Latest / The Starting Block / AI-armed attackers deepen crypto's 2026 hacking crisis

Transcript

AI-armed attackers deepen crypto's 2026 hacking crisis · The Starting Block

• 0:04
  Back to the starting block.
• 0:06
  It's Friday. You've made it to the
• 0:07
  end of the week.
• 0:08
  Congratulations.
• 0:09
  The markets aren't looking too bad,
• 0:11
  as you can see in the price ticker
• 0:13
  above me.
• 0:14
  So yeah, here we are at the end of
• 0:16
  the day. If you haven't joined us
• 0:18
  this week for the starting block,
• 0:19
  we've had some fantastic guests on
• 0:21
  the show. We had Jesse Pollack join
• 0:23
  us yesterday from BASE to talk to
• 0:25
  us about his recent announcement
• 0:27
  about Kobe taking over the base app.
• 0:29
  And a number of other goings
• 0:31
  on at Coinbase.
• 0:32
  If you want to go and watch that
• 0:33
  interview, we just uploaded it to
• 0:35
  the Blocks YouTube channel.
• 0:37
  So if you're watching today's
• 0:39
  show on YouTube, please go ahead
• 0:41
  and subscribe.
• 0:42
  And if you are interested in hearing
• 0:43
  from Jesse Pollack, you can go and
• 0:44
  find that video on our YouTube
• 0:46
  channel, we also have our
• 0:48
  conversation with Jamison Lopp
• 0:50
  earlier this week, talking
• 0:52
  in depth about the cold card exploit
• 0:54
  and what that means for Bitcoin
• 0:55
  custody.
• 0:56
  That video is doing good numbers on
• 0:58
  our YouTube channel so you can also
• 0:59
  go. And check that one out.
• 1:02
  And while you're at it, if you're
• 1:03
  watching this live on X
• 1:05
  this afternoon, please give us a
• 1:06
  like and a retweet so we can have
• 1:08
  more people join us for today's
• 1:10
  conversation. It's gonna be a good
• 1:12
  one. But of course, before we get
• 1:14
  into that, I'm going to jump
• 1:15
  straight into the block briefing
• 1:16
  this afternoon to give you the
• 1:18
  top stories you need to know from
• 1:20
  the last 24 hours.
• 1:22
  And bringing up our first headline,
• 1:24
  The Wait Continues,
• 1:26
  Senate Majority Leader John Tune.
• 1:28
  Has confirmed to the block that the
• 1:30
  chamber is delaying its vote on the
• 1:32
  Clarity Act, the landmark crypto
• 1:34
  market structure bill, until
• 1:35
  lawmakers return from their August
• 1:37
  recess next month.
• 1:39
  June says Democrats were
• 1:41
  insistent on no vote this
• 1:43
  week, but the bill will be quote,
• 1:45
  queued up first thing when we come
• 1:47
  back. With the Senate breaking
• 1:48
  Friday and attention shifting
• 1:50
  towards November midterms,
• 1:52
  that narrow September window becomes
• 1:54
  pivotal.
• 1:55
  Republicans still need 60 votes
• 1:57
  and that means winning over
• 1:59
  reluctant Democrats.
• 2:00
  If you wanna go read more on that
• 2:02
  story, you can find it on the
• 2:04
  Block's website. That's the Block
• 2:05
  Co.
• 2:06
  Some great reporting from Sarah Wynn
• 2:08
  from our news team.
• 2:09
  Then, applesauce.
• 2:10
  That's a word a Michigan federal
• 2:12
  judge used to describe Coinbase's
• 2:14
  arguments.
• 2:15
  Judge Shalina Kumar denied the
• 2:17
  exchange's bid to block state
• 2:19
  enforcement of its planned sports
• 2:21
  event contracts.
• 2:22
  Ruling Coinbase failed to show.
• 2:24
  Federal commodities law preempts
• 2:27
  Michigan's authority.
• 2:28
  Coinbase had argued prediction
• 2:29
  markets fall under the CFTC,
• 2:32
  not state regulators,
• 2:34
  and that complying with both was
• 2:35
  impossible.
• 2:36
  The judge disagreed writing it's
• 2:38
  quote, not impossible simply because
• 2:40
  it's costly and challenging.
• 2:42
  It's one front in a nationwide
• 2:44
  battle.
• 2:45
  Coinbase is also suing Illinois
• 2:47
  and Connecticut.
• 2:49
  Then our next story, crypto meets
• 2:51
  Wall Street, market maker winter
• 2:53
  mute. Has registered a US
• 2:54
  subsidiary as a broker dealer
• 2:56
  with the SEC and FINRA, opening
• 2:58
  the door to trading traditional
• 3:00
  stocks, options, and commodities.
• 3:02
  The New York-based unit can provide
• 3:04
  liquidity to securities exchanges,
• 3:07
  self-clear digital asset securities,
• 3:09
  and act as an authorized participant
• 3:11
  for ETFs, including those tied
• 3:13
  to crypto.
