Black October, Banks vs. AI, Visa/Fireblocks?

Transcript

And I want to give you the cherry on top. Just this morning, I forgot I even have this brokerage account that I got a an email that was clearly automated but very poorly timed from Fidelity Investments that said October is Cybersecurity Awareness Month. >> It is indeed. >> Not a dividend. >> It's Tale of Two Quants. >> Now, your losses are on someone else's balance sheet. >> Generally speaking, airdrops are kind of pointless anyways. >> Um a number of trading firms who [music] are very involved. >> I like that ETH is the ultimate Ponzi scheme. >> DeFi protocols are the antidote to this problem. >> Hello, everyone. Welcome to The Chopping Block.

Every couple of weeks, the three of these guys and me this week get together to give the industry insiders perspective on the frontier topics of the day. Quick intros. First, you got Tom, the DeFi maven and master of memes. >> Hello, everyone. >> Next, you got Tarun, the gigabrain and grand poobah of Gauntlet. >> Yo. >> Next, we've got Robert, the crypto connoisseur and czar of Superstate. >> Good morning. >> Uh and I am Rob, which according to Claude, I am the sultan of stablecoins and the paragon of predictions at Dragonfly.

>> All right. >> Wait. Wait. Wait. Wait. That There's so little alliteration there. What are you doing? >> The paragon of predictions? >> Double S, double P. >> Yeah. >> Yeah. >> It's a guest guest host, whatever. >> [laughter] >> Guest hosts don't need real Guest don't need real alliteration, I see. >> I I got to tell you guys, like I don't know how you've been doing that for 6 years. Like I I struggle to get those get those out. So, but I'm I I'm you know, when in Rome. So, >> You know, I think there's sort of a uh funny thing of like Hasib did it and then just sort of we we we lived by the dictatorship of Hasib, but now we might be free of that dictatorship, I hear.

>> It's a new era. >> I think the further we get away from all in, the better, too. So, I'm I'm down to mix up the alliterations. So, Rob, for our listeners who don't listen to the show, we probably need to introduce you. >> Yes, okay. So, anyone who does not know me, I am Rob Hadock, one of the other partners at Dragonfly with Tom and Haseeb. And as announced at the end of last week, we are doing a podcast host swap. So, I have a podcast which I'm a regular on called Empires Weekly Roundup with Jason Yanowitz at Blockworks and uh Santiago, who is a entrepreneur and and who also was previously an investor in crypto. And I'm I have to say before we go on that we are all early-stage

investors in the frontier. But I want to caveat that nothing we say here is investment advice, legal advice, or even life advice. Please see choppingblock.xyz for more disclosures. Okay so new reign, everyone can, you know, spread their wings. There's You've got You can talk about anything you want. You don't have to wait for me to tell you exactly what to do and then and then chime in. So, we're going to start on a a topic which I think is kind of on top of everyone's mind this week, which is what has been a very bad week for security. And now I'm going to do something that almost never happens on this podcast, which is that I'm going to allow somebody who knows more than me about this topic to explain it. So, Tom, please tell us what happened.

>> I think Tarun is the king of brain and grand poobah of security, but it's fine. >> first. >> Tarun, if you want to >> No, no, Tom, it's all yours. Tom, it's all yours. >> Yeah, Tom. >> Let's team it. So, security incident and event happened yesterday that security experts are calling Black October. Basically, in the past 2 days, 48 hours, there've been multiple basically 10 out of 10 CVEs disclosed in most of the top um languages, frameworks, open-source libraries, everything that runs the web. So, the main one that got disclosed was was vulnerability called PHP 2 Shell.

There's actually two different vulnerabilities that allow remote code execution on servers running PHP. We are all pretty old, so you Zoomers, I realize probably don't know what PHP is. I actually this happened in a chat I was in. I someone who's 23 asked what PHP was and then that made me feel really old. But if you did any web development in the mid-2000s, you probably use PHP. It's a server-side language that runs still WordPress, Facebook very famously was built on PHP. So runs a lot of servers still to this day. And so therefore it's very bad that there's a very long tail of not the most up-to-date, not the most tech-savvy products and companies still running on PHP today.

And this vulnerability basically allows anybody to take over their server and run remote code with like one line. So I think the Cloudflare CEO was saying that they saw like millions of people trying to exploit this and so there's this sort of, you know, race to you know, basically deploy this patch and to upgrade all this and this also happened in tandem with a similar vulnerability on Node, which is obviously more modern more popular um server-side framework, but not nearly as bad, but there were a bunch of other ones. There was this Railway breach. Railway is a popular sort of platform as a service hosting product. So also vulnerabilities there.

So it felt just like in the span of like 48 hours, all these massive vulnerabilities got disclosed. Everyone was scrambling to patch. A bunch of European governments were like taking their sites offline just out of precaution. I saw like Nikita Bier was like tweeting, "We should just shut down the internet." And I know it was a joke, but I'm like kind of not half wrong and I it kind of felt like this was kind of how I feel like in crypto there were those days or moments where [ __ ] is just hitting the fan and everyone's trying to like circle the wagons and figure out like, "Okay, am I exposed? What's going on? What's truth?"

