Latest / Hardwired by AlphaWire / The State Of Risk In DeFi #02 | ft. Charles Holmes & Greg Bock

Transcript

The State Of Risk In DeFi #02 | ft. Charles Holmes & Greg Bock · Hardwired by AlphaWire

• 0:00
  SPEAKER_01: So, hello everybody.
• 0:01
  SPEAKER_01: Welcome to another episode of Hardwired.
• 0:05
  SPEAKER_01: This one is the second episode of a little series that we're going to do called The State of Risk in DeFi.
• 0:12
  SPEAKER_01: And I've got uh Greg Bach and Charles Holmes along again.
• 0:16
  SPEAKER_01: So if you want to say a little introduction to your good selves and then we'll get started.
• 0:21
  SPEAKER_02: Hello, I'm Greg Bach.
• 0:22
  SPEAKER_02: I'm CEO of Fidesium.
• 0:24
  SPEAKER_02: We are a boutique cybersecurity firm specializing in Web3, most notably EVM chains for smart contracts, but we also do pen testing and compliance.
• 0:37
  SPEAKER_00: Hi, I'm uh Charles Holmes from Verdict.
• 0:39
  SPEAKER_00: Uh we are building a due diligence as a service uh offering for decentralized finance where we offer ratings, coverage, and a security marketplace.
• 0:50
  SPEAKER_00: So effectively, we're a one-stop shop for security.
• 0:53
  SPEAKER_00: And Fideesium is on our security marketplace as well because we know who the best in the industry are.
• 1:00
  SPEAKER_01: That's very that's very nice words of you to say, Charles.
• 1:05
  SPEAKER_01: Um so thank you very much, both of you, for coming along again.
• 1:08
  SPEAKER_01: We we talked about quite a few different things last time, but one of the areas we didn't discuss was multi-six, and we were having a bit of a chat off-camera about how things have changed, where the security risks lie, and there's a couple of interesting things I think to point out that that you brought up, Greg.
• 1:26
  SPEAKER_01: So if you want to fire away and give a bit of an overview and then we can talk about some of the risks.
• 1:32
  SPEAKER_02: Uh yeah, so it's an interesting thing, right?
• 1:35
  SPEAKER_02: Um and it's important not to think multi-sigs are less secure inherently.
• 1:42
  SPEAKER_02: It's the hacks recently boiled down to a couple things.
• 1:46
  SPEAKER_02: Um, multi-sig uh wallets tend to hold treasuries for different protocols, so there is they tend to just be better targets for the hackers.
• 1:57
  SPEAKER_02: And the second part of that is a chain is only as strong as your weakest link.
• 2:03
  SPEAKER_02: So a single sig wallet, or even you know, a hot wallet, one point of entry, generally one laptop, computer, maybe a phone.
• 2:16
  SPEAKER_02: Uh multi-sig, the attack surface is just broader.
• 2:19
  SPEAKER_02: So you have uh multiple keys floating around, multiple people with multiple keys, uh, more devices where that can be accessed from.
• 2:29
  SPEAKER_02: And so it just broadens the entry points for um any narrative wells that are looking into it.
• 2:36
  SPEAKER_02: And the problem gets worse when security is not um set up correctly and not taken as it should.
• 2:46
  SPEAKER_02: So, you know, one of the recent hacks, I think we even I can't remember if we brought it up on the show or we were just discussing it pre-last show, of there was a hack recently, multi-sig wallet went for I want to say 60-70 mil, and all seven keys were stored on a single laptop, which was just at that point, you know, why bother?
• 3:10
  SPEAKER_02: It's um, you know, you're you're playing at security, you're not doing security.
• 3:17
  SPEAKER_02: And so, yeah, uh Halburn released their kind of state of uh digital asset risk.
• 3:24
  SPEAKER_02: Uh very nice report came out just the other day, and they broke down, you know, the big trends as far as what they've seen.
• 3:34
  SPEAKER_02: And very interesting reading, you know, the guys do good work.
• 3:39
  SPEAKER_02: And what the big one was is yeah, wallet hacks, social engineering have been going up and up at the same time that smart contract bugs, uh bridge exploits, and what we used to see in the last two bull runs is on a distinct decline.
• 3:58
  SPEAKER_02: You know, technology is getting better, the the platforms are maturing finally, they're you know, we're starting to plug holes, everything on the code level where you can lock it down is getting much better.
