Binance's CZ says AI crypto hacking fears are overblown, points to phishing risk
In brief
- CZ argued on X on October 23 that fears of AI hacking crypto are overblown.
- AI can still cause damage through leaked data, phishing and social engineering, he said.
- Crypto's cryptography isn't the weak link, in his view; legacy bank systems would be softer targets.
- On October 22, CZ flagged PHP flaws CVE-2026-109618 and CVE-2026-109619, linked to PHP2Shell.
Encryption isn't the weak link, CZ argues
CZ's core point, as Crypto Briefing reported, was that AI doesn't need to defeat crypto's encryption to have an impact. In his view, the cryptography protecting crypto systems isn't the weak link.
He went further. CZ noted that systems used by banks and the broader internet often rely on weaker encryption standards than those found in crypto, and he argued that if AI-driven code-breaking ever became a serious threat, legacy systems with older protections would be the softer target.
The risk he pointed to sits with the human layer (leaked data, phishing and social engineering).
Two PHP flaws flagged a day earlier
On October 22, CZ flagged a pair of PHP vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. According to Crypto Briefing, the flaws could allow remote code execution on servers that haven't been patched, and the disclosures were linked to an exploit referred to as PHP2Shell.
PHP is a programming language that powers a large share of web servers. That's why it matters. Crypto Briefing characterized CZ's warning as a nudge for anyone running affected infrastructure to update quickly.
Crypto Briefing: the web layer carries the same risks
The outlet's own analysis went beyond CZ's posts. It noted that crypto platforms sit on top of web servers, front-end code and third-party software that can carry the same vulnerabilities as any other website, and it wrote that AI improves phishing tactics.
"Scam messages that once gave themselves away with clumsy grammar can now read like they came from a real colleague." (Crypto Briefing)
CZ's statements weren't tied to any specific token or event, per the report. They were general observations about where the threat sits, not a call on any particular project.
Frequently asked questions
Why does CZ think fears about AI hacking crypto are overblown?
In an October 23 post on X, CZ argued that the cryptography protecting crypto systems isn't the weak link. He noted that banks and the broader internet often rely on weaker encryption, so legacy systems would be the softer target if AI code-breaking became a serious threat.
What risks from AI did CZ say are still real?
CZ added a caveat to his post, saying AI could still cause real damage through leaked data, smarter phishing and social engineering. His core point was that AI doesn't need to defeat crypto's encryption to have an impact.
Which PHP vulnerabilities did CZ flag on October 22?
CZ flagged two PHP vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619, according to Crypto Briefing. The flaws could allow remote code execution on unpatched servers, and the disclosures were linked to an exploit referred to as PHP2Shell.
