Latest / Hardwired by AlphaWire / The State Of Risk In DeFi #03 | ft. Charles Holmes & Greg Bock

Transcript

The State Of Risk In DeFi #03 | ft. Charles Holmes & Greg Bock · Hardwired by AlphaWire

• 0:00
  SPEAKER_02: So, hello everybody.
• 0:02
  SPEAKER_02: Welcome to another episode of Hardwired.
• 0:05
  SPEAKER_02: This is another episode in a little series we're doing called The State of Risk in DeFi.
• 0:10
  SPEAKER_02: And I'm with uh Charles Holmes and Greg Bok.
• 0:14
  SPEAKER_02: Thank you very much for both coming along again.
• 0:17
  SPEAKER_02: Um I'll I don't think we'll keep doing introductions, but very, very quick one if you just want to see where you're from and the company and stuff, and then we'll we'll dive into what we're going to talk about today.
• 0:26
  SPEAKER_00: Great.
• 0:27
  SPEAKER_00: Hi, I'm Bach.
• 0:28
  SPEAKER_00: I'm with Fidesium.
• 0:29
  SPEAKER_00: We are a Web3 security firm, smart contract audits, pen testing, and the like.
• 0:36
  SPEAKER_01: Hi, I'm Charles.
• 0:37
  SPEAKER_01: I'm from Verdict.
• 0:38
  SPEAKER_01: Uh we run a risk intelligence platform that's a marketplace.
• 0:42
  SPEAKER_01: We offer ratings, coverage, insurance, um, and all sorts of wonderful things to make your protocol as safe as it possibly can be.
• 0:52
  SPEAKER_02: Well, thank you very much for both of you coming along again.
• 0:55
  SPEAKER_02: It's becoming a little bit of a regular occurrence now, us three talking about what's going on in well, security and web three, I suppose, is the overarching theme.
• 1:04
  SPEAKER_02: And we have got a big topic to discuss today, which if you've been anywhere near Crypto Twitter for the past week or two, you will have seen.
• 1:13
  SPEAKER_02: But that is the ledger hack.
• 1:15
  SPEAKER_02: Um, for anybody that's not seen, there was a distributor ran out of Malaysia, I believe, called CryptoBillis, and they were sold to a Chinese person entity or company, and that entity then made them sign an NDA so that they couldn't announce that they've been sold for quite a little bit of time, and they started adding a very small piece of hardware to all of the ledger wallets that they were selling, so much so that now we wake up to see an$84 million hack has happened, where these from what the kind of crypto researchers on Twitter have said anyway, is that they were not engaging with the the kind of wallet itself that didn't trip um ledgers like security protocols, but it allowed them to view anything that was happening on the device.
• 2:04
  SPEAKER_02: It was like a view-only module, supposedly.
• 2:07
  SPEAKER_02: This meant that whenever you kind of spun up your first wallet and you saw your seed phrase for the first time, they could also see it.
• 2:13
  SPEAKER_02: And at such a point that they decided to execute on this hack, they obviously utilized all the seed phrases and drained all the wallets.
• 2:20
  SPEAKER_02: So that that's the facts as I know it.
• 2:22
  SPEAKER_02: Correct me if I've got any of them, any of them wrong, but interested to hear what you guys have to say about what's going on.
• 2:28
  SPEAKER_01: Well, a little caveat to start off is uh they've been found as of today in Singapore's airport.
• 2:35
  SPEAKER_01: So there's uh a ledger was sold in Singapore's airport that uh had uh one of these uh SIM cards and chips uh beneath the screen.
• 2:44
  SPEAKER_01: Um so it's not just limited to you know buying from a vendor.
• 2:49
  SPEAKER_01: Um you can actually, you know, be so succumb to this uh challenge, these hacks um by you know buying it from what appears to be an official vendor in a physical place as well.
• 2:59
  SPEAKER_00: Uh yep, they are also in Europe.
• 3:02
  SPEAKER_00: Uh there's uh new report uh guy bought one from a store.
• 3:07
  SPEAKER_00: They're trying to trace where he purchased his stock from.
• 3:11
  SPEAKER_00: Uh still unclear as of yet, as the story was breaking, but uh opened it up and yeah, the a variation of the device.
• 3:20
  SPEAKER_00: And it appears there were three generations of uh this uh attack device implanted into Ledger.
