CISO @SolanaFndn | Cyber Investing Seven Hill Ventures - Former: CISO @Twitter, @Mozilla, @Coinlist, Chairman @OWASP, Startup Founder (Acquired)
San Francisco, CA
Joined September 2008
- Tweets7.5K
- Following2K
- Followers11.7K
- Likes4K
Pinned Tweet
Honored to testify to Homeland Security and joint session on AI, Quantum and Cybersecurity. Full info below
Excited for a fantastic @solana Breakpoint in London!
[Speaker Announcement]
Securing markets in the age of AI and quantum.
@_mwc was Twitter’s first CISO and ran security at Mozilla. In July he became Solana Foundation’s first Chief Information Security Officer. He joins us at Breakpoint in London, 15-17 November.
Michael Coates retweeted
Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified.
The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far.
Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete.
As an immediate precaution, Binance has:
- temporarily suspended deposits and withdrawals while security checks are completed;
- revoked the affected address authorisation;
- engaged law enforcement and blockchain intelligence partners to trace and recover funds.
Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.
Please rely only on official Binance channels for updates. Please feel free to contact Binance Customer Support if you have any further questions.
binance.com/en/support/annou…
Michael Coates retweeted
More Breakpoint 2026 speakers are confirmed.
Lending, trading cards, robotics, poker and tokenized bank assets, all running on Solana and all on the Breakpoint stage in London this November.
ALT Breakpoint 2026 speakers announced: Jeff Platt, Michael Weisz, Todd McDonald, George Ruhana, Jack Pearson, Tuom Holmberg, Lily Liu, Michael Coates. 15-17 November 2026, solana.com/breakpoint
Michael Coates retweeted
If you’d told me six years ago I’d be encouraging people to use Solana for payments, I probably would’ve started an argument with you 😂
Today, Polygon Open Money Stack supports Solana for end-to-end payments.
Moving all money onchain was always going to take more than one chain. That’s why we’re making it easy for businesses to bring money in from a bank, place it in the right account, move stablecoins across chains, and pay it out however they want (whether that’s via bank account, Solana, or any other chain).
@toly, @rajgokal and @solana team have built an incredible ecosystem. Excited for what we can do together.
Michael Coates retweeted
YC builders building on Solana receive $50k + support from @SolanaFndn
Apply to YC by November 2: ycombinator.com/apply
At @ycombinator, we're excited to fund more crypto startups solving financial needs including AI capital raising, stablecoins, trading, and agents.
Here's our latest crypto request for startups. Our next application deadline is Monday.
Michael Coates retweeted
Just spoke to the Head of AI at a huge company.
The #1 thing they're struggling with is... what do I do with the AI laggards at our company?
Like most companies, they’ve found that a Super Pareto Principle is true within their org. 10% of their employees are responsible for 90% of the uplift in productivity/token usage from software engineering to non-technical knowledge work.
They’ve spent a lot of time & resources on AI enablement from LLM foundations to function-specific trainings and skill building. And yet, the power law of productivity increases hasn’t budged.
So now they’re left with a few sobering thoughts and hard questions:
1) 90% of people are overpaid and 10% are underpaid
2) We’d be better off allocating tokens proportionally to the power law, but how do we do that without killing culture?
3) Significant layoffs are likely warranted and wouldn’t impact overall output, but cultural backlash is a big concern?
4) How do we hire more power law people as a non technology company?
5) Is all of our efforts on training and enablement ACTUALLY worth it?
6) How do we not experience a brain drain where the top 10% all leave because they want to be surrounded by other AI-native 10x’ers?
Normalize varsity math
Let kids excel
"during the last school year, a council of educators at both Palo Alto high schools rejected the [advanced math] course, arguing it would serve few students and set back equity and students’ well-being"
Right, math is harmful. Come on! What are we doing?
“If teaching math can harm students, then we have a lot bigger issues to talk about than whether to offer this course,” Nguyen told the Chronicle.
Indeed.
Brian Conrad, a Stanford mathematician, told the Chronicle that he felt math was treated as a “punching bag” for equity and mental health concerns.
“The school doesn’t cut sports teams simply because some kids are far more talented at sports,” he said.
“Why is it that the teaching of math generates much more controversy than other subjects?”
sfchronicle.com/bayarea/arti…
Anyone else think a skill should be invoked with ./xyz instead of just /xyz?
I guess one could argue it's in the path...
Michael Coates retweeted
One potential outcome of the vulnpocalypse is that companies decide the cost (in risk, dollars, and engineering hours) of OSS dependencies is too high. Vulnerability management isn’t cheap or glamorous, and it’s unlikely that you need all of the attack surface you inherit with these packages. All of the small packages from the many transitive dependencies you inherit present supply chain risk that likely outweighs whatever value you’re getting from that few hundred lines of code.
The cost of the tokens to rewrite the fraction of that code you need, and maintaining it as 1p code, will eventually be lower than the continued cost of dependency management.
This will improve security, but would have negative consequences for the OSS ecosystem.
Takeaway - open source had an early larger exposure to ai based vuln discovery by nature of code being available for inspection.
This gave a short term false sense of security to closed source.
But reversing from binary is no longer an obstacle.