• 4:16
  SPEAKER_02: Uh crypto still has the problem of being crypto, where people are still not operating in this uh security as a process mindset where everything is security, how you handle your deployments, how you treat your internal processes, how you like deal with interfacing with third-party vendors, everything is security, and the large state actors and the well-funded groups that are going after digital assets were quick to realize this, and so that's where the taxes have moved.
• 5:00
  SPEAKER_01: A risky state of affairs by the by the sounds of it.
• 5:03
  SPEAKER_01: I suppose one of the things that I always kind of cast my mind to with this is you can have a secure setup, but most people like like you say, they play at it.
• 5:13
  SPEAKER_01: They don't they don't look sort of once they set it up to how that's maybe changed or shifted.
• 5:18
  SPEAKER_01: Do you think people misunderstand how to set these kind of security procedures up?
• 5:24
  SPEAKER_01: Or do you think it's just they get out of date, or why do you think that people get these hacks uh surfacing in these areas when it's meant to be more secure?
• 5:33
  SPEAKER_02: Um, I don't think they play at it, and I don't think it's uh it's definitely a matter of going out of date, uh, but it's a matter of going out of date and not being enforced because it is harder.
• 5:45
  SPEAKER_02: It is more steps to stay secure.
• 5:48
  SPEAKER_02: You have to have a process.
• 5:51
  SPEAKER_02: The process for a secure system tends to have more steps than a process for an insecure system.
• 5:58
  SPEAKER_02: Um and this goes across everything.
• 6:02
  SPEAKER_02: You know, I believe uh uh correct me if I'm wrong, but it was uh Drift who got hit, and it was a full third-party trading company that infiltrated over the course of months and got developers on the team.
• 6:18
  SPEAKER_02: They were a the fake company was a trusted supplier, they got devs on the drift team to test their app and downloaded packages, and that's how they were able to compromise the machine.
• 6:32
  SPEAKER_02: So yeah, it seems onerous when you're running a business, you're trying to move fast, you're trying to get your work done.
• 6:40
  SPEAKER_02: Oh, the supplier just wants me to look over this thing.
• 6:43
  SPEAKER_02: Oh, they're good friends.
• 6:45
  SPEAKER_02: Oh, I'll just open this up or I'll just install it.
• 6:49
  SPEAKER_02: And that's where these hacks happen.
• 6:51
  SPEAKER_02: Uh, it's you know, many times trusted sources.
• 6:55
  SPEAKER_02: Um, you know, the proliferation of social engineering hacks that have been going around, especially on Telegram, is another key case.
• 7:06
  SPEAKER_02: Um, my co-founder was almost got stung by one, and it was a known person in his contacts.
• 7:13
  SPEAKER_02: This wasn't like, you know, a bogus job offer from you know some random company.
• 7:19
  SPEAKER_02: It was a known contact.
• 7:21
  SPEAKER_02: Uh they hadn't talked to him in a couple months, not terribly unusual in cryptoland.
• 7:27
  SPEAKER_02: Uh, the guy messaged him, said, Hey, just checking to see what you are up to.
• 7:33
  SPEAKER_02: Would you like to grab a quick call?
• 7:36
  SPEAKER_02: And the only thing that threw him off was used an irregular meeting platform to request the meeting.
• 7:47
  SPEAKER_02: And that's enough.
• 7:49
  SPEAKER_02: You know?
• 7:49
  SPEAKER_02: And then, yeah, look at the link.
• 7:51
  SPEAKER_02: Is link was dodgy, led to a spoof of some, led to a spoof of a less used uh meeting site that doesn't keep uh enough proactive security going to take down spoofs of their site.
• 8:10
  SPEAKER_00: I think where this could uh go on as an industry is uh, and then I know it's something a lot of security companies are looking at at the moment, is you're gonna need an operational security officer within most big companies just to make sure that everybody's operations are running properly, everyone's being vetted, hardware's being looked after, keys are being looked after, and where this may turn into is an industry standard of actually getting qualifications for signers, uh, qualifications for people so that they can understand exactly what they're signing and why they're signing it.
• 8:43
  SPEAKER_00: Um, and I think as an industry we're gonna have to mature going forward.
• 8:47
  SPEAKER_00: Um, the reason behind that is we even though we don't think we're in the early days, we're still in the early days uh of crypto.