• 3:14
  CEO Evgeny Gavoy says
• 3:16
  digital assets and traditional
• 3:17
  finance will quote, ultimately
• 3:19
  integrate more deeply.
• 3:21
  Wintermute already facilitates over
• 3:22
  $10 billion in daily trading
• 3:24
  volume across 60 plus exchanges.
• 3:27
  The move rides a growing wave of
• 3:29
  tokenization across the industry.
• 3:31
  Then tough quarter for the miners.
• 3:33
  Mara Holdings posted second quarter
• 3:35
  revenue of $175
• 3:37
  million down 27%
• 3:40
  year over year with a net loss
• 3:41
  ballooning past 600 million.
• 3:44
  Rival CleanSpark reported 138
• 3:46
  million in revenue of 30 percent.
• 3:49
  And a $240 million loss,
• 3:51
  both were dragging down by fair
• 3:53
  value hits on their Bitcoin
• 3:55
  holdings.
• 3:56
  But the pivot continues, Mara and
• 3:58
  CleanSpark are pouring capital into
• 3:59
  high-performance computing and AI
• 4:01
  data center capacity, with
• 4:03
  CleanSparks touting a 20-year
• 4:05
  $6.6 billion lease
• 4:07
  and Mara eyeing nearly five
• 4:09
  gigawatts of power.
• 4:11
  The race for AI compute and
• 4:14
  miners is definitely heating up.
• 4:16
  Then a twist in the crypto
• 4:17
  bullfight. Bloomberg reports that
• 4:19
  ethics language sent to President
• 4:21
  Trump last week, requiring
• 4:23
  him to divest from crypto
• 4:24
  related businesses could actually
• 4:26
  hand him a personal tax benefit
• 4:28
  worth billions, deferring federal
• 4:30
  taxes on his gains for years
• 4:32
  or potentially ever.
• 4:34
  Senators Tom Tillis and Ruben
• 4:35
  Gallego drafted the provision
• 4:37
  now seen as critical to passing
• 4:39
  the Clarity Act.
• 4:41
  The latest version would also let
• 4:42
  state attorney generals enforce
• 4:44
  it. A change from earlier drafts
• 4:46
  that gave the power solely to the
• 4:48
  Justice Department.
• 4:49
  The White House did not respond
• 4:51
  to requests for comment there.
• 4:54
  Then JP Morgan is sounding a note of
• 4:55
  caution on hyperliquid.
• 4:57
  Analysts led by Nikolaos
• 4:59
  Panitsouzoglou said
• 5:01
  the decentralized exchange faces
• 5:03
  significant challenges to
• 5:05
  its market share as U.S.
• 5:08
  Regulators' perpetual futures
• 5:09
  platforms expand and competition
• 5:11
  and prediction markets heat up.
• 5:13
  They flag concerned around
• 5:14
  decentralized venues from limited
• 5:16
  KYC controls to oracle failures.
• 5:19
  And the money is noticing here
• 5:21
  inflows into hyperliquid ETFs
• 5:23
  stalled in July and August after
• 5:25
  record inflows in May and June,
• 5:27
  where the hype eventually overtakes
• 5:28
  token like Solana and XRP,
• 5:31
  the analysts say, remains to
• 5:33
  be seen.
• 5:34
  And that's it for the block briefing
• 5:36
  this afternoon. We're gonna move
• 5:37
  quickly into the hot seat today.
• 5:39
  It's a great pleasure to welcome Ido
• 5:42
  Ben-Natan, who is the CEO
• 5:44
  of Blockade, and we're going to be
• 5:45
  talking crypto hacks in
• 5:47
  2026.
• 5:48
  It's unfortunately been a big
• 5:51
  narrative this year, and
• 5:53
  obviously I think driven primarily
• 5:55
  by the rise of the power
• 5:57
  of the AI tools we now have at our
• 5:59
  fingertips. But first things first,
• 6:00
  Ido, it's great to have you on the
• 6:02
  show. Thanks so much for joining us.
• 6:04
  Thanks so much for having me.
• 6:05
  It's good to be here.
• 6:07
  You guys put out a H1 report,
• 6:10
  and it's got some key numbers,
• 6:12
  losses surpassing $1.1
• 6:14
  billion.
• 6:15
  And I stand to be corrected, but
• 6:17
  this could be close to the
• 6:19
  worst on record.
• 6:21
  Do you want to give us a quick TLDR
• 6:22
  about your H1 reports and
• 6:24
  perhaps, in your mind, what the most
• 6:26
  important findings were there?
• 6:28
  Yeah, I think the most interesting
• 6:30
  thing about the report is actually
• 6:31
  not the dollar denomination of
• 6:33
  the total amounts of funds
• 6:35
  lost, but it's actually the
• 6:37
  growing case of the number of
• 6:38
  incidents that are taking place.
• 6:40
  I think if we look back at this time
• 6:42
  a year ago, we were seeing
• 6:44
  a single-digit incidents take place
• 6:46
  a day.