And this kind of felt like that day, but for like everybody who works in cyber where it's just like everything is going wrong and you don't really know what where truth is and you kind of have to just like circle the wagons and kind of get your own house in order and hope for the best, but just a lot of kind of fog of war. And so, I obviously a lot of this gets attributed to, you know, a lot of the advances in sort of cyber offense and defense, and a lot of the new AI models, a lot of you know, people who obviously using like open weight models to do cyber offense and defense. And so, a lot of people sort of attribute it to that, but yeah, kind of a crazy 48 hours. It feels like if anything, I mean, the kind of read I get is this

this is just going to keep happening. There's just huge huge body of work and old code that really it is people have kind of just, you know, used for for the best. And now it feels like with AI again, we're kind of hitting this almost like apocalypse type thing. Troon, I'll let you I'll let you chime in. >> Couple other I I think I'm just going to list some other things that were exploited. Um there were a bunch of Linux kernel exploits posted to a mailing list, which means there were there was no responsible disclosure. Node.js, which is what Vercel kind of is built off, had a bunch of uh remote code execution flaws. Uh Microsoft found a a custom agent that they claimed was a

Chinese state-aligned threat actor, which I wasn't sure. That was like built on immediately exploiting all the CVEs. So, they actually like caught it in the wild like going and like indexing and exploiting Microsoft's security threat intelligence. >> why I've gotten like a thousand emails in the last day to reset my Microsoft 365 password? >> Yes. 100%. I think this is part of that. Quick, which is the the successor to TCP that Solana used by default, I think now they actually fell back, had a zero-day. Uh GitLab had a remote code execution flaw. And this is all in 24 hours. So, I I'm not like telling you much that I Just to just to give you a scale of this. Another thing about the PHP stuff

is like the number one users of PHP in 2026 are government websites apparently because you saw a lot of government saying like don't use our website. Like Finland shut down all internet services, the Netherlands cybersecurity agency like took over government websites. That'll be like the see NSA being like we're taking over whitehouse.gov for for a week. France, a bunch of states, prefectures, whatever kind of had to shut down stuff. And then the most important one was Japan because Japan has actually had a ton of attacks this week. So much so that the prime minister of Japan tweeted about how you need to update everything and or shut down all your web servers. So, this is again one day and right this is a 24-hour period all

the things I just look and I want to give you the cherry on top. Just this morning, I forgot I even have this brokerage account but I got a an email that was clearly automated but very poorly timed from Fidelity Investments that said October is cybersecurity awareness month. >> [laughter] >> Uh it is indeed. >> It's a It's a real It's a real thing and it's like it's like a automated message of like oh like use multi-factor authentication, set it up, whatever.

And >> [laughter] >> I just thought it was funny they sent it like the automated email came the day after the apocalypse. It was like it's like >> it up. You're ready. >> Yes, [laughter] I'm ready. Anyway, that was I'm sure I'm I'm sure I'm understating how many things are there. I'm sure there was more than what >> was released yesterday what I just mentioned. >> It's a So for those of us who are not as technical and can't see the future as well as you guys can on the security side like what happens a year from now? This feels like I I'm I'm not the the technical partner at Dragonfly. And so I hear all this and I'm like I barely understand what's going on and I'm scared shitless.

Is that Was that what I I should be? Should I be scared shitless? >> Here here's my take. These are the worst security vulnerabilities in the broad web that we've seen. Yet still, it's not that catastrophic, right? Like most of the crypto impact I saw, you know, because you know, there's been trickle-down things, but like Railways was compromised, and so a DeFi project's keys were compromised, and someone started you know, stole the keys and started upgrading them.

The total ramification, like the blast radius here, isn't that big, right? Like this is like the doomsday batch of security vulnerabilities, and not that much broke. >> I don't know. I I think I I can't remember the last time I the NSA was saying like, "If you can't patch this, take down your web service." Um I don't think that's like it literally ever happened. >> Correct. That's never happened, right? But even in that like DEFCON one scenario where the NSA is like telling everybody to take down your website, the real-world implications of this were not that severe.

>> Well, we don't know yet. I mean, we don't know kind of what's been exploited, what's been exploited I mean, to your point, the ability to monetize stolen credentials and personal information and stuff is like a little bit more abstract than someone in crypto stealing your private key. So, in that sense yes definitely. >> I I totally agree, but there's always horrific vulnerabilities. They get acknowledged quickly, awareness gets built quickly, they get patched quickly, and everyone's eyes are a little bit wider and more open for the risks going forward, right? This was as bad as it could possibly get that we've seen so far.

And yet, the actual ramifications are quite contained, to our knowledge. Right? And so, yes, we should all be extremely scared, right? Like every IT professional is like freaking out. Every security professional is freaking out. The velocity of compromises and the severity of them has been increasing as a function of time. And it's getting scarier out there, but it's still like the worst day we've ever had and still there hasn't been any catastrophic impact.

>> I just don't think we know the second order effects at all. Like there could be some hidden skeleton. Like this feels like all crypto hacks, right? Where it's like there's the initial thing and like sometimes it uh it looks like the initial thing is actually >> trying to reassure Rob, okay, Taran? >> Yeah, he's trying to help me out. He can see me shaking over here. >> No, I I think the more interesting thing here, right? Is like everyone in crypto had to deal with this in February and March of this year. And I think people have spent a lot of time on like live threat detection, security posturing, figuring out sandboxes, all this [ __ ] that all these SF people were like, "Oh, we don't need that." And then now all of a sudden they're like, "Oh, [ __ ] We need

[laughter] that." And they're trying to buy crypto auditors and stuff like that because like I think crypto people were ironically ahead on like being prepared, but probably for bad reason in that they dealt with the vulnerabilities, but also it's like their security practices are in some ways a lot stronger. Like I think one of the more interesting things Haseeb's out here, so I can dunk on him. Haseeb loves always saying this open source is dead cuz of AI thing, right? Like, "Oh, it's like whatever. Like it's like the most hackable. Everyone's just going to go after you. It's over. Everyone's going to want closed source."