• 8:54
  SPEAKER_00: And uh, you know, even though Greg and I have lost all of our hair due to crypto, um, it's uh something that uh you know it it needs to be looked at very seriously because if we are gonna onboard a billion users to use crypto, then uh it has to be secure and reliable, and people can't lose their money.
• 9:11
  SPEAKER_00: So um I think some people need to look inwardly and work out exactly what's going on operationally within their companies and uh make some decisions.
• 9:21
  SPEAKER_01: I think an interesting thing that's kind of just popped up to me out of that that conversation and a little bit at the end is there's going to almost be like um a knowledge, what's the word, like curve for this that's required, depending on how involved you get into the blockchain ecosystem.
• 9:37
  SPEAKER_01: But an interesting thing where like mostly in the current financial world, this this need for education and certification in in the operations of finance has been abstracted away, I suppose, in a weird sense.
• 9:53
  SPEAKER_01: Like you went from having to manage your money because you owned it and you you had it in your pocket almost to it all being on a screen.
• 9:59
  SPEAKER_01: Um and it's kind of gone back a little bit the other way where your like personal security and your knowledge of it has become important again.
• 10:07
  SPEAKER_01: It's gonna be interesting to see the kind of how wide the gap becomes.
• 10:12
  SPEAKER_01: Does it just stay in kind of the hands of companies, or does retail or the the average man at the end of the kind of interest curve get a lot more involved and start to consistently engage with these protocols, or is it always gonna be a niche?
• 10:26
  SPEAKER_01: What do you think?
• 10:27
  SPEAKER_01: Do you think the average man is gonna get more and more knowledgeable about crypto?
• 10:31
  SPEAKER_01: A bit like some people knew how to build websites and some people don't in a very, very common analogy.
• 10:38
  SPEAKER_02: I mean, I think unless there's a very big shift um that abstracts away like all of the kind of bad um user experience parts of crypto in the very near future, we're going to shift that way, and there is going to be some necessary level of knowledge on the average retail person in at least in the short term.
• 11:07
  SPEAKER_02: Uh otherwise, yeah, they're they're gonna get rinsed.
• 11:12
  SPEAKER_02: The problem is that level of knowledge right now is fantastically too high, you know.
• 11:19
  SPEAKER_02: Um and I think that's why this uh bull run did not see the onboarding of retailers like uh the last uh the last bull runs.
• 11:30
  SPEAKER_02: We have onboarded all the nerds that can possibly be bothered to put up with the horrible state of user experience.
• 11:39
  SPEAKER_02: There just aren't enough more of them.
• 11:43
  SPEAKER_02: We have all the retailer users we're gonna have until we drastically fix the UX and uh security problems.
• 11:53
  SPEAKER_01: And do you think it's coming, or do you still think we're another cycle away from some of that being abstracted away?
• 11:57
  SPEAKER_01: Because it's it's been the goal for years and years.
• 11:59
  SPEAKER_01: That's what I've heard from every company and everybody who strives for a vision in crypto is we're gonna make it easier to use and more secure and less ability to be hacked.
• 12:09
  SPEAKER_01: And there's been some like measurable, measurable forward movement in some areas.
• 12:13
  SPEAKER_01: Like when I swap something on MetaMask now, if it's like an unknown contract and they're saying that they've scanned some of them for them being honey pots, and like you go on deck screener and you can see some check marks about the smart contract, whether certain things have been relinquished, or can they still edit the contracts?
• 12:32
  SPEAKER_01: But even that's like a high level of knowledge just to understand that.
• 12:37
  SPEAKER_01: Do you think it's on the horizon or do you think it's further than the horizon, I suppose?
• 12:42
  SPEAKER_02: I still think it's a little bit further than the horizon, sadly.
• 12:45
  SPEAKER_02: I mean, the fact I mean the MetaMask, actually, any hot wallet is a great example.
• 12:50
  SPEAKER_02: The fact that you dump an address to send some money to, and you have to know what chain it is, otherwise buy-bye money is just not a problem that anyone's dealing with, right?
• 13:06
  SPEAKER_00: You still have that problem on uh Coinbase on Binance and things like that.
• 13:10
  SPEAKER_00: I've known people who are crypto literate who have lost like uh what was the one I was trying to help a gentleman with?
• 13:15
  SPEAKER_00: Uh USDT sent to Coinbase and they didn't do USDT at the time.