• 6:47
  So these are only a
• 6:49
  single, sorry, single-digit
• 6:50
  incidents taking place a month.
• 6:52
  So the incidents that
• 6:54
  pass our team's threshold for
• 6:56
  severity.
• 6:58
  We're really kind of just a few
• 7:00
  every single month.
• 7:01
  And now what we're seeing is that
• 7:02
  the number of incidents that cross
• 7:04
  that threshold for severity are
• 7:06
  single digits a day.
• 7:07
  So the number has increased really
• 7:09
  significantly over
• 7:11
  the past year, and picking up over
• 7:13
  the last six months specifically.
• 7:14
  So I think if you go
• 7:16
  and look back at the report, you'll
• 7:18
  see that June was the record month
• 7:19
  with 57 incidents before
• 7:21
  then, in May we had seen.
• 7:23
  Uh... Almost fifty before
• 7:25
  then in april a little under fifty
• 7:27
  then before then march twenty eight
• 7:29
  so and so so the numbers is actually
• 7:30
  have started from the number of
• 7:32
  these interesting places very much
• 7:34
  obviously this is happening because
• 7:36
  attackers are leveraging these
• 7:38
  kind of tools to go in and just take
• 7:40
  every single vulnerability every
• 7:41
  single expert that they find
• 7:43
  weaponizing it much faster uh...
• 7:45
  Never get
• 7:48
  One of the key findings here, and
• 7:49
  it's no surprise to read this,
• 7:51
  was that DPRK-linked
• 7:53
  hackers accounted for
• 7:55
  roughly $600 million of these
• 7:57
  hacks.
• 7:58
  Can you talk to us a little bit
• 7:59
  about that remaining a
• 8:02
  big theme when it comes to
• 8:04
  hackers targeting the crypto
• 8:06
  industry and DPRk hackers
• 8:08
  being chief among them?
• 8:10
  Yeah, so I think it's actually
• 8:12
  really interesting. My background or
• 8:13
  team's background is in these
• 8:14
  Israeli cyber intelligence units.
• 8:16
  And so similarly, the
• 8:19
  government goes and interviews
• 8:21
  every single high school graduate
• 8:23
  before they go and draft and select
• 8:25
  them and where they go in the army.
• 8:27
  And so you have this
• 8:28
  kind of process that ultimately
• 8:30
  takes the smartest kids in
• 8:31
  the country and goes and puts them
• 8:33
  to solve certain missions.
• 8:35
  Now, for us, it was missions of
• 8:36
  national security.
• 8:38
  For DPRK, it's, you know,
• 8:40
  missions of economic profit,
• 8:43
  right, for them.
• 8:44
  And so...
• 8:45
  You know, seeing what we have seen
• 8:47
  during our times in those units
• 8:48
  and just the
• 8:51
  amount of productivity that you can
• 8:52
  get out of really, you know,
• 8:54
  young and hungry kids that are
• 8:55
  really smart and going after kind of
• 8:57
  these really difficult problems and
• 8:58
  the ability for them to solve
• 8:59
  problems that you otherwise would
• 9:01
  not think are possible to be solved.
• 9:03
  It's not really surprising that if
• 9:04
  you take that same kind of cohort of
• 9:06
  people and tell them, go get as
• 9:08
  much money as you possibly can, one
• 9:10
  that they're going to and target
• 9:11
  crypto because just the time to
• 9:12
  value is so quick.
• 9:14
  As soon as you find some sort of
• 9:15
  problem, as soon as you find
• 9:16
  vulnerability, you're instantly
• 9:18
  able to go and monetize that really,
• 9:19
  really quickly.
• 9:21
  And two, it's also not surprising
• 9:23
  that they will be so successful.
• 9:25
  Because they're able to solve
• 9:27
  problems that we otherwise would not
• 9:28
  think are possible.
• 9:29
  And I also think that our industry
• 9:30
  needs to level up.
• 9:34
  It's the security that probably we
• 9:36
  have across the industry in
• 9:39
  order to pass these problems.
• 9:42
  Yeah, sure. I mean, just to tack
• 9:44
  onto that, I think another
• 9:45
  interesting thing here is that
• 9:48
  the attack surface and how
• 9:50
  these hacks are taking place has
• 9:52
  changed a lot.
• 9:53
  We had Stanley Kulikov on the show a
• 9:55
  couple of weeks ago.
• 9:56
  And obviously, I asked him about the
• 9:57
  Kalp Dal exploit and his
• 9:59
  thoughts on AI
• 10:01
  leading the way in terms
• 10:04
  of hacks, especially targeting the
• 10:06
  DeFi sector. And he kind of said
• 10:08
  that. You know, it's not really a
• 10:09
  case of like code vulnerabilities
• 10:11
  and smart contracts being the
• 10:12
  primary vector in 2026.
• 10:14
  It's more a case of like OPSEC
• 10:17
  social engineering that is leading
• 10:19
  to a lot of these hacks,
• 10:20
  especially this year.