I actually take the opposite tack. I actually think closed source is actually more unsafe in the long run because A, you can reverse engineer any closed source binary now, like super easily. B, there's it's actually very hard to detect if someone has exploited or is a man in the middle or like sitting in your closed source stack. There's like no sunlight that is the disinfectant transparency that you can actually see. Whereas in the open-source world, if people are uh exploiting it, it's often times very quickly disseminated. And so, you can kind of see it it it doesn't stay secret for very long. Whereas like JP Morgan could have had like a zero day and like lost

to $10 billion, you know, like the the the way the Fed lost almost lost a billion dollars that the Bangladesh Central Bank had a few years ago. And just not tell anyone for a while. And like you only find >> hack? Didn't it start Didn't they find it on August 11th, too? And it took a while to find >> exactly, exactly, exactly. Sort of There's like also some weird stuff around disclosures stuff in the closed-source land. >> Yeah. >> Um I was going to say this is like the things that we see. You don't think about all the things that you don't see. You know, when things were disclosed, things that weren't disclosed. This is obviously responsible disclosure, too. So, I actually think all this is almost more like um you know, you think of what was a DeFi exploit in 2018? It was like

reentrancy. Something extremely basic that like eventually, you know, just kind of got built around. And then and yeah, now basically no one has reentrancy exploits in their in their smart contract. But like you actually hit the low-hanging fruit first. And then you attacks get more and more sophisticated. So, like if anything, I think this is kind of just the tip of the iceberg. And like if if you look at the again, I also kind of think about like when coding agents and coding models start to get really good, you know, it was a little over a year ago when I think like you know, Claude code and and Opus 4 came out. And these things were to get really good. And then it wasn't until like maybe 6 or 7 months later when there was kind of oh [ __ ] moment and like you know, there was like I

didn't really buy the the thesis, but like the that Citrini article about, you know, SaaS is dead and stuff. And so, this feels like kind of like the oh [ __ ] moment for cybersecurity where this stuff was technically possible for let's say 6 or 7 months with sort of state-of-the-art models. I mean, there was a whole, you know, Mythos roll out and and Daybreak. And now it's like, oh, this is just kind of everywhere. And everyone can see it. And everyone can kind of have it. >> I mean, the biggest thing that I thought was interesting was like the same thing that happened during the hugging face incident except in mass where it's like all these people were like trying to patch their system with Claude well Claude's a piece of [ __ ] and will obviously block you from doing anything to protect yourself. Open AI will also

block you but they will say be like you use sign up for daybreak and they actually do you can sign up kind of easily like the access to mythos is and the Claude security stuff is way more slow so you can't really rely on it in a a live attack where you need to patch immediately. And then the like open source models were like the only way to like kind of ensure that you could safely patch things if you were getting attacked. So I I thought that was actually a very interesting observation like seeing all these people who are railway customers who are like [ __ ] all my secrets and keys are all sitting in railway. Like this is almost like if one password got hacked. And they're like I just need to rotate everything and like the the the main lab models wouldn't do it for you so you had

to like go open source. I thought that was like I I kind of feel like this is going to be the the the lesson overall is like anything where the model provider has like sufficiently high reliability is never going to be done by a closed source model. Like trading, right? It's like all the Anthropic and Open AI models love blocking you from trying to trade because they're like oh we don't want to be like responsible if if the the model give you a last a bad idea. I think one of the reasons you didn't see the AI trading agent stuff take off as much until the open source models caught up was because of that. It was like the only way to do it. And I think cyber security is a kind of similar thing where it's like the liability thing separates the open and closed

worlds in a way that we that looks very much like crypto actually. And like I think that's that that's sort of why I I I I think I'll still just disagree with Seba on like the open source stuff. I don't think open source is dead. I think like sunlight is the best disinfectant in the long run. >> All right. So so speaking of the stopping agents from trading or doing financial activity. Uh maybe that's a good segue into uh what's happening right now with the banks uh around you know blocking a lot of these these AI agents. So, So for people who don't know uh and I'm sure every most people that listen to this podcast know Instinct and Muse and all of these other kind of horizontal like general purpose AI agents, uh a lot of the users

of them have been giving them login credentials to their banks and to their credit cards and saying, "Hey, you know, look look at my how much I'm spending. Look at, you know, potentially, you know, what my what my investment account is invested in. Look at, you know, kind of what I'm getting on yield in my checking account or my savings account and help recommend other types of of activity or or ways that I can invest." And there's been a little bit of this sort of I don't know concern trolling, I think is how I would put it, uh over the last month or two around could there be an agentic bank run. So, I think it was Apollo's chief economist, Torsten Slok, who put out something about maybe 3 weeks ago, 3 4 weeks ago, that said agents going in and auto sweeping cash

from these like yo low-yielding checking accounts uh could cause a bank run. It was that had a lot of fanfare uh on the internet. I think um I publicly was very I think maybe maybe that the tweet that I put out at the time was these people don't know how Plaid works, which I I think also just that I'd be very surprised that any of the banks were would be allow people to actually use these agents to move money. To to read, absolutely, but to move money. It was pretty quickly after that that I believe it was on the the Q3 call that Jamie Dimon from JP Morgan uh started warning of rogue AI agents, possibly thousands of them, in JP Morgan were moving trying to move money and

