In 2019, sophisticated hackers spent weeks targeting Coinbase employees with emails from compromised Cambridge University accounts. The attackers patiently built trust before deploying a pair of chained zero-day exploits—a term that describes undiscovered software vulnerabilities—that took aim at the Firefox browser. One exploit sought to break into the browser, and the other sought to execute malicious code on the host machine. At the time, it was among the most advanced attacks ever directed at the corporate sector.
The Coinbase security team caught it within hours after an employee report and automated alerts fired simultaneously. This allowed us to identify the malicious behavior. Response times measured in minutes, no customer funds lost. But I think about that incident differently now. The attacker needed weeks of social engineering and rare zero-days to get one shot at us. An AI-driven adversary wouldn’t need weeks. It might not even need hours. And that’s the world I’m preparing for today.