• 13:20
  SPEAKER_00: So it was just lost.
• 13:21
  SPEAKER_00: Like it was still on their wallet, but because Coinbase owned it and they didn't offer USDT, then they just couldn't get it um at all um on their account.
• 13:30
  SPEAKER_00: So like this, these this these things need to be addressed quite quickly, um, but they're not going to be.
• 13:36
  SPEAKER_00: And at the same time, like our parents, my you know, people that you wanted to get into crypto, I don't want to give them a massive learning curve about hot wallets or rabbi over MetaMask or anything like that.
• 13:49
  SPEAKER_00: I'd rather just say, look, just keep it in Coinbase.
• 13:52
  SPEAKER_00: At least you can ring a customer service um person or Binance or Kraken or wherever they've got their capital.
• 13:58
  SPEAKER_00: And uh I I think the centralized exchanges have got a decent a decent uh product, but at the same time, uh it needs to be easier to use.
• 14:08
  SPEAKER_00: And I agree with you, Greg.
• 14:09
  SPEAKER_00: I think uh the UX needs to improve significantly before we can safely onboard lots more people.
• 14:17
  SPEAKER_01: I've got a good story about clawing back miss crypto though.
• 14:22
  SPEAKER_01: I've got a couple actually.
• 14:24
  SPEAKER_01: So I was using Swissborg a good few years ago and um sent I think some Matic on ETH rather than on Polygon or something, and Matic and Polygon, oh I always misremember the names for the tokens because they changed it.
• 14:39
  SPEAKER_01: It might have been Polon Matic or Polon Polygon, so excuse my ignorance if I've misnamed the token.
• 14:45
  SPEAKER_01: But the long story short is I sent it to the wrong place.
• 14:48
  SPEAKER_01: And for ages and ages, they're like, we can't get it.
• 14:50
  SPEAKER_01: We we won't we can't, you said it's the wrong thing, basically fiddlesticks.
• 14:54
  SPEAKER_01: And I was like, but that makes no sense because you it's a multi, it's a multi- it's a multi-chain um contract address, I'm pretty sure, because you I can send other things on other chains to that address, which means that you set it up, which means that you physically can get it, you're just refusing to.
• 15:12
  SPEAKER_01: And they and they went, How do you know that sort of thing?
• 15:15
  SPEAKER_01: Um, and then finally, not not in so many words, but that was kind of the inference of the next message.
• 15:22
  SPEAKER_01: Um, but in the end, they they said, Well, we'll get to it, we'll get to it, we'll get to it.
• 15:27
  SPEAKER_01: And then I think about a year later, it just appeared in my wallet, or eight months, it took ages.
• 15:34
  SPEAKER_01: They must have just added the functionality to their their panel.
• 15:38
  SPEAKER_01: I think I had the same with Coinbase as well.
• 15:40
  SPEAKER_01: I think I made that mistake of sending USDT when they didn't accept it, and it took them a while, but they they clawed it that.
• 15:46
  SPEAKER_01: I think Binance as well, I've done it.
• 15:49
  SPEAKER_01: You've just got to annoy the support until they relinquish.
• 15:55
  SPEAKER_02: Yeah, but I mean that's just it, right?
• 15:57
  SPEAKER_02: If you're gonna move to a centralized exchange, eventually the centralized exchanges will all merge together and we end up in the same paradigm as the the banks.
• 16:08
  SPEAKER_02: You know, the dream is that the UI UX gets good enough that we can use true self-custodial wallets and really decentralized things and you know, own our own money.
• 16:23
  SPEAKER_02: Um it is good uh to have the centralized exchanges as kind of a bridge over.
• 16:29
  SPEAKER_02: Uh they I mean without those, good lord, it the the problem it'd probably be uh several thousand times worse.
• 16:37
  SPEAKER_02: But it's still uh it is not the end solution.
• 16:42
  SPEAKER_02: At least I don't see them figuring it out anytime soon either.
• 16:48
  SPEAKER_01: Yeah, the sort of the super app for all of crypto where you can manage all of everything and it's secure and it's a good place to store stuff doesn't really exist.
• 16:58
  SPEAKER_01: It it has become every every option has its pros and cons and its trade-offs, and and you've kind of got an understand at a very high level what what risks you're opening yourself up to.
• 17:11
  SPEAKER_02: I mean then Oh sorry, go ahead, Charles.