doing things that were uh that were not actually approved by the people who had, you know, kind of given these agents their credentials. The uh Wells Fargo CEO also said the same thing that either the AI deposit exodus was overdone, but that they needed to restrict them cuz they were seeing, you know, unauthorized, you know, types of activity. I think Bank of America then restricted agents very quickly after that. Schwab then did the same exact thing, including blocking Muse and saying that they were seeing unauthorized activity, you know, dozens of times a week. And then Axios comes out today and they say that they've been speaking with all these bank executives who have also said that they've been detecting unvetted agents inside accounts acting independently. Morgan Stanley's

blocking, JP Morgan's blocking, Bank of America's blocking, Citi's restricting. E- E- Some of them are not even allowing to read only now by some of these agents. A- And so it so sort of seems like the banks are trying to get ahead of what is a concern for there being a better user experience using AI in the in in people's financial lives. I don't know. Robert, you know >> Because because banks have been the paragon of UX historically. >> Paragon of UX, exactly. >> Yeah, I mean, I feel like we touched on this a couple episodes ago briefly.

Banks are extremely reluctant to change the way people interact with them, right? Like it They tried to shut down Plaid and it took like a decade of like negotiations for them to slowly like enable Plaid as like an approved way to access literally just read only data about how much money you have and your account numbers, okay? That's how risk-averse they are just for new patterns of users interacting with their account, right? It took like a decade to get comfortable with that, okay? So of course an agent interacting with a bank is an order of magnitude

more fear-inducing than we built a scraper for the read-only data. Anything that can click a button is 10 times as terrifying. Is it actually a risk to the bank? Not really. Right? They're probably going to use a lot of hyperbole and a lot of excuses like and I read one of the reports, you know, where they're like, "We noticed that the agents were taking actions that the users didn't even request." Like how would the bank even know what the user requested? Right? Or what the instructions to the agent were. They're like making up some hyperbole to invoke fear.

Is this a risk to them? No, it's really not a consumer benefit and it sort of runs against the interest of the bank if it makes again it easier for consumers to shift their money, to close accounts, to rebalance things, whatever, right? Most of these service providers have absolutely horrific, impossible to navigate platforms, which are designed to thwart the human at every turn and lock them into uneconomic structures. >> By the way, this Axios report became very political related to this, where it was Bernie Sanders had a tweet.

>> Bernie Sanders, yeah. >> Like a couple hours ago. >> What'd he say? >> I will read >> Please. >> it's actually funny. >> [laughter] >> This is insane. I I I don't know if I have a Boston accent. >> No, do it. >> We cannot allow I can't do it. >> We cannot allow AI >> It wasn't a great Bernie Sanders, but it was like okay Boston. >> [laughter] >> We cannot allow AI agents to go into your bank account and act independently without your authorization, but this is what's happening now. Left unchecked, AI could endanger the entire global financial system including your bank account. Pause AI now, all caps. >> Talk about the exact opposite conclusion that Bernie should have drawn, right? Like Bernie should, as somebody who at least on the surface tries to be as pro-consumer, pro-public,

pro-retail as possible, he should have the exact 180° opposite take, which is "Hey, it's literally impossible right now for a consumer to figure out how to close a bank account, move their money around, move things into another account, open up a new account, get a new bank account, optimize their lives. It's functionally impossible, right? I have a Just personal anecdote. I have a GoDaddy account I forgot about that like I don't think has any domains in it. I got an email like 3 days ago and like, "Oh, we're updating something." You know, and I was like, "Oh, good reminder. I'll just close this account."

No domains, no services, I don't have any balance in there. I haven't used it in like forever. Even with an AI agent, I couldn't close this like old GoDaddy account. I just couldn't. It was like, "You're going to have to call us. There's forms." Right? The terms of service of all these things are like deliberately sabotaging the consumer. >> Oh, yeah. I I'm I mean, how much do you think that I was going to say how much do you think this is like a bank thing versus just businesses generally being afraid of A, people losing friction, and B, just being afraid >> deliberate friction.

>> Like Amazon's also blocking agents and I think they've they've pretty good UX, pretty customer friendly, generally. >> Totally. This is deliberate friction, and deliberate friction is fundamentally horrible for the end consumer, right? Bernie Sanders and the rest of the Senate and the rest of Congress should be actually incredibly excited about AI for this specific task of reducing friction. This is a godsend to consumers. >> Well, Ro- Robert, you you spend probably more time in DC than I do, but I I spend a decent amount of time there, too. And, you know, in the last, you know, call it 5, 6 months, the topic around like liability if AI goes rogue, and the topic around like how do we have consumer protection around AI has actually been a very, very common one.

