When the AI Said Trust Me: How a Phishing Kit Beat a Crypto Chairman's Second Factor

Between the silence and the recovery, a chairman's account spoke a language it never speaks. For a short window, an X account belonging to Kong Jianping, chairman of the Nasdaq-listed BNB treasury company Nano Labs, published scam content to a follower base built over years. No password was cracked. No server was breached. No encryption layer gave way. The attacker never needed any of that. Here is the detail that should keep every crypto operator awake tonight: Kong says an AI assistant told him the phishing link was fine. The AI was wrong. The AI was the doorway. I have spent enough time inside incident response to know what a typical account hijack looks like on paper, and this is not the typical story. This is the first widely reported case I have seen where a large language model sat inside a credential-stealing attack chain and accidentally played for the other team. That single detail is worth more than the event itself, and almost nobody covering this is talking about it. Let me slow down and walk you through what actually happened, because the sequence matters more than the headline. Kong Jianping is not a random retail account. He is the public face of Nano Labs, a US-listed company whose core strategy is accumulating BNB as a corporate treasury asset. That makes him a specific kind of target. In the crypto treasury equity wave of 2025 and 2026, chairman accounts became distribution assets, not just personal profiles. When a figure like Kong posts, the market listens, and that listening is the valuable thing. The account itself is worth nothing. The trust wired to it is worth everything. The attack appears to have unfolded in four recognizable beats. First, a phishing email landed at a public email address associated with Kong. Second, that email carried a link dressed to look like an official X verification page, domain-spoofed and visually convincing. Third, Kong asked an AI assistant whether the page was legitimate, and the AI judged it harmless. Fourth, on that reassurance, he entered the one-time verification code the fake page requested. That was the whole game. The moment the code was submitted, the attacker had what he needed. This is the part I want you to sit with. The attacker was not guessing passwords. He was not brute-forcing anything. He was running what security people call an Adversary-in-the-Middle attack, or AiTM. The fake page was not a dead end that captured a code; it was a live relay. The attacker sat between Kong and X's real servers, forwarding the genuine one-time password in real time, and then walked into a legitimate session wearing Kong's credentials. If your mental model of two-factor authentication is that it saves you from this kind of thing, I need to correct that model right now. An OTP forwarded in real time is an OTP that worked exactly as designed. The second factor did its job. It just did its job for the wrong person. This is not a bug in YubiKey-less 2FA. It is the design ceiling of any authenticator that lives in the same channel the user is already typing into. I watched a version of this play out during the 2020 Compound yield farming panic. Back then the crisis was different, an interest rate model that surprised retail, but the emotional structure was identical. People were being asked to make a security decision under stress, and the tools they trusted answered a slightly different question than the one that mattered. In 2020 it was panic selling. In 2026 it is panic clicking. The mechanism evolves. The vulnerability does not. Now we get to the AI. When Kong says his AI assistant misjudged the link, he is describing something more technical than a moment of human error. Modern AI assistants are being positioned across the industry as verification helpers. Ask the chatbot, check the link, confirm the page. The implicit promise is that the model can tell you whether something is safe. That promise is, in most deployments, false. An AI assistant reading a page has none of the signals that actually establish trust. It cannot validate a TLS certificate chain. It cannot check domain registration records, certificate transparency logs, or the whois history of a lookalike domain that was registered eleven days ago in a cheap TLD. It sees text and layout that have been engineered to look correct, and it reports that the text and layout look correct. The attacker did not have to defeat the AI. The attacker only had to write a page the AI would describe accurately. Security researchers have a name for the underlying class of failure here: the confused deputy. A component is handed trust and authority, and then it is manipulated into using that authority against the very party who extended the trust. The AI assistant in this story is a textbook confused deputy. The user delegated a security judgment to it. The attacker understood that delegation and built a page designed to satisfy the proxy instead of the principal. This is the contrarian point that the coverage is missing. The industry keeps selling AI as a layer that makes security better. In the specific role where AI replaced a hard verification step, it made security worse. Not because the model was stupid. Because the model was never capable of