• 3:28
  SPEAKER_00: Uh Harry, you're mostly correct.
• 3:30
  SPEAKER_00: It basically grabbed the data stream between the input on the board and the storage of the ledger device.
• 3:38
  SPEAKER_00: It didn't do anything, it just read it, saved it, and then sent it out when it got to nearby devices.
• 3:48
  SPEAKER_02: Absolute craziness, in it.
• 3:49
  SPEAKER_02: It is of all of the things I sort of had on my bingo card as a as something where people would would be susceptible to a hack or to their assets being stolen, it wasn't this.
• 4:01
  SPEAKER_02: Um what do you think is gonna happen next?
• 4:04
  SPEAKER_02: Do you think Ledger's gonna survive this?
• 4:06
  SPEAKER_02: My my gut feel is they probably will, they're big enough to do so, but it's it's gonna be a hell of a lot of time before I think most people will trust them again, if ever.
• 4:17
  SPEAKER_02: But especially in the kind of more professional end of DeFi users and retail users.
• 4:23
  SPEAKER_00: Well, yeah, I mean, let's not forget, it was only a couple of years ago that uh they were, you know, not responsible, but a flaw in their nano device uh was exploited uh via SDK and they were overflowing the screen, and that led to uh the Bybit hack.
• 4:43
  SPEAKER_00: Um, you know, as the most popular device, they are obviously going to be the target of a lot of this stuff.
• 4:51
  SPEAKER_00: And dealing with third-party distributors and letting devices get um out of date, especially as you know, treasury devices for large um DeFi and other large protocols.
• 5:10
  SPEAKER_00: They have not exactly been proactive.
• 5:13
  SPEAKER_00: They've been very good reactive on this one to date.
• 5:17
  SPEAKER_00: I keep on seeing their press releases, they are contacting the people that were hit by this.
• 5:22
  SPEAKER_00: Um, it looks like they're doing their best to make it right.
• 5:26
  SPEAKER_00: The funds are being tracked.
• 5:28
  SPEAKER_00: So I think they will come back.
• 5:31
  SPEAKER_00: They just have an amazingly strong name recognition, but I mean, this is absolutely gonna chip into their market share.
• 5:40
  SPEAKER_00: Um I mean, the one that the one that killed me, I was pretty vocal about it on Twitter is like you're buying a device for a store of wealth.
• 5:50
  SPEAKER_00: You go to crypto billis.
• 5:53
  SPEAKER_00: I mean, it just sounds like cryptobillies.
• 5:56
  SPEAKER_00: It's I mean, it sounds like the Wild West.
• 5:58
  SPEAKER_00: Like to save a couple bucks on the device and like maybe some faster shipping for a device to store wealth, it just really boggles my mind.
• 6:09
  SPEAKER_01: Yeah, I think uh what we're gonna see is uh again, they're probably gonna be have to react to this a little bit.
• 6:15
  SPEAKER_01: Um there was an addition of, I think it was the ledger some time ago, which had a clear body so you could see actually inside it.
• 6:21
  SPEAKER_01: And I think they're gonna have to go back to something like that so you can actually see all the internals uh just to confirm things are uh are legitimate within inside.
• 6:31
  SPEAKER_01: Um and it may change people's buying preferences as well, where they'll have to buy direct uh you know, from Ledger, from Trezor, which is another company who make these devices, uh, which is different.
• 6:44
  SPEAKER_01: And I think they maybe have to introduce more seals, uh, some official seals or something like that.
• 6:50
  SPEAKER_01: Um, like just so that you can confirm it hasn't been opened beforehand.
• 6:54
  SPEAKER_01: Um, something like that needs to happen.
• 6:57
  SPEAKER_02: I think this is going back a few years when I last bought my last device, but I remember there being quite a few seals.
• 7:04
  SPEAKER_02: Like they did, they did come in quite a secure kind of official packaging.
• 7:08
  SPEAKER_02: It it really shocked me.
• 7:10
  SPEAKER_02: I was quite surprised that something like this had happened.
• 7:12
  SPEAKER_02: But you are right, I would have probably never entertained buying from a a sec a third-party distributor.
• 7:18
  SPEAKER_02: Um, like I even got a um alleger device given to me at a Solana event in Paris a few years ago.
• 7:24
  SPEAKER_02: I never opened it.
• 7:25
  SPEAKER_02: I just kind of have it as a bit of a keepsake.