• 17:14
  SPEAKER_00: No, I was just gonna say, even if you're trying to look at your operational security, you've got an air gaps, laptop, uh Trezor, or a ledger, you're at risk of having your address leaked.
• 17:23
  SPEAKER_00: You know, uh it just it doesn't seem to make much sense.
• 17:27
  SPEAKER_00: So we need something as an industry.
• 17:29
  SPEAKER_00: Sorry, Greg, I cut you off.
• 17:30
  SPEAKER_02: Oh, no, no, absolutely not a problem.
• 17:33
  SPEAKER_02: So yeah, the other thing I would the only other thing I was gonna say is, yeah, and just and then the hacks just keep on getting better.
• 17:38
  SPEAKER_02: You know, I mean, once upon a time when bridges were difficult and it was harder to move stuff around, something would get hacked and you'd have hours, days, whatever to trace down where the money went and hopefully do some recovery.
• 17:59
  SPEAKER_02: Well, forensics has gotten a little bit better, but the speed of moving between chains and moving money out has gotten blindingly fast.
• 18:09
  SPEAKER_02: So the forensics teams just can't keep up, and like trying to recover anymore is even becoming a problem, even if they do find it, if there is a hack.
• 18:24
  SPEAKER_01: Dangerous, a dangerous game has to be played with uh a bit of forethought.
• 18:30
  SPEAKER_01: Um so one other thing I wanted to discuss today was from a hack that came out recently, which we want to get on to in kind of the second part of this session.
• 18:42
  SPEAKER_01: But the question that kind of posed is if you are a crypto company, who do you bank with and why?
• 18:49
  SPEAKER_01: And I think Bok, you had a couple of points on this to start off with.
• 18:54
  SPEAKER_02: Uh yeah, so um we have some friends over uh out of the US uh run a little neo bank called Meow.
• 19:05
  SPEAKER_02: Um they are doing some amazingly good work uh with crypto invoices, uh the money's insured, um a brilliant back to the interface problem.
• 19:21
  SPEAKER_02: Oh man, their UI and UX in their app is just absolutely brilliant.
• 19:27
  SPEAKER_02: They, you know, as it should be, they were purposely built as a business bank that accepts crypto, and they're the first one to kind of that I know of anyway, to really kind of hit that level, like make a serious play as a uh neo bank for businesses and be kind of crypto first.
• 19:49
  SPEAKER_02: Um you know, we we used Revolute for years, they added uh crypto, they allow you to have vaults.
• 20:02
  SPEAKER_02: Uh the process of sending, receiving, transferring, and otherwise seeing your history in that vault is just torturous.
• 20:14
  SPEAKER_02: The UI is atrocious.
• 20:16
  SPEAKER_02: Uh they turn off features at a whim, like you know, like the the crypto aspect of Revolute is you can tell it was added very ad hoc, very bolted on.
• 20:31
  SPEAKER_02: It's separate, they treat features differently, they you know, they report differently, the app is laggy between your vault and your balance in your account.
• 20:42
  SPEAKER_02: It's yeah, there are many, many, many, many, many, many problems.
• 20:48
  SPEAKER_00: Yeah, I had a Revolut account for some time.
• 20:51
  SPEAKER_00: Um I think I got into it as soon as they'd uh released all their crypto stuff, and the big problem I had was I bought some Bitcoin on there, and I was like, okay, great, can you show it to me, show me where on-chain it is, please, so that I can make sure that it actually is a bit of Bitcoin.
• 21:05
  SPEAKER_00: And they pretty much refused to do that.
• 21:07
  SPEAKER_00: So I was like, okay, then no problem.
• 21:09
  SPEAKER_00: I will refuse to use your service and uh removed all my money from there.
• 21:12
  SPEAKER_00: Um I've been around a number of different neo banks, um, have worked for them, um, put capital in them.
• 21:20
  SPEAKER_00: None of them are very good, unfortunately.
• 21:23
  SPEAKER_00: So I'm looking forward to trying your new one, Greg, uh, and seeing how far I get with that.
• 21:28
  SPEAKER_00: Uh, because there needs to be something that assists crypto companies with invoicing, uh, payroll, um, multi-jurisdictional payroll as well.
• 21:37
  SPEAKER_00: So if you're paying someone in euros, just paying someone in rupees, dollars, whatever, pounds, you know, it all needs to work through a bank and it all needs to be quite simple.