• 10:22
  Can you talk a little bit about the
• 10:23
  modus operandi and where you
• 10:25
  think the biggest vulnerabilities
• 10:28
  are now?
• 10:30
  Yeah, that's spot on.
• 10:31
  If you go back to our report, what
• 10:33
  you'll see is that almost 75%
• 10:35
  of the amount of funds
• 10:37
  lost were due to private
• 10:39
  key compromise.
• 10:41
  And about 80%
• 10:44
  of the funds, of the
• 10:46
  number of incidents were due to code
• 10:48
  exploits outside of necessarily
• 10:50
  smart
• 10:52
  contract infrastructure.
• 10:53
  And so what we really see is
• 10:55
  that the trend is
• 10:57
  focused on kind of operational
• 10:59
  security, as opposed to just kind
• 11:01
  of smart contract security targeting
• 11:02
  the ecosystem.
• 11:03
  And it's really kind of, you know,
• 11:05
  that's the line to AI being
• 11:07
  one of the major culprits for
• 11:09
  having this thing, you know,
• 11:11
  proliferate so quickly, right?
• 11:12
  We're seeing that these vulnerabilities
• 11:13
  or attack chains are actually
• 11:15
  starting from, not from,
• 11:16
  you, know, vulnerabilities in smart
• 11:17
  contracts, but other, otherwise,
• 11:21
  unrelated libraries or dependencies
• 11:23
  kind of moving in to
• 11:25
  crypto, almost laterally moving
• 11:26
  through these operations to these,
• 11:28
  through these applications to crypto
• 11:30
  in order to basically extract funds
• 11:31
  in the best way possible.
• 11:33
  So crypto is actually really the end
• 11:34
  goal, but it's not actually the
• 11:35
  starting point in where these hacks
• 11:36
  take. And we saw that with
• 11:38
  Kelp, we saw that with Drift,
• 11:40
  we saw that with a bunch of the
• 11:42
  largest hacks kind of targeting the
• 11:44
  ecosystem, it's really a matter of
• 11:45
  operational security.
• 11:47
  And, and it just kind of goes and
• 11:48
  highlights the need to detect these
• 11:50
  things and react to them incredibly
• 11:51
  quickly, because as soon as there is
• 11:53
  some kind of breach, if there is
• 11:54
  crypto involved, funds will be lost
• 11:56
  incredibly quickly.
• 11:57
  And so, you know, I think
• 11:59
  we're saying the same thing.
• 12:02
  Do you have any advice to the
• 12:04
  industry in general when it comes to
• 12:06
  this kind of stuff?
• 12:07
  Because even with the CalpDial hack,
• 12:10
  Blockade noted a pattern of LinkedIn
• 12:13
  social engineering, which led to
• 12:15
  these multi-sig sign-in compromises.
• 12:17
  That's pretty crazy that this is
• 12:19
  happening through social media.
• 12:20
  Do you think people are just not
• 12:22
  taking the threats seriously enough
• 12:24
  when it come to who's messaging
• 12:26
  them online and what
• 12:28
  they're accepting in terms of
• 12:30
  like...
• 12:31
  Calendar invites, interviews, that
• 12:33
  kind of thing.
• 12:34
  So I think the reality is that
• 12:36
  you will always have these kinds of
• 12:38
  breaches. It's not that taking
• 12:39
  security more or less seriously
• 12:41
  necessarily solves the problem.
• 12:42
  It's having solutions and
• 12:44
  tools in place to detect these
• 12:46
  things and react to them in real
• 12:47
  time. You have to almost assume that
• 12:49
  there will be a breach and then
• 12:51
  work around what happens after that
• 12:53
  to react really, really quickly
• 12:54
  accordingly.
• 12:56
  And so my recommendation to
• 12:58
  them and to these other teams is to
• 12:59
  ultimately work with solutions like
• 13:01
  Blockade to go in and
• 13:03
  detect these incidents as they're
• 13:04
  unfolding, build incident response
• 13:06
  workflows incredibly quickly to go
• 13:07
  and react to them, and just harden
• 13:09
  the systems in a way where even
• 13:11
  if there is some kind of breach, you
• 13:12
  are able to go and prevent the
• 13:15
  catastrophic kind of contagion of
• 13:16
  what happens after that incredibly
• 13:18
  quickly.
• 13:20
  Can you talk to us a bit about AI
• 13:22
  as an emerging vector and what
• 13:24
  kind of tools are
• 13:26
  now at the fingertips of
• 13:28
  hackers out there?
• 13:29
  And I guess to teams to
• 13:31
  beef up their security, I know a
• 13:33
  lot of people have been using
• 13:34
  frontier models and it seems
• 13:36
  like Anthropix and
• 13:39
  OpenAI's models are a
• 13:41
  little bit nerfed when you compare
• 13:42
  them to like KimiAI and what
• 13:44
  some of the Bitcoiners have been
• 13:45
  doing it to do in the last
• 13:47
  week to try and, you know, find as
• 13:49
  many.