Even I could see it shifting from like Clarity AI stuff to to this specifically. And it it's sort of odd to me because also with Clarity, a lot of what has been happening in crypto, a lot of what has been happening in AI is about shifting consumer surplus from the banks and from these like intermediaries to the end consumer. It's actually net better for me. I get better I get more surplus, the end consumer gets more surplus. And yet the to your point that you made earlier Robert, the you know, the the Bernie Sanders of the world seem to be taking the sides of the banks more often. Which was like I mean, what happened to occupy Wall Street? This was literally I remember occupy Wall Street people, you know, camping out in front of Goldman like 15 years ago. Right? And so it's it's been a like a very weird

mix of sort of ideology. It's almost like a circle meeting in the kind of the other side of but the the same ends. >> Yeah, I agree. It's weird the outcome we've gotten to, but it did all start at least something started with occupy Wall Street. And now the progressive wing is pro-bank. >> Very very odd. I I to the point Tom you said about Amazon. So obviously Amazon is blocking agents as well. Although Shopify is allowing them if you talk to Shopify's agent. At the end of the day clearly this all comes down to incentives and how do these companies make money? Right? So the way that the banks make money is there's 1.6 trillion dollars of deposits sitting in non-interest bearing

accounts. Right? And so that's obviously good for them. They can go and lend that out. They can get return on that equity. Amazon's obviously selling ads to everybody. I don't know what what ends up happening. >> And a whole lot of compute. You know, they think they need more. Yeah, CPU demand is going to go up 4x. You think they would be yeah, [ __ ] it. Have your agent just hang out on Amazon all day and burn burn burn burn up some cycles. >> Your agent can come to Amazon and shop if you just get ex- you use only the biggest models and the most compute and we're just like four times charge you then your agent can shop here. >> There you go. >> I think the the other thing worth noting is even though I I took the opportunity of receive not being here to

to dunk on him. I'll give him a compliment also. Cuz he had a good good tweet about the the idea that it's much easier to block these agents that are hosted and come from a place with identity like Meta versus local agent you're running on your own computer, which is to it's should not be different from you to that. Like the obviously all the banks will we can't tell the difference. Yeah, no [ __ ] That's the point. Like I think that's like that that part is where people are learning about how I remember didn't didn't Trump say something like everything is computer? I think now it's like everything is crypto cuz like everything looks like crypto now, right?

It's like actually you can just be the anonymous 50 agent swarm spamming your insurance company until they pay you back, right? And like that idea that this friction has gone down, but also you have to deal with civil attacks, people kind of replicating themselves, etc. It's just like everything market structure-wise and commerce-wise seems to be going to crypto. And obviously businesses want to put these frictions, but I actually think the game is going to flip. The like the board like all these people think they're playing chess with this fixed set of pieces, but actually the board itself is changing.

And I think the banks are not able to acknowledge that and will get completely there's going to be so many ways around whatever they do blocking-wise. And I don't think they're going to have a >> Yeah, so I so I think I disagree because to your point to Rune and I think this was in his tweet. Like you can absolutely use Hermes and like set up a local agent and do whatever you want on, you know, these these through your your and your financial accounts. The amount of people who would do that on a relative basis the amount of capital they have is going to be like essentially de minimis, right? Like we're talking to like us and and by the way like I I I joked earlier about not being non-technical. I'm probably technical more technical than, you know, the vast vast majority of people who are

looking at these things. And like I I I like Hermes, but like I found it like it was took me way too much time to get it to the right place uh to do the right things for me. And if I if I found it to be that way, like it's going to be a small subset of people who are doing that. >> This is This is always a source the thing with open source. It always starts kind of shitty UX-wise and always improves over time because you have many more people who are building custom front-ends, building custom interfaces, building custom uh ways of using the same code. And so, I think that that's not the issue I think in the long run the future. I think basically there's going to be a million ways that this is if if there's ways to make money for these

agents to make to do this, it's the same as the trading stuff. No one wanted to use the like sanctioned trading agents, right? You look at a lot of the trading agents that were uh you know, kind of people tried to try to build that were like sort of sandboxed and didn't let you do a lot of things. Like a lot of people didn't want to use them or like they kept getting blocked. And then they once they were able to get an alternative, you just saw the usage go up like crazy. So, I just think we should just acknowledge that all commerce is going to look like crypto and so then you should also be able to pick the winners and losers based on what what won and lost in crypto.

>> All right. So, you don't think the banks are going to be able to or the asset managers going to be able to put up more friction? >> I mean, asset managers asset managers for sure, right? They don't have zero They don't have demand deposits. They don't have to like guarantee you withdrawal. Like asset managers is a different game. They're They're They have total control. There's no real way. I think for banks when you're offering demand deposits, and I can't tell whether it's a you or your code operating on your behalf, and there's no real way for me to distinguish that at all other than maybe it's like you do Face ID, but then it's like, "Okay, I told my agent to do all this [ __ ] and then I Face ID'd out." Right?

>> Right. Like at the end of the day, an agent literally does the things you can do. It can control my browser, right? It can literally type in my username, my password, right? Based on my instructions. An agent is the representation of the individual and the individual's desires, right? And their legal authority and dot dot dot dot dot fill in the blank. Right? At the end of the day, an agent is software doing something for you. That's it. It's just software producing automation to do the thing that you could have done on your own. Every technology we've had over the last 500 years is making it easier for you to do stuff you could have done the hard way, and now you're doing the easier way,

right? And so it's illogical to fight the technology. Everybody should figure out how to enable it. And the banks that enable it, I think are going to be the beneficiaries. >> I I I can definitely see that. I I I have a perspective that we're probably going to see like net new AI first banks who are actually going to be the beneficiary versus like JP Morgan will figure it out. Uh but I also don't think JP Morgan will be in that much trouble because most people are lazy and they haven't cared about the fact that they're they have a ton of friction and that they make me call them every time I want to wire 10 grand somewhere despite the fact that I've done this 3,000 times in in the past.