• 21:47
  SPEAKER_00: Uh, invoicing needs to be quite stable.
• 21:50
  SPEAKER_00: Um, so you either keep the same address or you get a new address depending on how it cycles through.
• 21:54
  SPEAKER_00: And as far as I'm concerned, uh there's still a market for a really good neo.
• 22:00
  SPEAKER_00: Bank to pop up that can actually do this from the ground up, even though we have 150,000, what feels like it sometimes, neo banks popping up every day.
• 22:09
  SPEAKER_00: Um, all and some have interestingly no KYC cards, and that seems a fascinating thing for a bank to be offering as well.
• 22:17
  SPEAKER_00: Um, so yeah, I I think we're we're still looking for that perfect solution.
• 22:22
  SPEAKER_00: Um, and it'll it'll probably pop up in the next couple of years, but it'll take a few iterations and unfortunately some hacks and challenges have to happen, and maybe some regulations need to be adjusted to allow um one of them to pop up as well.
• 22:37
  SPEAKER_02: I definitely think there's some movement on the uh regulation end that is I mean that just no there's just no clear um no clear guidance on uh how to treat everything, uh, you know, even down to stable coins or dollars.
• 23:01
  SPEAKER_02: But we're gonna can treat them completely different.
• 23:04
  SPEAKER_02: Your holdings of stable coins is completely different to your holdings of fiat, even though stable coins are largely backed by treasury uh bonds and all of this.
• 23:14
  SPEAKER_02: It just the regulation is both not there and when it is there is largely nonsensical for like a large part.
• 23:24
  SPEAKER_01: Do you think that's changing though?
• 23:26
  SPEAKER_01: Like I sort of see the headwinds for that, uh or the tailwinds rather, as sort of starting to appear across the main jurisdictions anyway.
• 23:34
  SPEAKER_01: Like I think we're sort of one more iteration away from at least a an even keel, an ability to transact a little bit more easily, an ability to kind of know relatively where you stand, even if you don't know the whole picture.
• 23:47
  SPEAKER_00: But then you increase the attack services, like uh the thing we were talking about before, uh Curacao regulator gets uh hacked, and all of a sudden, all of these gambling platforms um that have gone to Curacao to remain pseudo-anonymous, you know, maybe anonymous, they're all having their details leaked now.
• 24:05
  SPEAKER_00: So you've got you say regulators have to do this, but at the same time, the regulators have to improve their operational security.
• 24:12
  SPEAKER_00: And if we as crypto firms are having massive problems with it and we're embedded in this industry and have challenges understanding what transactions mean or signing processes and things like that, imagine some normies that have worked in the TradFi space who have no idea how any of this works, and we've got social engineering occurring all over the place.
• 24:30
  SPEAKER_00: The North Koreans, like it, like a national government, is literally targeting uh regulators, it's targeting companies.
• 24:36
  SPEAKER_00: So I think what we need is uh well, I think it's our first point, really, which is uh we need better operational security throughout the industry, and this is gonna tack on to anybody who's trying to regulate us as well.
• 24:49
  SPEAKER_01: Yeah, I think it's it's both sides, I suppose, at the end of the day.
• 24:53
  SPEAKER_01: And I think it's gonna be a big lift for sort of a lot of companies to reach the bare minimum.
• 25:01
  SPEAKER_02: Oh, it's gonna be a huge lift.
• 25:02
  SPEAKER_02: Uh there was a great thread on Twitter the other day, um, a couple security researchers talking back and forth.
• 25:08
  SPEAKER_02: Um clients obviously complaining about uh cost of security.
• 25:14
  SPEAKER_02: It's like, oh, the AI tools, this brings it all down.
• 25:17
  SPEAKER_02: Well, yeah.
• 25:19
  SPEAKER_02: It allows us to do more quickly, but that just increases the depth.
• 25:26
  SPEAKER_02: The reason why smart contract hacks have gone down is because we now have tooling to go deep enough to like largely prevent them.
• 25:37
  SPEAKER_02: You know, uh smart contract bug hacks have like largely fallen off a cliff in uh the past year.
• 25:43
  SPEAKER_02: But what's gone up and what needs to happen next is monitoring, opsec, uh infrastructure uh review for security and lockdown of processes.
• 25:58
  SPEAKER_02: So if anything, the cost to stay secure is going up as the industry grows up, you know, but it's only doing that because once upon a time, crypto was doing one thing: smart contract audit, nothing else.