• 13:50
  Vulnerabilities in different open
• 13:51
  source Bitcoin code, and then make
• 13:53
  these suggestions to different
• 13:55
  teams to make the fixes.
• 13:58
  How powerful is AI for
• 14:00
  both the hackers and, you know,
• 14:03
  white hat hackers to
• 14:06
  beef up security?
• 14:07
  Yeah, I think the pace of
• 14:09
  the intelligence of these tools is
• 14:11
  growing incredibly quickly, right?
• 14:12
  Whether it's the harness is getting
• 14:13
  better, the underlying model's
• 14:14
  getting better.
• 14:15
  The infrastructure to run them at
• 14:16
  scale getting better and so.
• 14:19
  I think that very soon, you talked
• 14:20
  about DPRK and having some of the
• 14:22
  best hackers in the world look at
• 14:24
  these kinds of problems, I think
• 14:25
  very soon everyone in the world is
• 14:27
  going to have one of the most
• 14:28
  hackers in world at their
• 14:29
  fingertips.
• 14:30
  Now, yes, maybe some of these models
• 14:32
  will be nerfed and maybe we'll have
• 14:33
  some of these different controls
• 14:35
  in place to make sure you can't do
• 14:37
  that. But open source will
• 14:38
  proliferate and those controls can
• 14:39
  be removed across those different
• 14:41
  things and open weight models.
• 14:43
  And so I ultimately think
• 14:45
  that
• 14:47
  Like we said, we will continue
• 14:49
  to see this problem getting worse,
• 14:51
  we'll continue to see threat actors
• 14:52
  going and hacking these different
• 14:53
  things, and we'll continue to it in
• 14:55
  crypto almost as like this canary
• 14:57
  in a coal mine, right?
• 15:00
  If you think about the economics
• 15:01
  that a threat actor has, they're
• 15:04
  financially motivated, they want to
• 15:05
  make money, and so they will do the
• 15:07
  thing that enables them to spend the
• 15:09
  least amount of time, the least
• 15:10
  amount of resources in order to
• 15:11
  generate the highest reward.
• 15:12
  Right and so
• 15:14
  In that kind of world, in that kind
• 15:15
  of dynamic, when we
• 15:17
  look at other alternatives for
• 15:19
  threat actors to go and do, they can
• 15:20
  take these models, they can point
• 15:21
  them at different pieces of
• 15:23
  software, pay for tokens in
• 15:25
  different kinds of ways, and maybe
• 15:26
  hack into some database,
• 15:29
  try to monetize that database in
• 15:31
  some kind of way on the dark end and
• 15:32
  sell it for some sort of profit.
• 15:33
  Or they can go and hack some sort of
• 15:35
  crypto company that has access
• 15:37
  directly to the assets themselves,
• 15:40
  immediately move them, immediately
• 15:41
  go and monetize those assets very
• 15:42
  quickly. And so.
• 15:44
  I think that dynamic makes it so we
• 15:46
  will ultimately see that a lot
• 15:48
  of the carnage and a lot of the
• 15:50
  the heartache for these different
• 15:51
  kinds of models getting better come
• 15:53
  to our industry first.
• 15:55
  Now, I think there's benefits and
• 15:56
  cons to that, obviously.
• 15:57
  Like, we're going to hit the
• 15:58
  hardest, the fastest.
• 16:00
  But I also think that the industry,
• 16:01
  like you said, with all these white
• 16:02
  hat hackers that are going and
• 16:03
  leveraging these different models to
• 16:05
  go and find these different kinds of
• 16:07
  issues across open source Bitcoin
• 16:09
  code, for example, and then going
• 16:10
  and hardening it, I think ultimately
• 16:12
  that will make the industry harder
• 16:13
  as well. We will be calloused and
• 16:15
  hardened from our exposure
• 16:17
  in just how lucrative and
• 16:19
  fast it is to go and target crypto
• 16:21
  companies.
• 16:23
  I want to talk to you a little bit
• 16:24
  about the cold
• 16:26
  card exploit from last
• 16:28
  week and just your general thoughts.
• 16:30
  We dedicated a show on
• 16:32
  Monday to this and we had Jameson
• 16:34
  Lott from Casa and Zach Herbert from
• 16:36
  Foundation to talk about that
• 16:38
  in depth. So our audience obviously
• 16:40
  I think is fairly aware of this
• 16:42
  but from your perspective,
• 16:44
  how big of a deal was this because I
• 16:46
  think so many Bitcoiners just
• 16:48
  trusted that they everything right
• 16:49
  and it still went wrong for a
• 16:51
  lot of them.
• 16:53
  Due to the nature of the
• 16:55
  firmware exploit itself.
• 16:56
  Can you talk to us a little bit
• 16:58
  about what you think of this
• 17:00
  incident and if it could actually be
• 17:01
  the worst thing that's ever happened
• 17:03
  in Bitcoin's security?
• 17:05
  It's a good question.