• 7:28
  SPEAKER_02: But like, it is really quite difficult to know what are the best practices to use and how that's even going to make you secure.
• 7:36
  SPEAKER_02: I suppose one of my questions would be how could you make yourself even more secure?
• 7:41
  SPEAKER_02: Would it be utilizing a multi-signature wallet and splitting up the keys across maybe a couple of the different hardware wallet providers at the end of the day?
• 7:49
  SPEAKER_02: You could do that.
• 7:50
  SPEAKER_02: There's nothing to stop you.
• 7:53
  SPEAKER_01: Okay, you could do that with safe, I think, to be perfectly honest.
• 7:56
  SPEAKER_01: Set up a safe wallet and then it's just the faff, basically, that I suppose would stop quite a lot of people from doing that.
• 8:02
  SPEAKER_01: Um, it's quite clunky.
• 8:03
  SPEAKER_01: You've got to take one device out, put another one in.
• 8:05
  SPEAKER_01: Um, actually, maybe that works with a Trezor and a ledger.
• 8:08
  SPEAKER_01: I've never actually tried plugging in a Trezor and a ledger at the same time.
• 8:11
  SPEAKER_01: Boc, have you heard of anybody using that type of situation?
• 8:15
  SPEAKER_00: Oh, I think there's some custom stuff out there.
• 8:18
  SPEAKER_00: I have not uh played around too much on that, and most people I know are safe enough with, you know, buy from the distributor, check the device, you know, only use it when moving like big fonts, you know, just air gap everything you can, never connect it to your phone.
• 8:40
  SPEAKER_00: Um yeah, I mean, they're how to stay safe is just you need to be cautious and 100% switched on at every step.
• 8:50
  SPEAKER_00: And unfortunately, ordering from a third-party supplier is just a no-no.
• 8:58
  SPEAKER_00: It's one of those things where it happens due to convenience, a little bit on price, and but it is less secure as you know this supply chain attack proved.
• 9:08
  SPEAKER_00: And um, Harry mentioned it earlier.
• 9:11
  SPEAKER_00: Uh I mean, what a kind of stroke of genius by the the attackers in this is 100% management buyout, ironclad NDA, an NDA so strong that the third-party reseller wasn't even allowed to tell Ledger who this product they were distributing that the buyout was happening.
• 9:36
  SPEAKER_00: And I'm sure they couched it as, you know, all trade secrets, we're moving into this market, we don't want the news to leak, but they essentially gagged them for like I think six to eight months.
• 9:49
  SPEAKER_00: And you know, while it might have still gone on, I think there's enough security professionals around that um oh god, uh, I'm trying to remember the name.
• 10:03
  SPEAKER_00: I don't have it now.
• 10:04
  SPEAKER_00: We can maybe fill it in after in one of the posts, but the security researcher who found it just happened to be opening up a device.
• 10:14
  SPEAKER_00: And as he opened up the device and started posting on Twitter, that was the dead man switch and um set off all the drains.
• 10:27
  SPEAKER_00: So had he not just happened to open that device, this could have been even much, much worse.
• 10:33
  SPEAKER_00: They'd been distributing these devices for months, they were getting them into people's hands, uh, they were accruing value for everyone who used a poison device.
• 10:42
  SPEAKER_00: And if this guy had not cracked it open and posted on Twitter, it could have gone months and months longer, and the damage could have been 2x, 3x, 5x.
• 10:54
  SPEAKER_00: So yeah, really, really sobering thoughts.
• 10:57
  SPEAKER_01: And they were using a SIM card as well, weren't they?
• 10:59
  SPEAKER_01: They'd actually literally put a SIM card underneath the screen.
• 11:02
  SPEAKER_00: Yeah, yeah, yeah.
• 11:03
  SPEAKER_00: Uh, because that's how they that's how they were transferring the you know, didn't need much SYN card with one pack of data on it.
• 11:12
  SPEAKER_00: Once they got that, it fires.
• 11:15
  SPEAKER_00: Um, and it was the safest way for them to do it because if they had tried to rely on uh Wi-Fi, Bluetooth, or whatever and hoping uh nearby devices were listening, um, it's just another place they could have got caught, right?
• 11:31
  SPEAKER_00: They could have got hit by somebody monitoring the uh traffic going through their other device.
• 11:38
  SPEAKER_00: Just hitting cellular.
• 11:39
  SPEAKER_00: I mean, unless you uh actually there you go.