• 26:16
  SPEAKER_02: And now they have to pay attention because the hackers moved in and started attacking them there.
• 26:21
  SPEAKER_02: So now you have to defend those spaces.
• 26:23
  SPEAKER_02: And that's gonna be a hard lesson for I think a lot of new protocols to learn that your security budget, you know, as you start hitting MILS and TBL, uh, needs to be a more substantial chunk of uh your budget than you may have been used to in the past.
• 26:42
  SPEAKER_02: And it's certainly no longer, you know, it never should have been a one-off audit and done, but now it just absolutely can't be.
• 26:55
  SPEAKER_01: Yeah.
• 26:56
  SPEAKER_01: It's uh a changing world for people, I suppose, isn't it?
• 27:00
  SPEAKER_01: And I don't I don't think people really realize they say the but they see the big number hacks that happen, but maybe they think, oh, it won't happen to us.
• 27:07
  SPEAKER_01: But more and more it it is.
• 27:11
  SPEAKER_00: Well, you've got vibe coding allowing uh new people to come into the industry.
• 27:16
  SPEAKER_00: They're creating these gargantuan smart contracts which take even longer to audit, they're releasing front ends which haven't been pen tested, they don't understand, maybe they're too young, don't really haven't been through the ringer, haven't been hacked, haven't like interacted with any North Koreans before.
• 27:34
  SPEAKER_00: Um, and they're just that they're just gonna have a massive amount of problems.
• 27:37
  SPEAKER_00: So the more protocols we see, the more likelihood of them getting hacked is really there.
• 27:41
  SPEAKER_00: And Greg's right, they they need to be paying attention to operational security and processes.
• 27:46
  SPEAKER_00: And if they're not, um, we're gonna have a massive problem ahead of us.
• 27:49
  SPEAKER_00: Um, but hopefully that's after this bull market.
• 27:52
  SPEAKER_00: That would be wonderful if all the hackers could just take some time off for a few years.
• 27:55
  SPEAKER_00: That would be great.
• 27:57
  SPEAKER_00: That'd be lovely.
• 28:01
  SPEAKER_01: Rightyo guys, I think that's pretty much everything from from my side today.
• 28:07
  SPEAKER_01: Unless anything else you guys want to dive into before we sign off.
• 28:12
  SPEAKER_02: Um I mean, I think the only other thing we were talking about before was you know, kind of it leads into what Charles is rating on.
• 28:25
  SPEAKER_02: And I think uh some stuff that Web3 protocols really need to start researching and paying attention to, which is what our compliance framework, how do they get started, you know, what is ISO 2701, what is SOC 2, what is SOC 2 type 1, what is SOC 2 type 2, you know, and what they can do to prepare themselves and how to, you know, approach this kind of new world of security.
• 28:55
  SPEAKER_02: And um so I think uh it's a bit deep to go into here, but I think we should just uh leave people with some homework to uh look up those uh look up those things and then Yeah, and then uh maybe next issue a hard wire, we can do uh maybe a deeper dive on compliance.
• 29:16
  SPEAKER_00: That actually sounds like a great idea.
• 29:17
  SPEAKER_00: I'd really enjoy doing that, Greg.
• 29:19
  SPEAKER_00: I think that's that's wonderful.
• 29:20
  SPEAKER_00: And we can even cut look at the certifications and things like that and why people need them, uh, what they need to do in terms of landing institutions and how this can all bundle up together to make a package where you can go to a compliance or risk team and basically like, there you go, we've done our homework first and uh we're ready to onboard you.
• 29:38
  SPEAKER_00: So yeah, I think that'd be very useful and leads leads on quite well.
• 29:42
  SPEAKER_00: So yeah, great idea.
• 29:45
  SPEAKER_01: No, sounds sounds perfect to me.
• 29:47
  SPEAKER_01: Well, thank you very much, Greg.
• 29:48
  SPEAKER_01: Thank you very much, Charles.
• 29:49
  SPEAKER_01: This has been hardwired.
• 29:51
  SPEAKER_01: It's been great having you both on.
• 29:53
  SPEAKER_01: Thanks for taking the time.
• 29:55
  SPEAKER_01: Thank you, Eric.
• 29:55
  SPEAKER_01: Thank you very much.
• 29:57
  SPEAKER_01: Thanks.