How Arbitrum's Security Council Froze $70M of North Korea's Stolen Funds

Transcript

Hi everyone. Welcome to Unchained, your no-hype resource for all things crypto. I'm your host, Laura Shin. Thanks for joining this livestream. Before we get started, [music] a quick reminder, nothing you hear on Unchained is investment advice. This show is for informational and entertainment purposes only, and my guest tonight may hold assets discussed [music] in the show. For my disclosures, visit unchainedcrypto.com. Bitcoin changed how money works. Cetus changes how Bitcoin scales. Cetus uses Bitcoin as both a settlement and data availability layer, as Bitcoin's application layer. >> [music] >> Cetus gives you access to the first trust minimized BTC on a fully programmable platform, and a native stablecoin for Bitcoin, CTUSD. You can now participate in Bitcoin capital markets with lending, privacy, [music]

payments, Bitcoin yield, trading, and predictions. You get expanded Bitcoin utility without sacrificing its security. Cetus mainnet is live. Put your BTC to work at cetus.xyz/unchained. Etherfi is giving Unchained listeners 15% cash back on ride shares, groceries, and restaurants right now, which honestly is kind of wild for a card like this. On top of that, I'm getting 3% cash back on every single transaction using my actual crypto. No conversion fees, no nonsense. My bank never once did that.

And it goes beyond just spending. You can borrow against your holdings at 4% or less, which is super useful if you don't want to sell your assets. You can also earn on all major assets up to 8% APY just by holding. And moving money is just easy. No hidden transfer fees, no friction. It just works globally. If you want to check it out, go to ether.fi/unchained to claim your offer. That's ether.fi/unchained. Step into a new era of wealth. Discover Nexo, the premier digital wealth platform. Manage your crypto portfolio with confidence and control. Receive interest on your digital assets. Borrow against them without selling. Trade a wide range of currencies all in one

platform. Now available in the US with 30 days of exclusive privileges for new clients. Experience wealth club premiere. Access enhanced interest rates, reduced borrowing costs, and crypto cash back on swaps. Get started today at nexo.com/unchained. I'm here now with Griff Green, Arbitrum Security Council member, leader of the DAO Security Fund, and co-founder of Giveth. Welcome, Griff. Hey, good to see you, Laura. All right. So, for any audience members who don't know Griff, he was very closely involved in the DAO, which created Ethereum's first existential crisis and led to the Ethereum hard fork

that created Ethereum Classic. I got to know super well working on my book. Um so, that's what's that was a major incident in that. And now we are going to talk about him being involved in another similar code is law situation. Um so, Griff, before we get into all these details around the Arbitrum Security Council's decision, why don't you just um set the scene a little bit more about how North Korea came to this point where some of its funds were vulnerable to Arbitrum being able to freeze them? If if if you haven't been paying attention, there was this crazy hack where uh on Layer Zero, where um KelpDAO, who created a staked ether called rseth, this token that is

collateralized by ether on mainnet. They had a bunch of those rseth tokens in the Layer Zero bridge. And uh North Korea hackers were able to effectively find a way to take all the uh rseth that was in bridges that has a tokenized representation on a bunch of L2s, take it and bring it all to mainnet in their hands. And uh to extract value out of it, they quickly uh borrowed used it as collateral in Aave to borrow a bunch of weth on Aave uh on mainnet, and also bridged a bunch to Arbitrum to also uh borrow e- on Arbitrum. So, then uh and and then my understanding uh from uh

sources uh that I know in Seal 911, that they actually then continued to try to exploit Layer Zero. They worked for another day or so just or some hours after that just trying to do it. And then for some reason, they left their to- their ether there for about like 48 hours. They just left it in the addresses and took a couple days off. In that time, um the Arbitrum Security Council was notified by Seal 911. And just so you know, like if you ever get fished, if you ever get hacked, if your Telegram gets taken over, if like you know of a security vulnerability in any way, just DM Seal 911. These guys are the heroes

behind the scenes. It's Batman and Robin and the whole Justice League. They're all back there. Uh Taylor Monahan uh is usually my interface, and she hosts the show on this podcast. So, uh you know, DM Seal 911. It's @seal_911_bot, uh b o t, on Telegram if you have any issues. That's what I do. That's what you should do, okay? But anyway, um these heroes behind the scenes, they're messaging me, mostly Taylor, and she's like, "Hey, like I think maybe this we could use the Arbitrum Security Council to steal these funds back from North Korea."