• 11:43
  SPEAKER_00: Here's another way you could be safe.
• 11:44
  SPEAKER_00: Store your ledger in a Faraday cage.
• 11:50
  SPEAKER_00: And hysterically, um, I mean, it sounds a bit like a joke, but there are a couple really good companies that uh sell uh handkerchiefs and pouches uh that are portable Faraday cages.
• 12:03
  SPEAKER_00: They are sewn with uh silver thread throughout the uh cloth, wrap it, no signal gets through.
• 12:10
  SPEAKER_00: And I mean, honestly, not a bad idea for storing a device uh just in case it might get signal.
• 12:19
  SPEAKER_01: The other option is uh, you know, when you buy lipo um batteries, lithium-ion batteries, they come in these wonderful burn bags, and they're little Faraday cages as well.
• 12:31
  SPEAKER_01: They're a cup like 10, 20 quid.
• 12:33
  SPEAKER_01: You can buy those, uh, stick your wallets in there, and uh yeah, it's it protects it from fire as well as uh any interference as well.
• 12:42
  SPEAKER_00: Oh, brilliant.
• 12:43
  SPEAKER_00: The more you know.
• 12:45
  SPEAKER_02: One thing I saw on Twitter was people saying you might be more secure just using a second mobile phone because the supply chain and the the risks of Apples, like if you go with Apple, with their is it their SDK or their kind of their security enclave for things being stored on a on a mobile device was possibly more secure than than anybody else?
• 13:09
  SPEAKER_02: Kind of made a lot of sense to me.
• 13:11
  SPEAKER_02: Like, yes, you're using kind of a mobile wallet in inverted commas um application, but would it not be more secure if the only thing that device is used is to connect to the Wi-Fi once in a while at your home address?
• 13:25
  unknown: Yeah.
• 13:26
  SPEAKER_00: Well, yeah, especially if it doesn't leave your house, um, if it's always on your network.
• 13:31
  SPEAKER_00: And I think that brings us to uh another point.
• 13:34
  SPEAKER_00: Uh news out of Singapore, someone had their uh wallet drained.
• 13:40
  SPEAKER_00: Uh we heard 40,000, 400,000, and the official story now stands at 4 million, and I am just astonished that someone travels with a phone with that much stored.
• 13:58
  SPEAKER_00: I mean, that seems like the I mean that is just as dangerous as it gets to begin with.
• 14:04
  SPEAKER_00: But to your point of a second phone, I think a second phone is a viable solution as long as the phone never leaves your house.
• 14:13
  SPEAKER_02: Yeah.
• 14:14
  SPEAKER_02: I I I suggest it to a lot of people that are like they don't really want to deal with a hardware wallet because they kind of get it gets them like I don't really know how to use that.
• 14:22
  SPEAKER_02: I'm like, just get a brand new, like doesn't have to be top of the range at all, like either Android or Apple device.
• 14:29
  SPEAKER_02: Don't ever put a sim in it, don't turn on anything other than Wi-Fi once in a while to set the thing up.
• 14:35
  SPEAKER_02: Don't log into any email, don't go on the browser.
• 14:40
  SPEAKER_02: Yeah, just use it as a wallet.
• 14:41
  SPEAKER_02: Like it is just a dumb phone wallet, and the screen's easy to use.
• 14:45
  SPEAKER_02: You can read the transactions, you can use it to look up etherscan or vtc scan or whatever you're doing just to see the transactions gone through, and that's it.
• 14:53
  SPEAKER_02: Like, just use it for that.
• 14:54
  SPEAKER_00: None of that, Charles.
• 14:56
  SPEAKER_01: You just went uh I think we've had a connection is unstable.
• 15:01
  SPEAKER_01: Apparently, I need to reconnect.
• 15:03
  SPEAKER_01: Do you want me to click reconnect?
• 15:05
  SPEAKER_01: Yeah, try reconnect.
• 15:07
  SPEAKER_02: So a bit of technical difficulties there.
• 15:09
  SPEAKER_02: We are back.
• 15:11
  SPEAKER_02: We were just discussing the topic of safety at conferences, and I believe you had a point to bring up, Charles.
• 15:19
  SPEAKER_01: Yeah, I mean, uh, as uh as Bok was being at the uh Token 2049, uh, and we've just discussed uh the issue with the gentleman losing four million.