>> Totally. Yeah, I I think the banks will generally be fine. Tarun has talked about the example of him getting his health insurance fixed. Like I feel like you know >> or getting paid back co-pays I overpaid for 5 years. >> Correct. Correct. If you look at where AI benefits the end user the most, it's on things that are basically impossible to navigate as a human. >> Yeah. >> Right? >> Yeah. >> I think the hardest systems for people, regular people, everyone, smart people, dumb people, whatever, like all people, the hardest thing for people to navigate is like the US healthcare system. It is so difficult.

It is so much paperwork, it is so much complexity. The cards are stacked against the individuals so badly that AI should have the biggest impact on fixing that and the biggest losers are going to be health insurance companies. If there's any industry I would want to short, that's what I would want to short. >> All right, maybe move on to a new topic. >> So speaking of shorting. >> Speaking of shorting, let's short this topic. Let's move on to Joe Weisenthal and Hyperliquid's US path. So this was actually I thought was really interesting to me. So Joe Weisenthal and Tracy Alloway did not lots newsletter and they did the lots podcast. They interviewed Jeff Yuan the

the founder of Hyperliquid a I guess this was like about a week ago or so and then Joe put out a in his newsletter a basically an ode to blockchain technology. He said maybe I was wrong about the Bitcoin or the the blockchain not Bitcoin crowd. And so this reminded me and and I'm sure all of us remember this but I guess it was 11 years ago now that we had this sort of like push from all of the big banks where that like Bitcoin is stupid, the tokens are stupid, it's made up money out of thin air but the blockchains are going to reinvent the way we all do finance. So I you know there was the the woman who Blythe Masters who used to be she was at like with the third most

senior person at JP Morgan for some period of time and then was the first one of the first CEOs of Digital Asset Holdings which which now became Canton. She went on the front of Bloomberg Businessweek and it literally said blockchain not Bitcoin. And this was like everything all the banks were talking about 11 years ago. And now it's happening. Like that's what Hyperliquid is. It's blockchain not Bitcoin. Like I I don't know what should we think about it. Are the TradFi firms now winning in crypto? >> Well, I I think it's funny that like Hyperliquid is a thing that he cites which I'm like this is not TradFi in any way, right? He's not talking about like well, you know, he did profess I guess some some awareness of of stable coins and I think he has some understanding of like why stable coins are good. But you

know, Hyperliquid is like, okay, it's a perp decks and um like I I see Hyperliquid's great great but like I think the things that you know, Joe gets excited about are like, oh, we can have perps as this substrate for creating a market for anything. You can have perps for equities and commodities and pre-IPO and all these types of things, which is true, but I'm like we also did have those before, you know, we we did there were other perp decks before Hyperliquid or other synthetic platform before Hyperliquid. So like the proof of concept was there and I think maybe it was just like you know, I think there were these kind of acute moments like um the weekend when the Iran war started and people were trading oil or like the Cerebras IPO but it's like you can kind of you it sort of makes that

jump from like the a very small you kind of have to see the vision to like, oh, this is actually very real, which I think Hyperliquid is is is kind of doing, but yeah, I don't know. I um I mean, great to kind of see it and I think I think Joe's generally very yeah, I think sober about about about his takes, but it was funny to me like this was the thing that kind of woke him up, you know, after after all these years. >> Well, it's also like is he realizing isn't he realizing this a little late? I feel [laughter] like this has been a It's like Bloomberg, other people at Bloomberg have been talking about this and writing about this for like 9 months. It's like I don't I'm I found that a little bit funny cuz it's like, what [ __ ]

happened now given that like I go to the Bloomberg crypto section it's like only about Hyperliquid. >> What happened in the interview with him? >> 9 months. >> He interviewed Jeff and he got excited. >> yeah, yeah, yeah, yeah, yeah. >> pilled. >> But they have literally been writing about it. His own publication. So there's something I'm just kind of like, all right, that's just there there are other people there who I think already had this view. >> He was just busy. >> man. There's a lot going on in AI and sometimes you got to you got to shift your attention a little bit. >> It's true. It's true. I haven't seen him post about his vibe coding experiments in a while.

>> Yeah, he >> Remember there was a little while where it was like constant. Yeah. >> It was like he was literally the best vocal vibe coder out there for a >> Remember >> there was that New York Times article written about him and then talked about his vibe coding? I mean that has to be the most vocal by like media distribution of vibe of like >> He's a vibe coder. He had something the other day that was cool. It was like uh it was like a graph visualization thing and it was like oh here's the stylistic ties between this album and this piece of clothing or this this movie or whatever and anyway, I Joe still out there. You just got to go go check it out.

>> He was I remember listening to an odd lots that he did. I think it was with Patrick Collison or John but but I'm sorry if I got that wrong in like July or something and I think Patrick said to him he was like you know how you know that someone vibe codes cuz they'll always tell you. And and that that is Joe is the Joe Weisenthal is the the the tantrum out person that always tells you that he's that he's vibe coding. Uh well so I thought what was also interesting here was that the So right after the Jeff Yass podcast, they had Terry Duffy on, the right now president of the CME but but previously the CEO.

>> Yeah, why did they not just have a debate? >> them on together. >> It would have been fun more fun, yeah. >> [laughter] >> I mean and so for people who don't know, Terry Duffy has been maybe the most vocal critic of perps and prediction markets and the current regulatory regime and I think like almost the entirety of his podcast with Joe Weisenthal was basically about like how he thinks like everything that's happening right now is ridiculous and we need to put guardrails up. And it was a a lot of like old man yelling at the clouds going on there but he's he's been among probably the most vocal person that's been against kind of everything happening in in trading the last year. I don't know. Robert, you're >> Including including our favorite on this show which I think Rob you're going to be in YouTube but onion futures.