the task, and everyone in the loop assumed it was. The correct defense has existed for years, and it is unglamorous. FIDO2 and WebAuthn, the standards behind hardware security keys like YubiKey, do not rely on a secret the user types into a page. They rely on a cryptographic challenge-response bound to the origin domain. The credential simply cannot be replayed on a phishing site, because the phishing site is not the origin the credential was minted for. Capture it, forward it, copy the page pixel for pixel. None of it matters. The key will not sign the wrong domain. Kong's account was breached. The most reasonable reading of that outcome is that no hardware-bound credential was gating the login. That is not a criticism of him specifically. It is a description of how most high-profile accounts are still configured. OTP over email or SMS remains the default second factor across almost the entire industry, and it is exactly the factor that an AiTM relay is built to strip. I spent a stretch of 2017 manually auditing wallet addresses to separate real community members from sybil attackers, and the lesson that stuck with me was this: attackers optimize for the cheapest path to trust. They do not pick the hardest lock. They pick the door everyone leaves ajar. In 2017, that door was verification theater. In 2026, that door is a shortcut where a human should have run a hard check and instead asked a machine. The attack window here was short. Kong recovered control quickly, and Nano Labs treated the incident with a degree of public candor that I want to credit, because the default instinct in corporate crypto is to bury an account compromise and hope nobody screenshots it. Recovery speed matters. The shorter the hijack window, the narrower the blast radius for followers who might have clicked the scam content. But I want to be precise about where the real damage lives, because price is the wrong lens. This event had essentially no price impact. It will not move BNB, and it will not move Nano Labs equity in any meaningful way. Anyone trying to trade this is trading noise. The actual loss that this attack can cause is downstream and human: a follower, possibly a real investor, trusting a link that came from an account they had every reason to believe. That loss does not show up on a chart. It shows up in someone's wallet. There is a harder question buried in the corporate angle that nobody has asked yet. Kong Jianping's personal account is functionally a corporate communications channel. When a chairman's private profile is used to reach investors, that profile is no longer purely private. US securities rules have been suspiciously quiet on executive social media since the Netflix case more than a decade ago, but the underlying logic holds: if the account is a material information channel, its security is a governance matter, not a lifestyle matter. I do not think this particular incident rises to the level of anything a regulator will chase. But the pattern, if it repeats across the crypto treasury equity cohort, will eventually force the conversation about what internal controls a listed crypto company owes its chairman's login. The single most important thing to understand about this attack is not that it happened. Attacks like this happen constantly. It is that the attack is cheap, repeatable, and already packaged. A phishing kit that proxies an OTP costs almost nothing. The AI layer in this case was not custom work. The attacker simply wrote a page good enough to fool a general-purpose model, and the user's own tooling did the rest. Which means the more important story is the second one that has not happened yet. If a model can be talked into blessing a phishing page, then the growing crop of AI agents that execute trades, sign transactions, and manage positions on behalf of users carries the same weakness, scaled up and automated. The confused deputy problem does not get smaller when you give the deputy a wallet and a signing key. It gets larger, because now the manipulation has a direct path to funds instead of to a single social account. I led a cross-industry task force in 2026 drafting an ethics charter for AI-driven crypto trading, and the hardest argument in the room was never about capability. It was about where the final verification lives. Everyone wants the agent to be fast. Almost nobody wants to define who checks the agent. This Nano Labs incident is a preview of exactly that gap, applied to a human account instead of a trading bot. The takeaway is not that AI is dangerous, and it is not that two-factor authentication is useless. Both of those conclusions are lazy. The real lesson is narrower and more useful. There is a category of decision where a human delegates a safety check to a system that cannot actually perform that check, and this event is a clean example of that delegation failing. Every enterprise and every trader now has to find their own version of that decision and put a hard gate behind it. The next phishing kit is already in the wild, and it is aimed at the account you trust most. The only question that matters is whether, when it arrives, you are relying on a key that binds to a domain or a machine that says trust me. The account is back. The followers are back. The lesson is still sitting there, unclicked.