5 Questions for Coinbase Chief Security Officer Philip Martin

Crypto is one of the most talked-about technologies of our time — innovative, fast-moving, and still being understood. As more people explore it, understanding how the ecosystem works becomes just as important as the opportunity itself. That’s why we’re thrilled to welcome Philip Martin, Coinbase’s Chief Security Officer, on Thursday, Jan 22, to break down how security is evolving and what smart exploration looks like today.

Before the event, Philip shared his take on the rise of online scams and what we can all do — no matter our tech level — to protect ourselves. Consider this your first look at the wisdom he’s bringing our way.

Recent reporting suggests that roughly $28 billion in illicit funds flowed through the crypto ecosystem last year. From the vantage point of a major exchange, what does that number actually represent? Is it a sign of fundamental structural vulnerability in crypto, or is it evidence that regulators and investigators are finally getting better at detecting what was previously invisible?

That figure is the amount researchers detected as illicit funds moving through cryptocurrency. This data is useful, but it also needs context. Measured against the total volume of all crypto transactions, activity tied to crime is very small: studies put it well below 1%.

What the data signals is that some bad actors are using crypto for crime, but it also reflects the strength of the technology. By virtue of crypto’s design, it offers a level of transparency and security unmatched by traditional financial systems. Transactions taking place on the blockchain, the technology that underpins crypto, are logged and visible forever. Cash transactions leave little to no record, which is why cash still dominates illicit finance globally. In fact, the US Treasury has found that money laundering through crypto remains far lower than through traditional currencies, even as hundreds of billions of dollars are laundered worldwide each year using cash and conventional financial systems. Crypto’s transparency makes it harder for wrongdoing to stay hidden, and that’s a big reason law enforcement increasingly sees regulated crypto platforms as part of the solution, not the problem.

In short: the number points both to real criminal activity and to better detection. It’s why we believe crypto, when built and regulated well, gives regulators and investigators new tools to fight financial crime, not hide it.

You’re the Chief Security Officer at Coinbase; effectively the person standing between millions of users and a very motivated, very sophisticated global threat environment. What keeps you up at night? What are the attack vectors or adversaries that the public isn’t thinking about but should be?

What keeps me up at night are the everyday tricks that convince real people to hand over access to their money. Scammers use phone calls, fake websites, phony customer-service messages and other forms of social engineering to get passwords, convince people to approve transactions or share codes.

We also see increasingly convincing AI tools, including deepfakes and AI-written messages, that make scams far more believable and easier for attackers to reach more victims.

These are human problems at heart: attackers are trying to manipulate people, not just using software or complex technologies to hack into accounts.

Our job is to make those attacks harder, faster to detect, and less profitable, and to educate and give customers simple, effective steps they can take to protect themselves.

The single best thing people can do is be skeptical of unsolicited requests, avoid reusing passwords, and use the strongest security protections available across their accounts.

Crypto has long been marketed as “trustless,” yet the sector still relies heavily on human behavior, people clicking links, approving transactions, or trusting the wrong intermediaries. Where does the human factor remain the weakest link, and what emerging fraud tactics are you most concerned about right now?

This isn’t necessarily a crypto only problem. We’re seeing fraud and scams across various platforms. The attacks that worry me most all start with preying on people’s emotions and convincing them to do something they wouldn’t do if they knew the truth. 

The psychology of trust and social pressure is often the key vulnerability, not a technical exploit.

For example, “pig butchering” and romance scams are all about the long game. Maybe you’re chatting with someone online through a dating app or social media, and over time, they become friendly and trustworthy. Weeks or even months can go by, and it starts to feel like a real relationship. Then, seemingly out of nowhere, they suggest an investment opportunity that sounds totally legit. Little by little, you’re nudged to move money. By the time most people realize something’s wrong, the person they trusted has disappeared along with their savings. It’s exactly this slow-burn manipulation that groups like Tech Against Scams are focused on exposing, helping people recognize the warning signs earlier and avoid getting pulled in.

What’s new and particularly dangerous now are hybrids that combine social pressure with AI-powered scams, where criminals are using AI-written messages and deepfake tools that impersonate a voice, videos or images to trick victims into believing they’re engaging with someone they know and trust.

We tend to think of scam victims as inexperienced investors, but the data tells a different story. Educated professionals are increasingly being targeted in highly engineered scams. What patterns are you seeing in who gets victimized, and what are the most convincing scams circulating today that even a savvy user might fall for?

Scammers aren’t just preying on beginners. They’re actively courting busy, educated people because those victims often have money, trusted networks, and online footprints attackers can research and exploit. The pattern we see again and again is patience and personalization: an attacker builds rapport over time (like we see in “pig-butchering” and romance scams), or they study a victim’s LinkedIn, email, and social posts and then send a message that looks exactly like something a colleague, recruiter, or lawyer would send. Smart people fall for these scams because the messages are believable, they come from a plausible context, and the attacker has done the homework to remove the usual warning signs. That combination of trust, time, and technology is why these scams succeed: they feel real, they’re tailored, and they arrive in a context where a person might reasonably let their guard down.

For people who are crypto-curious or already hold digital assets, what does a “safe” crypto experience look like in 2026? If you could give users a concise, non-technical checklist for evaluating whether an exchange, transaction, or investment is trustworthy, what would be on it?

A trustworthy crypto experience means using platforms that are transparent and audited, that give you clear, easy-to-use protections, and that offer real people and processes to help if something goes wrong.

Those getting started with crypto should treat it like any other important financial relationship: pick providers that show their work (audits, regulatory oversight), invest heavily in security, and make it easy for customers to use strong protections like hardware keys, passkeys, vaults and withdrawal allow-lists.

At Coinbase, those are the basics we build into the product and the advice we give customers: strong 2-factor authentication (hardware keys are best), withdrawal allow-listing and vaults for large holdings, built-in scam prompts in the app, and dedicated fraud investigators and phone support for account takeovers.

Join Philip Martin and guests with Coinbase on Thu, Jan 22 for Spotting the Red Flags: Protect Yourself from Misinformation & Today’s Top Scams, followed by a reception. Registration is free; sign up here.