Worlds of dynamic and static analysis merging quickly!
All the vulns will be found. Adjust accordingly.
I wanted to test if a Solana program with no source available could be pulled from the chain and reverse engineered into a byte identical open source version
So I took the daosfun contract and did just that
Found a critical security vulnerability in the mainnet program too, oops!
All smart contracts can be perfectly reverse engineered now
There is no security by obscurity anymore
github.com/lalalune/daosfun-…
Michael Coates retweeted
I wanted to test if a Solana program with no source available could be pulled from the chain and reverse engineered into a byte identical open source version
So I took the daosfun contract and did just that
Found a critical security vulnerability in the mainnet program too, oops!
All smart contracts can be perfectly reverse engineered now
There is no security by obscurity anymore
github.com/lalalune/daosfun-…
The AI-driven surge in vulnerability discovery and exploitation has begun. Three indicators from the past few weeks:
1. chatter that incident response firms are fully booked and overwhelmed with business (meaning breaches are happening even if we don’t see headlines)
2. a major certificate authority compromise (eMudhra)
3. the massive PHP vulnerabilities discussed today (CVE-2026-109618 and CVE-2026-109619)
AI is either directly discovering the vulnerabilities or is a means to rapidly exploit the issue at scale and low cost. The combination of low cost and scale means industries that skated under the radar because of attacker interest / ROI are now squarely in the attack crosshairs.
This applies to all companies, big and small. You are not safe because “hackers won’t come after industry XYZ”. They will.
The defensive needs are clear. We need to migrate from human-driven cyber defense to defense at the speed of computers. This is the position I laid out in December when I spoke to the House Homeland Security Committee subcommittee in DC about the threat of AI-powered cybersecurity attacks.
What should organizations do today?
This is not an exercise in being clever. Rather the need is to be comprehensive.
1. Understand your exposure - Establish an automated inventory of your packages, libraries, operating systems, full tech stack, etc.
2. Understand when you need to respond - Build automated monitoring systems that monitor public CVEs and cybersecurity chatter and cross-reference this with your inventory. Response time is moving from days to hours to minutes. You need automation and alerting.
3. Mobilize and plan for response - The issue will inevitably hit at 2am. How will you mobilize the right team members? Can you bring the system offline in moments (operationally, and do you have internal authorization)? What team members are needed? Do you have reliable paging and response? Practice now.
4. Reduce Attack Surface & fix issues you can now - AI chaining is increasingly tying together otherwise low-risk issues into critical outcomes. This means you either need to comprehensively analyze all known vulns to better understand if a low is actually a high risk issue. Or, lacking this capability, be more aggressive to fix known issues. One simple way to fix issues - remove the access and exposure. A device that can’t be reached is much harder to exploit!
This is not business as usual. Your cybersecurity posture and strategy over the next 18 months are an opportunity to survive when your competition fails (and they may no longer be a competitor at that point).
If you’ve been saying “We take cybersecurity seriously...” This is your chance to put your money where your mouth is.
On top of the cyber vuln landslide this week did we also just invent alchemy?!
Last month, we demonstrated high-rate alchemy: turning mercury into real, stable gold, beating CERN’s record by a factor of 10.
Last week, we enriched isotopes in the world’s most powerful plasma centrifuge, beating the Soviet record that stood for 40 years.
Now, we’re building a fusion reactor in San Francisco to achieve record power density.
Michael Coates retweeted
SCOOP: Major U.S. banks are detecting unauthorized third-party AI agents inside customer accounts, including some attempting to take actions that appear to be independent of user instructions, sources told Axios.
The findings have alarmed banking executives, who are racing to restrict access to their systems as AI moves at a velocity faster than financial institutions can respond, multiple industry and bank executives told Axios.
Several banks are now preparing for worst-case and even “day after” scenarios, including how to rapidly secure or restore customer accounts if things go wrong, the people said.
Several bank executives told Axios they're struggling to distinguish between human users and AI agents. One executive said banks also struggle to determine whether agents are authorized by customers or potentially operating without their permission, more akin to rogue agent behavior.
Read my latest for Axios here: axios.com/2026/10/22/ai-agen…
Michael Coates retweeted
Fascinating. Amazon says it has telemetry showing PHP2Shell was being exploited on Oct. 17—that is, four days prior to public disclosure.
Not known who was doing it. "It remains unclear how the actor acquired exploit information prior to disclosure."
aws.amazon.com/blogs/securit…
Michael Coates retweeted
🚨 LiteLLM, a Python package for connecting to AI model providers with 92M+ monthly downloads, has been compromised.
Version 1.107.0 ships credential-stealing malware through PyPI wheels and Docker images, targeting cloud credentials, developer secrets, and AI tools.
Michael Coates retweeted
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
Check your repos folks. Compromised intermediate CAs
List here:
emudhra.we-have-a-problem.co…
Your browser is likely good already (provided you have normal updates).
‼️ BREAKING: 8 Private keys belonging to eMudhra intermediate certificate authorities (CA) have been compromised.
Chrome and Firefox blocked the affected certificates within hours. Go, NSS, and other software have issued fixes.
Full details - thehackernews.com/2026/10/ei…
