Coinflow CISO warns of AI‑driven threats to crypto payment security

Crypto payment firms are now prime targets for advanced persistent threat groups, and the pressure on security leaders is intensifying as AI tools accelerate vulnerability discovery [1]. Malcolm Portelli, CISO of Coinflow, explained how his threat model is shaped more by the industry’s financial‑services and Web3 nature than by geography, and outlined the company’s shifting defenses against AI‑enabled attacks.

Key takeaways

• Crypto firms attract APT groups seeking to access digital assets, driving a sector‑specific threat model [1].
• Traditional monthly security awareness videos were replaced by quarterly, 30‑minute sessions to improve engagement [1].
• Coinflow relies on multi‑factor authentication for API keys and AI‑based anomaly detection to combat fraud that tricks users into authorising payments [1].
• AI‑powered vulnerability scanners such as Mythos and TrendAI are generating hundreds of new findings, outpacing current patching processes [1].
• The CISO uses financial‑impact data from reports like Verizon’s DBIR and IBM’s breach cost study to communicate risk to board members [1].

Industry‑driven threat model and training overhaul

Portelli says the crypto and Web3 landscape dictates the security posture more than the fact that Coinflow’s security team operates from Malta. “Crypto is a big target, especially for the big APTs,” he noted, emphasizing that threat actors focus on firms handling digital money [1]. To keep pace, Coinflow has revamped its awareness program: monthly video snippets were deemed a compliance checkbox and discontinued in favor of quarterly, concise training sessions capped at 30 minutes, supplemented by more engaging formats [1].

AI‑enhanced vulnerability discovery and fraud defenses

The rise of AI tools is reshaping both attack and defense. Portelli highlighted Mythos, an AI‑driven vulnerability discovery system that uncovered numerous issues in Firefox, and TrendAI research that identified roughly 300 vulnerabilities in popular WordPress plugins at a cost of about $20 per zero‑day [1]. While defensive AI helps flag these flaws, automated patching that preserves functionality remains a challenge, leaving many CISOs with growing backlog of unaddressed findings [1].

On the fraud front, attackers have shifted toward social‑engineering scams that persuade customers and staff to approve payments themselves. Coinflow counters this by deploying AI‑based anomaly detection to flag suspicious transactions and maintaining continuous education for employees and end users, while also leveraging multi‑factor authentication for API keys to secure the primary integration point [1].

Why it matters

Portelli’s insights illustrate a broader trend: crypto‑payment providers must adapt to an environment where AI accelerates both vulnerability discovery and sophisticated fraud schemes. By aligning board communication with financial impact data and modernizing awareness training, Coinflow aims to stay ahead of attackers. However, the gap between AI‑generated findings and effective remediation tools suggests that many firms will continue to face mounting pressure over the next few years, underscoring the need for faster patching solutions and robust API security practices.