• 15:29
  SPEAKER_01: I was wondering, Bok, if you had any uh ideas or best practices for maintaining your security posture at a conference.
• 15:38
  SPEAKER_01: Like, what is your do's and don'ts list really for uh being at a conference of DJ?
• 15:43
  SPEAKER_00: Oh, yeah.
• 15:43
  SPEAKER_00: Um never scan a QR code unless you know the source, unless you see the other person open their phone, go to their telegram, and it is their just QR code generated by Telegram for their uh account or their LinkedIn.
• 16:00
  SPEAKER_00: But other than that, no other QR codes.
• 16:03
  SPEAKER_00: Certainly nothing stuck to a wall, advertising an airdrop.
• 16:07
  SPEAKER_00: I mean, that's just silly time.
• 16:09
  SPEAKER_00: Uh, never hand your phone over.
• 16:11
  SPEAKER_00: I've seen people do this, it just makes me shiver every time I do it.
• 16:15
  SPEAKER_00: Like, oh, it's just easier if I enter my number and I've watched people hand their phones to a stranger to input a number, which just don't hand over your device.
• 16:25
  SPEAKER_00: That's uh that's crazy.
• 16:28
  SPEAKER_00: Uh be wary accepting links, certainly from groups, uh, especially on a phone.
• 16:34
  SPEAKER_00: It's really uh much more difficult uh to check to see if the link is spoofed uh in any kind of way, even if it's for another event.
• 16:44
  SPEAKER_00: You know, Telegram, it is very, very easy to uh spoof links uh for uh hackers these days.
• 16:52
  SPEAKER_00: It can say, you know, luma dot whatever on the screen, uh, but the underlying link can uh redirect to a page of their choosing, and you might not catch it on mobile, right?
• 17:04
  SPEAKER_00: It's just uh much harder to uh catch those things.
• 17:07
  SPEAKER_00: Uh the other one is uh the second you're back from the conference.
• 17:12
  SPEAKER_00: I mean, honestly, a good one is at the end of every night, go through your main accounts, check for anomalous activity, any kind of sign-in attempts to any of your accounts will let you know if people are targeting you.
• 17:28
  SPEAKER_00: Uh, there was a new one uh this time, I think for all of our friends out there who do uh crypto conferences, uh a big favorite uh around, so you remember the conversation is exchange details, take quest selfie with whoever you just met, and send that to the other person.
• 17:48
  SPEAKER_00: So you have uh memory jogger what's uh what was happening and where you were.
• 17:55
  SPEAKER_00: Uh with the rise of AI and how cheap uh video fakes are getting, um distributing a natural photo of yourself, especially with someone who might be an attacker, is probably a very bad idea.
• 18:11
  SPEAKER_00: Getting, you know, turning that photo into you saying something you would never say is, you know, 15 seconds of work on uh with Grok.
• 18:20
  SPEAKER_00: Um and then the last one would be it's old school, but uh never sign into anything uh sensitive over uh event Wi-Fi.
• 18:35
  SPEAKER_00: You know, uh there could be pineapples around, there could be spoofed uh Wi-Fi systems that are intercepting your packets, um, even if you know they are encrypted in transit, they can be unencrypted.
• 18:50
  SPEAKER_00: You just don't want to give that kind of information away.
• 18:53
  SPEAKER_00: So yeah, I think uh following those would be.
• 18:58
  SPEAKER_01: Sorry, Mark.
• 19:00
  SPEAKER_01: No or I was just about to say, can you explain to people what a pineapple is?
• 19:05
  SPEAKER_01: Because some people wouldn't have heard of a pineapple before.
• 19:08
  SPEAKER_00: Oh, okay.
• 19:09
  SPEAKER_00: Uh so uh pineapple is a router with uh eight to twelve antennas, and it just looks like the top of a pineapple, and it's just very good at catching signal if they're distributed around a conference.
• 19:23
  SPEAKER_00: Uh, it is very uh easy to get a stronger, better signal off this in-place high-end router that is attached to a very small box that just does interceptions.
• 19:37
  SPEAKER_00: It routes it through back through the actual conference uh Wi-Fi.
• 19:41
  SPEAKER_00: It doesn't provide its own, but it acts as uh man in the middle attack and captures data on its way to the uh wider world.
• 19:50
  SPEAKER_00: Perfect.
• 19:52
  SPEAKER_02: It is it is kind of maddening how many attack vectors there are, and I suppose it's such a target-rich environment.
