP is a programming language that powers a large share of web servers. The flaws could allow remote code execution on servers that have not been patched.

The disclosures, linked to an exploit referred to as PHP2Shell, landed during a period of heightened attention to web security. CZ’s warning was a nudge for anyone running affected infrastructure to update quickly.

What this means for crypto users and builders

For everyday holders, the takeaway from CZ’s comments is practical rather than technical. That means treating unexpected messages with suspicion, especially ones that create urgency. It means verifying links before connecting a wallet. It also means assuming that some of your personal data is already circulating somewhere, and that attackers may use it to sound credible.

For builders and exchanges, the PHP warning is the more pointed lesson. Crypto platforms sit on top of web servers, front-end code, and third-party software that can carry the same vulnerabilities as any other website. A protocol can have airtight smart contracts and still get compromised through a neglected server.

His statements were general rather than tied to any token or event, so they are not the kind of news that moves prices on their own. What they do highlight is that security incidents tend to stem from operational lapses and user-targeted scams.

Disclosure: This article was edited by Diego Almada Lopez. For more information on how we create and review content, see our Editorial Policy.