The Coming Deepfake Onslaught Has This Crypto Security Exec Extra Worried

Lunglhofer laments that convenience is often the enemy of security and that, in both crypto and traditional finance, people embrace any tool that will let them move money faster.

Cybersecurity chief Chris Lunglhofer has spent decades preparing for the worst-case scenarios in the world of finance. But even he’s surprised by the latest threat.

“I never thought deepfakes would be used for crypto scams,” Lunglhofer, who is now head of cybersecurity at crypto exchange Coinbase, told me at the sidelines of Consensus.

Those scams have already arrived. There are now videos circulating that feature the voice and image of crypto CEOs like Coinbase’s Brian Armstrong and Ripple’s Brad Garlinghouse promising to give away free tokens. The videos are designed to trick viewers into visiting scam websites and entering their crypto wallet details.

Lunglhofer said he’s spoken with several crypto CEOs who have been targeted by deepfakes, and none of them were aware of the scams until Lunglhofer alerted them.

“They’re all like, ‘What the f*ck is going on?'” Lunglhofer said.

The scams are particularly effective because they often slip past the defenses of major online platforms like YouTube. The videos don’t contain any illicit content like terrorism or nudity, which the platforms make the most effort to detect. And they don’t feature the crypto CEOs saying anything that could be easily flagged as a scam, like promising guaranteed returns on crypto investments.

“Most of the time, the videos feature the crypto CEO saying something like, ‘We’re going to be giving away some tokens today,'” Lunglhofer said. “There’s nothing inherently scammy about that statement, so it doesn’t get flagged.”

Lunglhofer said he’s reported several of the deepfake scams to YouTube, but the videos are still live.

“I don’t think they’re being malicious,” Lunglhofer said. “I just don’t think they’re paying attention to this type of scam.”

The scams are also concerning because the quality of deepfakes is getting better every month, which will make them both more convincing and harder to detect.

“This is going to be a huge problem in the coming months,” Lunglhofer said.

In response to this coming onslaught, and to the problem of scams in general, Lunglhofer has a recommendation that goes beyond staying vigilant: If you are moving money, slow down.

“Most people want to move money as quickly as possible, and that’s putting them at risk,” Lunglhofer said. “If you’re moving a lot of money, use a tool like a vault or a multi-sig signing protocol that has a cooling off period before the money can move. And for smaller everyday transactions, use a passkey.”

Passkeys are a security feature offered by Apple, Google, and others that generates a security token on a person’s device that can’t be replicated or transferred. The token is then used to authenticate a person’s identity when they log into an app or website.

“Passkeys are a huge improvement over passwords, and they’re also much more secure than SMS authentication,” Lunglhofer said. “And not surprisingly, I’m also seeing a lot of crypto exchanges adding SMS authentication as an option, which is mind-boggling.”

Lunglhofer said he’s spoken with several executives at crypto exchanges who are unaware that SMS authentication is inherently insecure, and that it was never designed to be a security feature in the first place.

“It’s amazing how little some of these executives know about cybersecurity,” Lunglhofer said.

The bottom line is that setting up passkeys or adding other layers of security might take a minute of your time but, as cyber threats get scarier, the protection is more valuable than ever.