• 20:00
  SPEAKER_02: Like, why wouldn't they try and attack people at conferences, especially people that maybe don't understand how at risk they are, maybe they're like new to this industry or new to cybersecurity as a whole.
• 20:11
  SPEAKER_02: It's you have to be kind of on your toes.
• 20:14
  SPEAKER_02: Um but even when you're not at a conference, there's been reports that I've been seen over Twitter and LinkedIn of pull people pretending to be police officers.
• 20:23
  SPEAKER_02: Uh, I have a a mutual friend of ours that that got um contacted by this kind of group, pretending to be a police officer, saying that you've been involved in an identity scam, saying that they've got your details, listing off a load of exchanges and saying that they've got access and things, and that there's a crime reference number.
• 20:42
  SPEAKER_02: Like it sounds very official.
• 20:44
  SPEAKER_02: Some people have been even posting screenshots of emails with Metropolitan Police headings on them from spoofed addresses that look similar but aren't exactly the right ones, and then people are getting phone calls supposedly from a customer service representative at one of the exchanges, and this is all to either get you to download something or to log into a phony front end that then means they can get into their accounts.
• 21:10
  SPEAKER_02: But what do you do?
• 21:11
  SPEAKER_02: How do you manage about that?
• 21:12
  SPEAKER_02: It is it is so well.
• 21:15
  SPEAKER_00: I mean, it's just it's just be on guard.
• 21:17
  SPEAKER_00: It's just knowing that those people, I mean, they say it in all the ads, they're never gonna ask for personal information, like they should have it.
• 21:24
  SPEAKER_00: They're never gonna ask for any kind of passwords or that sort of thing.
• 21:30
  SPEAKER_00: Uh the phone one's really scary.
• 21:32
  SPEAKER_00: Uh so I also have a friend who was targeted by this.
• 21:36
  SPEAKER_00: Um, and the caller ID showed up as Sheffield Police Department.
• 21:41
  SPEAKER_00: So uh both I think uh four boroughs now have released warnings, uh Sheffield, Kent, Newport, and someone else, uh that in one case, uh number went out of service, and the uh hacking group uh like got the Number, uh, transferred it, and the caller ID still stayed the same.
• 22:04
  SPEAKER_00: Uh in the other cases, they're saying uh just the caller ID uh was spoofed, which is another thing you can do.
• 22:13
  SPEAKER_00: And that's what's been uh leading to these calls and this new range of attacks.
• 22:18
  SPEAKER_00: But the fact that four boroughs uh police stations released uh statements on this shows that it is obviously very widespread.
• 22:32
  SPEAKER_00: Um, but yeah, the thing is never give out personal details.
• 22:37
  SPEAKER_00: Um if they say they are from a police station, they want to talk to you, say fine.
• 22:43
  SPEAKER_00: Look up the number of the police station, call the police station directly, ask if they're trying to contact.
• 22:50
  SPEAKER_00: Um it's the same with all this, it's the same for the meeting scam uh with bad links.
• 22:56
  SPEAKER_00: You know, always take meetings on your own uh account if possible.
• 23:02
  SPEAKER_00: Never um just never go to a meeting that is on anything other than I mean, I would say never do it any anything other than uh Google Meet uh just because Google pays a lot of attention uh to spoofed addresses and they're very vigilant about taking down anyone who uh does spoof their addresses.
• 23:32
  SPEAKER_00: I have seen uh multiple phony misspellings of Microsoft Teams invites.
• 23:39
  SPEAKER_00: I've seen multiple on um fake Zoom uh URLs with incorrect domains, so zoom.etu, right, you know, whatever.
• 23:56
  SPEAKER_00: And they redirect to a phony version of the entire website with a meeting start link, and it's when you get into the meeting, it says, Oh, your Microsoft's are your microphones not recognized, please uh paste this into your console.
• 24:13
  SPEAKER_00: Never paste anything into your console.
• 24:16
  SPEAKER_00: Um, but yeah, bad.
• 24:17
  SPEAKER_00: The uh the the hackers are getting on one hand slightly more aggressive, uh, but I think it's due to two things.
• 24:28
  SPEAKER_00: Uh the proliferation of the tools that make it quite a bit easier for them.
• 24:34
  SPEAKER_00: And the second thing is uh crypto, uh even though we love it, is just a very target-rich environment.