>> Onion futures. >> Oh yeah, I saw that people were protesting onion futures and trying to get the ban revoked. >> [laughter] >> I I don't know if you know this Rob but Tom this is Tom's been Tom's pet project in my mind. I think of him as the onion futures guy forever. He's like, "DeFi's only use case is onion futures." >> [laughter] >> Yeah, I'm saying we had we had the proof of concept, but it was ahead of its time. It's uh but hopefully it inspired a generation of people who are now going on to make onion futures. >> Well, I I saw the pictures from the onion futures protest, and I I saw some Tom there. He was in the pictures at the onion future protest. He was the leader.

>> Wait, Tom, you were there? >> No, it was AI. It was uh yeah. >> [laughter] [snorts] >> You missed a great opportunity to stand up for what you believe in. >> I know. I um sorry, but I think that that was grassroots organized. The people are clamoring for it. This is This is their Occupy Wall Street is uh is this onion futures business. >> Right. This is like when they passed the um prohibition. These are the anti-prohibitionists. >> Yeah. Yeah. Well, well. >> Yeah, onion bootleggers. >> Legalize it.

>> Yeah, yeah, legalize it. >> Well, I I love that. All right, so uh on one of the bigger pieces of more like TradFi-ish news that came out today, there was the rumor about uh Visa buying Fireblocks, which Fireblocks like very quickly said was not true, but it I guess a couple of interesting things came out of this. One is that this has actually been rumored for I think a while. Like I I'm sure you guys have heard this as well, but there's been a bunch of reporters asking around about this, of which I know nothing, but so I was surprised that it it finally came out. And I know that Fireblocks has been they've been denying it for a while, so I was surprised Axios actually reported on it. But the the report from Axios said that it was going to be for 2.5

billion, which is and I guess the follow-up said 2.5, but it also had rumored it between 2 and 2.5, which is also a headline-catchy number because Fireblocks had raised at an $8 billion valuation at 2021 at the height of the crypto market. And it would also be Visa's first acquisition in the space, although they've been rumored with a couple of others. And obviously they're doing a ton of work on the stablecoin backed cards, and some of the direct settlement with with stablecoins, etc. And so, I don't know. Robert, maybe we'll start with you. Big deal, not a big deal? Is it happening, is it not happening?

>> Well, I have no information whatsoever whether it's happening or not happening. I am not close to this rumor. If it does happen, hypothetically [snorts] speaking, if it does happen, I think it's a good acquisition for Visa. I think it's a decent enough outcome for Fireblocks. I don't know what other path a Fireblocks would have right now. I doubt they're going public. The market's a little bit sideways. It's probably a great outcome for them.

So, we'll see. Knock on wood, observe from the sidelines, but I think everybody should be happy if that actually happens. >> Yeah, I would agree with you. I I think it's been You know, as everyone kind of knows, the wallet space has been tough. Obviously Fireblocks was far out in front of everybody else in terms of revenue, in terms of infrastructure, and and customers. They have done a They underlay a lot of the, you know, stablecoin payments companies that are out there. They're got a lot of the big asset managers, a lot of the big banks as customers. But it has been somewhat of a sideways, you know, market for uh the last, you know, number of years.

And, you know, to your point, Robert, about them going public, they're They're today to get public, you know, when you got Open AI, and you got Anthropic, and you got SpaceX, and you got all these guys out there. Like, we're talking about a scale needed to catch the attention of these IPO investors, of which, you know, there's very little of that exists uh in crypto outside of maybe the exchanges today, at this point. And, you know, if you're not going to get picked up by one of the indices, if you're not going to get picked up by coverage from the sell-side analysts, if you're not going to get it, you know, a lot of attention from the from the IPO investors. I think it's quite tough today to go public. You of course can do it still. You might just not have the outcome you want, so you'd

rather stay, you know, private if you if you can. And so, it's they're sort of in this, you know, catch-22 of a market that is, you know, everything that we've been talking about happening in you payments and stablecoins and tokenization and etc. is is all growing, but it hasn't necessarily meant a lot of growth in called the wallet market. Yeah, and so, um they are in a bit of a a catch-22. I agree with you, you know, this price would easily clear the pref. You know, most of the investors would would make money on it. Obviously, everybody who's been there since the beginning would make a lot of money. It's a great outcome uh in any world when you you you you start a company and you get to sell it for 2.5 billion, but it it is a you know, I'm sure it's a hard pill to

swallow for people as well when you go from 8 billion to 2.5, despite the fact that there probably are incredible synergies here uh with Visa and uh and kind of what they're trying to do on the stablecoin payment side. >> The only thing I'll say is their last round was literally at the top of the last cycle. Like, it was when all markets were extremely frothy okay? There's a lot of companies that raised at like five times the price they're at now, 10 times the price they're at now, 20 times the price they're at now, right? So, like, I don't think it makes sense to be like, oh, well, the high watermark was 8 billion dollars. Like, this is a terrible outcome. No. The prices in January '22 were bubble prices.

>> Yeah, I mean, we've seen this with Bain & Company obviously in the SaaS companies. Like, many, many of those companies it's they were in the same exact situation. I mean, Robert, to your point, I remember blockchain blockchain.com where they said they had a 13 billion dollar round right around the same time. And you had Chainalysis had an 8 billion dollar round. You had Alchemy had 10 billion dollar round. You know, OpenSea had a 13 billion dollar round. Right? Like, you know, the list goes on. Like, it was a 2021 was a a time, and there's obviously a lot of great outcomes that doesn't need to be tethered to what happened in in 2021.