• 17:06
  So.
• 17:07
  You know, I think this incident kind
• 17:09
  of highlights what I call like the
• 17:11
  original sin of crypto and maybe
• 17:12
  even the original sin of the
• 17:13
  internet, which is, which is the
• 17:15
  private key, right?
• 17:16
  The fact that we govern who has
• 17:18
  access to our assets,
• 17:20
  whether that's a crypto or access
• 17:22
  to different pieces of data on the
• 17:24
  internet is generally derived
• 17:26
  historically by a password.
• 17:28
  And then after that, some sort of
• 17:29
  private key and it's a single use
• 17:31
  key. It's a, it's single use kind of
• 17:32
  access to these things.
• 17:33
  Now there's, there's beauty in that,
• 17:35
  right, that no one else can go in
• 17:36
  and access to these things.
• 17:38
  The hardship in that is that it is a
• 17:39
  single point of failure.
• 17:41
  And if you leverage
• 17:43
  a piece of hardware with poor
• 17:44
  entropy to go and generate that.
• 17:46
  Then it's gone, right?
• 17:48
  Or if your device is
• 17:50
  compromised in some kind of way,
• 17:51
  then it is gone and others have
• 17:52
  access to it.
• 17:53
  And so I actually think that,
• 17:55
  you know, where the industry needs
• 17:56
  to go and what needs to happen is
• 17:58
  technology that's already kind of
• 18:00
  being developed, whether that's
• 18:01
  4337, and
• 18:03
  account extraction based wallets
• 18:05
  that ultimately give us the ability
• 18:07
  to govern a specific account with
• 18:09
  multiple different
• 18:11
  private keys or multiple different
• 18:12
  controls around them.
• 18:14
  And that's the direction that I
• 18:15
  think generally users need to need
• 18:17
  to go in.
• 18:18
  Now, is that a perfect solution
• 18:19
  always and forever?
• 18:24
  Obviously, there will always be
• 18:25
  security vulnerabilities and things
• 18:27
  like that, and I think
• 18:29
  the learning here is just having
• 18:30
  your assets sit somewhere and
• 18:32
  forgetting about them and not
• 18:33
  thinking about them is not actually
• 18:35
  the solution because the pace of
• 18:37
  security is evolving and so you have
• 18:38
  to either constantly
• 18:40
  be paranoid or either outsource
• 18:43
  that decision-making process to
• 18:44
  someone else who is spinning
• 18:46
  those cycles and thinking about how
• 18:48
  they can bolster and security
• 18:49
  enterprise.
• 18:52
  Has Blockade been involved in
• 18:54
  any insights or analytics
• 18:56
  when it comes to the cold card
• 18:57
  exploit? Are you watching this quite
• 18:59
  closely from your side?
• 19:00
  Yeah, so we're definitely watching
• 19:01
  the incident unfold and
• 19:03
  analyzing how these different funds
• 19:04
  are moving in all sorts of different
• 19:06
  ways.
• 19:07
  Obviously, solutions like Blockade
• 19:09
  and Blockade are able to detect
• 19:10
  these things as they're unfolding
• 19:11
  incredibly quickly.
• 19:12
  And because of the nature of the
• 19:14
  incident, users are still
• 19:15
  able to move funds as
• 19:18
  the threat actors are able go and
• 19:20
  craft these different keys.
• 19:22
  And so solutions to go and detect
• 19:23
  these things, alert for them,
• 19:24
  understand which wallets are
• 19:26
  affected and how that's going to
• 19:27
  unfold, are critical for
• 19:29
  the developers and for the users
• 19:30
  that are kind of custodying these
• 19:32
  assets across different.
• 19:35
  Piece of infrastructure.
• 19:37
  And so, yeah, we're definitely
• 19:38
  following closely.
• 19:39
  It's, you know, at this point
• 19:41
  with a lot of the users and how kind
• 19:42
  of things are taking place, it's
• 19:44
  obviously pretty difficult to go and
• 19:45
  kind of prevent that leak from
• 19:46
  happening across users, but we're
• 19:48
  obviously working with the community
• 19:49
  and working with different kind of
• 19:51
  industry experts to go try to, you,
• 19:54
  know, prevent the problem
• 19:55
  downstream.
• 19:56
  Yeah, I was in conversation
• 19:58
  with Jameson on Monday, and one of
• 20:00
  the interesting points he made was
• 20:01
  that it's actually quite difficult
• 20:03
  to, or it might be quite difficult
• 20:04
  in the long run to pin down an
• 20:06
  actual culprit because people
• 20:08
  are still moving funds around, you
• 20:10
  know, from their cold
• 20:12
  card wallets from affected
• 20:14
  devices. So part of this
• 20:16
  will be actually figuring out
• 20:18
  what the affected
• 20:21
  wallets are through,
• 20:24
  I guess,
• 20:27
  people filing police reports, those
• 20:28
  kind of things, and then sort of
• 20:31
  trying to follow the breadcrumbs.