• 24:43
  SPEAKER_00: It's a it's a one-shot two funds that can be transferred very easily.
• 24:51
  SPEAKER_00: And so it just makes it makes itself profitable because the value is stored right there.
• 25:00
  SPEAKER_00: And the second they get access to your keys, there's no stopping it, you know, unless you can beat them to the punch and move the funds out of the wallet before they get in.
• 25:09
  SPEAKER_00: Uh, it's really your only solution.
• 25:12
  SPEAKER_00: I mean, I think uh tracking down and fund recovery is still only at about 20% for all hacks, uh simply because the hackers are getting so proficient at jumping chains and moving through different bridges and shuffling the money around that even when the hack is noticed, if the incident response team isn't absolutely on their toes, the money is usually gone through several hops before they uh they can find it.
• 25:45
  SPEAKER_00: It gets very difficult to unwind that.
• 25:48
  SPEAKER_02: Yeah.
• 25:49
  SPEAKER_02: I suppose one thing we've not spoken about today is recovery.
• 25:53
  SPEAKER_02: I hear sporadic stories of people being able to get these things back.
• 25:57
  SPEAKER_02: Tends to be when it's in stable coins and you react very, very quickly.
• 26:01
  SPEAKER_02: But the majority of the time when it's not when an entity gets hacked for a very large singular amount, but when it's multiple um what they called victims, um, the likelihood of recovery is pretty low.
• 26:15
  SPEAKER_02: Like what what's your being your guys' kind of understanding of that out in the wild?
• 26:22
  SPEAKER_02: Charles, anything?
• 26:24
  SPEAKER_01: Um as someone who's had some rather interesting encounters with Lazarus Group in the past, um, there are certain solutions that you can go to that can help get things flagged.
• 26:36
  SPEAKER_01: Um, often there's no recourse when it comes to losing capital.
• 26:40
  SPEAKER_01: Um, you're quite right, Harry, that if they are stables, then a lot easier to do because you've got a tether in particular, could freeze things a lot quicker than Circle can.
• 26:49
  SPEAKER_01: Um, but when it comes to like losing some ETH or anything like that, they can be moved across chains.
• 26:55
  SPEAKER_01: They there's various bridges and things like that to get them out rather quickly.
• 26:58
  SPEAKER_01: Um, so it's just basically watching where they go and then seeing if uh seeing if you can go find a reputable company to help you.
• 27:06
  SPEAKER_01: But uh it it's really challenging, and I I do feel for anybody who's lost funds.
• 27:11
  SPEAKER_02: Well, even even look at what's come out of the UK High Court, I think it was just today.
• 27:16
  SPEAKER_02: Um, so 61,000 Bitcoin were recovered from a Chinese-based um scam, and the High Court looks like they're going to rule that the UK is going to keep it.
• 27:30
  SPEAKER_02: So even when it ends up in the hands of a government, they're like how you might get your funds back.
• 27:35
  SPEAKER_02: Now I'm sure there's lots of complexities to do with it being China and a and a hacking scam.
• 27:40
  SPEAKER_02: I think it's quite an old hacking scam as well.
• 27:42
  SPEAKER_02: Like, there's obviously more complexities at kind of the roots of it, but the outcome for the people that lost funds is the same, which is you're not getting it back.
• 27:52
  SPEAKER_01: See, I didn't think of the angle of people that had actually lost funds.
• 27:56
  SPEAKER_01: I was like hoping that the UK could start some sort of Bitcoin treasury for ourselves that we'd actually do something worthwhile in tech for on.
• 28:03
  SPEAKER_01: But yeah, um, if there are any impacted, yeah, they should get their funds back, really.
• 28:07
  SPEAKER_02: I think that well, that's what the majority so the sum that's the proceeds of crime where it's they had been paid in it, for example.
• 28:16
  SPEAKER_02: But the the the vast majority of the UK seized Bitcoin holding is this is from this Chinese scam.
• 28:22
  SPEAKER_02: And I think it was like a doubling scam where people invested money and they they obviously told they get double back or something like that, and the perpetrators got caught in the UK or something like that.
• 28:34
  SPEAKER_02: I don't know all the facts of this case, I I've just read the headline, but it goes to kind of say that it doesn't matter who finds it, the likelihood of recovery is is low.
• 28:43
  SPEAKER_02: So an ounce of prevention is is kind of worth any more than trying to uh trying to reclaw it back at the end of it.