>> Maybe maybe we need a Bending Spoons for crypto. You know, someone go round up these Bending Coins people. >> Isn't that Isn't that what Rob's other podcast co-host was supposed to be doing? That's what I If I remember correctly. >> No, it was kind of kind of >> Yes. Yeah. >> It was private equity for crypto. >> Yeah, yeah. >> It's the same thing. It's supposed to be that. >> But you're not you're not acquiring like crypto companies. >> it hasn't done done any acquisitions, that's one thing. But I mean, it was supposed to be this. That was the theory. >> I'm I'm talking about going out and buying the I guess because public, but like this this long tail of like they're not dead, but >> think I don't think the mandate for the PE people is like oh no public crypto company.

They could have. >> Of for Bending Spoons, you mean? >> No, no, for Santiago, right? Like he could have totally right. >> about Bending Spoons. I'm talking about Bending Coins. I'm talking about Bending Blocks. Yeah. >> But Santiago was doing like SMB type rules. They're more like a thrive market type type thing, right? >> I guess my point is it's like in some ways that's not that different. Some of the Bending Spoons small acquisitions look like that. They've done a lot. They've done a a ton of acquisitions. It's not just the ones that you >> consistently consistently kind of gone up market, right? So, I mean, what what was the most recent one? It was It was >> Airtable.

>> Airtable. Yeah, that was the most recent. >> now they now they have Warren Buffett money, so it's kind of different game also. Um >> Yeah. >> I think the the thing is like Five Blocks seems to grind it, they built a real product, they have made a lot of people not lose their money. They deserve something good to happen and I don't know. I It's also just like crypto is sort of like I It's ironic that all this AI stuff is actually just basically relearning crypto lessons right now as we talked about earlier. At the same time, crypto's kind of just becoming finance plus plus as opposed to like new internet, so it's yeah, valuations have have to come down.

The real question to me is who in the who who in the AI boom is the Fireblocks of the current current cycle? Who is the Fireblocks >> What does that even mean? >> Who's raising Who's raising at X and will close at 75% down or more? >> Most. >> Yes, but who who's the one who stands out to you as like the >> I mean, did you guys see the the Character AI bankruptcy filing? They They raised at 2 and 1/2 billion from Andreessen in the last round. And at the time they raised from Andreessen, they were burning $16 for every dollar revenue in compute.

For every dollar revenue, they burn $16 of compute. Like, how many companies do you think are doing have unit economics like that right now? I bet you it is a lot. >> Yeah. >> And like so So, what has to happen? Like, the VCs have to continue putting a bunch of money into this for a long period of time until they unless they can get, you know, unit economics positively soon. But considering the volatility >> a little bit different. There's also the problem here of like you're like, "Okay, they're spending $16 to make $1." The person making $16 must be making a lot of money. No, that person taking the $16 is like going and taking out 4 years of debt that they're servicing at [ __ ] 15% amortized. They're not making that $16 either, right? So, it's like on paper, there's kind of a a little bit of

hot potato. It's like, are the lenders lending to the hardware providers making money? Are the hardware providers making money? Are the apps making money? Or all three of them deluding themselves and then actually there won't be enough revenue in the long run. That's the real That's the trillion-dollar trillions of dollar question. >> To be fair to CoreWeave's 15% debt, that is just the unsecured piece. They do Most of their debt is, you know, secured against future contracts that may or may not actually happen. >> Most of them has Papa Jensen kicking in an equity backstop. That's why they're That's why you I compared to the other neo clouds, they're in the best position. I feel like the market just is being irrational about them. But some of the other ones, I don't know. Who steps in when their debt goes up?

>> Well, they probably all just need to re-rate. Like the whole thing >> Well, my my thing of like where is the where does the AI financial crisis happen? Is like there's a lot of duration mismatch here, right? It's like neo clouds and hyper scalers are borrowing at 10-year tranches, right? They're borrowing selling 10-year bonds, 5-year bonds. But let's say 10 duration of 10. Cuz like usually they have to do project financing, then collateral financing is adds up to 10. Then they sell to to smaller providers. They sell to inference providers, maybe they sell to to hyper scalers for excess capacity. Those are all like 1 to 3-year contracts.

Maybe 5-year at max. So, they're taking this 10-year thing, chopping it up into a bunch of 3 to 5-year contracts, and then charging some premium for that, and then that's their business. >> Well, what are the people who are the inference providers doing? You have the the the everyone from Cloudflare down to the small inference providers, plus like Together based on model, etc. They're taking this 3-year thing and chopping it up and selling it quarterly to SaaS companies and companies that want to do fine-tuning or like companies that are consulting companies doing fine-tuning like Applied Compute type companies.

Okay. They're charging a little bit of premium. But if I look at this thing, you have this whole duration curve, and you have yield at each duration. And if you try to add up all the numbers, it doesn't quite There's like some slippage that is unexplained. And I think that that's where that's where the the That blows out, the market's dead. >> Yeah, I am I have a lot of concern about what is happening in these markets. But that's because I live on the East Coast. I live on the West Coast, there is no concern. Infinite compute demand. We're all the singularity's happening in a year. Yes, and >> Do it.

>> And the singularity means more chopping block in the future. And with that, I think that's all the time we have for today. >> Thank you, guest host. >> Thanks, everyone. >> [music]