• 20:33
  Because I think a lot of the
• 20:35
  analysis that has gone into finding
• 20:37
  or identifying DPRK-linked
• 20:39
  taxes, seeing how they move the
• 20:41
  funds, looking for similarities,
• 20:43
  looking for consolidation addresses
• 20:45
  that match other ones, and
• 20:47
  this one seems quite difficult.
• 20:49
  Do you think it's a very unique case
• 20:50
  for the industry to deal with?
• 20:54
  Yeah, I don't think it's more unique
• 20:55
  than some of the other cases that
• 20:56
  we've covered.
• 20:57
  I think what's interesting here is
• 20:59
  that as opposed to one
• 21:01
  kind of centralized place that
• 21:03
  is getting hacked and kind of assets
• 21:04
  are moving from it, and not
• 21:06
  to say centralized in the meaning
• 21:08
  that it's necessarily a
• 21:09
  centralized entity, right?
• 21:10
  We've seen these things across
• 21:11
  Kellogg, we've seen things across.
• 21:15
  You know, Drift and all sorts of
• 21:17
  other kind of exploits. More
• 21:18
  recently, I'd rather mean that
• 21:19
  usually productors look at one
• 21:21
  address, look at ones that are smart
• 21:22
  contracts, they're like, hey, we
• 21:23
  will go and target that thing.
• 21:24
  It's supposed to go and say, hey
• 21:25
  there are a bunch of self-assertive
• 21:27
  wallets that actually have a shared
• 21:28
  vulnerability and we will kind of
• 21:29
  move these things, almost hacking
• 21:31
  the entire fleet as opposed to, you
• 21:33
  know hacking an individual,
• 21:35
  an individual kind of consolidation
• 21:37
  point. And so I think that's what
• 21:38
  kind of, you know,
• 21:40
  pivots this on its head.
• 21:41
  But I actually think that we'll see
• 21:42
  more of these kinds of different
• 21:44
  acts. Because The
• 21:46
  way that people are building
• 21:46
  applications and how a lot of these
• 21:48
  different, even more modern
• 21:49
  applications and neobanks are
• 21:51
  ultimately operating is by managing
• 21:52
  a fleet of self-conservative
• 21:53
  wallets. And so I think the risk
• 21:55
  of actually going and
• 21:57
  and identifying various different
• 21:59
  threats across those fleets of
• 22:00
  wallets, and in real time,
• 22:02
  identifying certain patterns that
• 22:03
  are happening at scale across these
• 22:05
  things will actually be a very, very
• 22:08
  important piece of infrastructure
• 22:09
  and security for the
• 22:11
  teams that are governing, or
• 22:12
  controlling, or selling these
• 22:14
  services to their users.
• 22:17
  You know, my last question to you,
• 22:18
  like I still find it a
• 22:20
  little bit perplexing that like the
• 22:22
  crypto industry has been so
• 22:24
  aggressively targeted, especially in
• 22:26
  2026.
• 22:27
  And, you know, there's a lot of
• 22:28
  suggestions that this is due to the
• 22:30
  rise of the AI tools that we now
• 22:32
  have.
• 22:34
  But you know like TradFi systems and
• 22:36
  stuff have not yet suffered any
• 22:38
  major, you know,
• 22:40
  exploits, especially in 20 26, if we
• 22:41
  look at comparisons.
• 22:43
  Do you think a part of that is
• 22:45
  down to the open source nature of
• 22:46
  a lot of the protocols that have
• 22:47
  been built, and
• 22:50
  as you alluded to earlier, the
• 22:51
  ability to move funds very quickly
• 22:53
  once you have carried out or
• 22:55
  found an exploit or managed to
• 22:58
  exploit a system?
• 23:00
  Why do you think crypto is in the
• 23:01
  crosshairs and not tradfied just yet
• 23:03
  if people are using all these
• 23:04
  frontier models to do this?
• 23:06
  Yeah, so a few points here.
• 23:07
  I think one crypto is beautifully
• 23:09
  transparent.
• 23:10
  And so we can see these things
• 23:11
  unfold as they happen.
• 23:12
  Now, one more thing to note here is
• 23:14
  that actually the number of
• 23:14
  incidents that we've reported on in
• 23:16
  our H1 report here.
• 23:18
  Is just the tip of the iceberg.
• 23:20
  The reality is that the number of
• 23:21
  incidents that we are triaging and
• 23:23
  dealing with are much larger.
• 23:25
  What we're actually reporting on
• 23:26
  here is a fraction of what is taking
• 23:27
  place. And most of the incidents
• 23:28
  that we're seeing, we're resolving
• 23:30
  with customers, we're resolving
• 23:32
  with prospective
• 23:34
  customers, and we're resulting with
• 23:36
  the community and with affected
• 23:37
  parties.
• 23:38
  And so...
• 23:40
  I think that that reality is also
• 23:42
  shared across traditional finance or
• 23:44
  other places, too.