• 28:50
  SPEAKER_02: Um those were the those were my main topics I wanted to kind of touch on today.
• 28:55
  SPEAKER_02: Is there anything you guys want to bring up or just draw to before we before we wrap up?
• 29:01
  SPEAKER_01: Uh hammer attack in London.
• 29:04
  SPEAKER_01: So uh some board cottage was uh uh had three gentlemen come round with knives uh while they had their family in the house.
• 29:13
  SPEAKER_01: Uh I think they'd lost about 800k or something like that.
• 29:16
  SPEAKER_01: Um so this is only going to increase as KYC without zero knowledge proofs uh are demanded throughout the industry due to regulations.
• 29:27
  SPEAKER_01: So yeah, I mean that's the only thing uh that I dislike seeing at the moment in terms of security at the moment in the world.
• 29:34
  SPEAKER_01: Um and hopefully we don't get to a stage where that we're the same as France, where this is almost a daily occurrence.
• 29:41
  SPEAKER_02: Yeah, that that is it is quite scary to read about what goes on in France.
• 29:45
  SPEAKER_02: I think that stems from the fact that didn't you have to register for tax reasons and you go on a list or something, and the government individual was sharing that list with the criminals.
• 29:57
  SPEAKER_02: Like it is so many attack vectors, like you have really got to think about how you're securing your home, how much you put online about what you do.
• 30:04
  SPEAKER_00: It's gonna put nothing online if you can help it.
• 30:08
  SPEAKER_00: But I mean, it's it's what really scares me about all these digital ID schemes.
• 30:13
  SPEAKER_00: The every government government, especially the UK and the EU, have proven time and time and time again they are horrible.
• 30:27
  SPEAKER_00: I mean atrocious at data security, yet they keep pushing these schemes and uh policies that want to centralize uh someone's entire identity.
• 30:42
  SPEAKER_00: And you know, let's let's forget the uh you know impacts on privacy this could have for a second.
• 30:51
  SPEAKER_00: But just as a just as a measure of security, centralizing all this information about a person into one place and linking it together is absolutely insane, especially when they they simply do not take care of the data.
• 31:08
  SPEAKER_00: You know, the uh the UK uh just what was it, just uh months ago, uh they left a company's house just wide open.
• 31:19
  SPEAKER_00: You could just go to a company and change the owner's email just by cycling through.
• 31:26
  SPEAKER_00: It was it was mad.
• 31:28
  SPEAKER_00: Uh there's been several data breaches, uh, personal information, medical records.
• 31:35
  SPEAKER_00: Um I don't know if tax has been hit in the UK, but I know uh a bunch of tax files uh went missing in uh the European Union.
• 31:44
  SPEAKER_00: And yeah, I like I mean the number one thing about security, I'd say don't trust your government.
• 31:52
  SPEAKER_02: Yeah.
• 31:54
  SPEAKER_02: Well, on that cheery note, it's been it's been a positive episode this week.
• 31:59
  SPEAKER_02: I know I know this the state of risk does mean that we are going to talk about kind of bad things going on, but it has been a particularly depressing week in the world of security.
• 32:09
  SPEAKER_02: Um on the on the slight positive note, all the markets seem to be going up.
• 32:14
  SPEAKER_02: Bitcoin seems to be somewhat in an uptrend.
• 32:16
  SPEAKER_02: We'll see if that continues.
• 32:18
  SPEAKER_02: I'm supposed we can have a bit of a talk about that next week and and maybe we can harken our minds back to hacks that have gone on in exchanges in years gone by and and what things changed in the industry since then.
• 32:30
  SPEAKER_00: Oh, yeah, yeah.
• 32:31
  SPEAKER_00: We could have a nice uh nice discussion about uh security in a boom market, if anyone remembers what those are.
• 32:37
  SPEAKER_00: Yes.
• 32:38
  SPEAKER_02: No, thank you very much for everybody coming on.
• 32:40
  SPEAKER_02: It's been great.
• 32:41
  SPEAKER_02: This has been another episode of Hardwired, and yeah, thanks for coming along.
• 32:45
  SPEAKER_02: Thank you, Harry.
• 32:46
  SPEAKER_02: Thank you, Charles.
• 32:47
  SPEAKER_00: Thank you, sir.
• 32:48
  SPEAKER_00: Cheers, goodbye.