• 23:45
  I don't think there are less
• 23:46
  breaches or less
• 23:47
  carnage across these different
• 23:49
  types of organizations.
• 23:52
  I just think that this is being less
• 23:54
  reported on because it is being
• 23:55
  handled
• 23:57
  within closed
• 23:59
  doors, as
• 24:00
  is true with crypto generally.
• 24:02
  We're just able to see some of them
• 24:04
  on-chain and kind of report on them
• 24:05
  and things like that.
• 24:07
  So you can almost imagine the
• 24:08
  infrastructure that Blockade has and
• 24:09
  its ability to go look at every
• 24:10
  single transaction, not just for
• 24:12
  our users, but for everyone taking
• 24:14
  place on chain, running those
• 24:15
  through our models, running those
• 24:17
  though agentic workflows to identify
• 24:20
  root cause, and then going and
• 24:22
  reaching out to these parties and
• 24:23
  trying to solve those.
• 24:24
  And And in some cases, yes,
• 24:26
  that reaches kind of the news.
• 24:28
  Alternatively, when we think about
• 24:29
  traditional finance and some of
• 24:30
  these different things, the
• 24:31
  vulnerabilities, the hacks, the
• 24:32
  exploits, even if larger,
• 24:34
  no one can see.
• 24:36
  And so I think, again,
• 24:38
  what we're seeing is almost like
• 24:40
  this canary in a coal mine.
• 24:41
  Like crypto, yes is overwhelmingly
• 24:42
  targeted, but also this requires
• 24:44
  us to go and kind of harden and
• 24:45
  build around some of the different
• 24:46
  things.
• 24:48
  And the transparency of these things
• 24:49
  makes us all more accountable to
• 24:51
  resolving the issues faster, better
• 24:53
  for users across the ecosystem.
• 24:57
  Thanks so much for taking the time
• 24:58
  to join us today and chat a little
• 25:00
  bit about your H1 report and just
• 25:01
  the state of crypto when it
• 25:03
  comes to being targeted by hacks.
• 25:05
  I think it's fair to say that
• 25:07
  everyone in the industry has done
• 25:08
  their utmost to mitigate
• 25:10
  the risks out there.
• 25:11
  But unfortunately, it's still a
• 25:12
  reality of our industry.
• 25:14
  And we do these shows that we can
• 25:16
  get the point across that this is
• 25:18
  a risk, but we have the
• 25:20
  best people in the industry working
• 25:22
  on the problem.
• 25:24
  Thanks so much for taking the time
• 25:25
  to join us.
• 25:26
  We hope that you will be
• 25:28
  back on the show sometime soon and
• 25:29
  we can have more positive things to
• 25:31
  talk about.
• 25:32
  Likewise, thanks so much for having
• 25:33
  me.
• 25:34
  Awesome. Thanks so much to
• 25:36
  Ido once again and the Blockade
• 25:38
  team.
• 25:39
  Thank you for joining us this week
• 25:40
  to watch the starting block.
• 25:42
  Once again, I just want to remind
• 25:43
  you, if you've missed any of the
• 25:44
  content or the conversations that
• 25:46
  we've had, you can just take a
• 25:48
  scroll down the video section right
• 25:50
  here on X if you're joining us on
• 25:51
  that platform today. If you're
• 25:52
  watching on YouTube, you can catch
• 25:54
  up with some of the big interviews
• 25:55
  that we had on the show over the
• 25:57
  last few weeks.
• 25:58
  A big one for me, obviously, was
• 26:00
  our launch show with
• 26:02
  CZ in Abu Dhabi Live.
• 26:04
  If you haven't watched that, you can
• 26:05
  find that on our YouTube channel.
• 26:07
  You can also find our interview with
• 26:09
  Jesse Pollack from Base yesterday.
• 26:10
  We just uploaded that today on
• 26:12
  YouTube. And if you want to find
• 26:14
  out more about the cold card
• 26:16
  exploit, you can listen to our
• 26:17
  conversation with Jameson Lopp and
• 26:19
  Zach Herbert.
• 26:20
  We can really recommend that one
• 26:21
  from earlier this week.
• 26:23
  We will be back next week with
• 26:25
  a big lineup of shows.
• 26:26
  I can reveal to you, and I can't
• 26:29
  tell you any more detail than this,
• 26:30
  but we will have CZ back
• 26:32
  on the starting block on Tuesday
• 26:34
  for a very big announcement.
• 26:36
  So mark that on your calendar.
• 26:38
  8.30 Eastern time if you're in the
• 26:39
  U.S. 2.30 Central European time
• 26:42
  if your here in Europe.
• 26:43
  CZ will be joining us live on the
• 26:45
  show for a big news
• 26:46
  announcement. It's one that you
• 26:48
  don't wanna miss.
• 26:49
  So it's a reminder.
• 26:50
  Otherwise we will be back on
• 26:52
  Monday. It'd be great to have you
• 26:54
  with us. Until then have a fantastic
• 26:56
  weekend. We'll catch you on Monday.