This was possible for a couple reasons. The big one being they just left the money in one address. Even if they were just moving it, like that would have been challenging, you know? The the other thing was that there's an incredible technical team uh that was able to create an ingenious solution that didn't up- didn't require upgrading the Arbitrum node software. Instead, we were able to use a transaction on Layer One to actually make this happen. Uh so, that those were the two like main things that allowed for this. Uh in most circumstances, the Security Council does not have the power to just freeze people's funds. Uh that's not that's not feasible. It's not It's not really

possible in most scenarios. So, uh this is like a very unique situation. Like I What I say most scenarios, I mean all these other hacks that happened. There are lots of hacks that happened on Arbitrum. We've never had the opportunity to just Never before has anyone said, "Hey, Security Council, should we freeze these funds?" Like not once. Uh this is a very unique situation. Okay. So, I was going to ask that how the idea came up, but it was literally Taylor who just saw like they stopped moving the funds, we have this opportunity, and she suggested it. I don't know if it was Taylor's mind, but I interfaced with Taylor.

But also, I'm good friends with Taylor from back in the day, so. >> [laughter] >> Right. Right. [gasps] Um yeah. Yeah, she was also very involved in the DAO, and you can read all about it in my book. I'm not trying to promote it. I'm just literally It really is the best source of information if you want to know what happened in the DAO. 100 pages of The Cryptopians is like the reference material. >> [laughter] >> Uh So, okay. So, one other thing that you said there was you said something about how you were only able to do it because you were able to make a transaction on mainnet on Layer One. I So, I did I didn't actually either see that or or like follow that. So, can you just explain that part? Absolutely. So, uh Arbitrum is a stage one roll up. That

means that it has a security council with emergency powers, uh but it also has uh what they call Oh my god, how am I blanking on what it's called? Forced inclusion. Also has forced inclusion, which means that let's say because there are centralized points. Every roll up, there's a sequencer. And in almost all roll ups, the sequencer is centralized. So, there is a piece of software somewhere that someone could just say, "Hey, if this address move says move money here, don't listen to him. Just ignore it." Cuz if it's one sequencer, right? Uh and and that is possible.

Um but in a stage one roll up like Arbitrum, or at least I shouldn't speak for all stage one roll ups. I'm not L2 beats. You can go look all this information up on L2 beats if you want to know how every roll up is. I I I shouldn't know that this is for sure, but now I'm like second guessing myself. Either way, uh if you want to move your money on L2 on an Arbitrum, you can actually make a transaction on Ethereum, and it will move money on Arbitrum. And that's how L- roll ups actually uh have the same security guarantees as Ethereum, right? And that this is the the magic of roll ups. This is what makes roll ups so interesting cuz you can have a centralized sequencer and be censor- censorship resistant,

right? Uh so, uh we were able to use that same tactic and actually and and because if we wanted to give ourselves new rules or upgrade the the software of the Arbitrum node, we could do that, and we could do other things have other strategies to take the hackers' funds. I mean, this is like, you know, blockchains are open source code run on servers and social consensus. So, like it's open source code, you can change anything in Bitcoin Ethereum anywhere.

The reality. So, like, you know, um but uh I'm I'm tangenting pretty hard. Basically, uh we if we wanted to do that, these other other simple solutions, we would need to go coordinate with a bunch of other people running the nodes, otherwise it would break everything. Uh just like in Bitcoin or Ethereum. Uh but because we have this forced inclusion tool, we can actually make a transaction on Ethereum. We have to wait 15 minutes. Uh and uh and since the hacker wasn't able to move their funds in that 15 minutes, that transaction went in and it actually was able to send their funds from the the address they control to uh an address that no one controls, 0x000

DAO. And uh now it is up to the Arbitrum DAO governance to decide what to do with those funds. Okay. Okay. So, now let's talk about this security council. Just explain, you know, what it is, how the Arbitrum DAO is set up, and and a little bit more like on yeah, what what each entity can do um and when. So, there's Arbitrum DAO is like a a very decentralized governance so like tool. Like there's actually five what they call Arbitrum aligned entities. The the the I mean, they're the ones that aren't worth talking about so much, but

I do love them and they're great guys. It's like Entropy and uh the the um OpCo, right? Uh but then there's also and then there's like a gaming commission. And so, those three don't don't have anything to play with this right now. Uh they will later, but for now, the main entities that players within the Arbitrum governance system to think about are the security council, the foundation, OCL, and um yeah, I guess that's it. Just those three, right? And DAO token holders. That's the other one, right? The actual DAO itself. So, uh the security council is elected by Arbitrum DAO. So, this is Arbitrum DAO token holders who delegate their ARB to

delegates. Delegates vote and they elect people like me. And in fact, there's an election happening right now, which is kind of funny. Uh you can go vote for uh the security council members. Uh the security council itself is made up of 12 people. Six are elected. It used to be every 6 months. We're transitioning to every year now. So, so terms are moving towards being 2 years long. And uh and six new people come every year.

And those six people are independent entities. The security council itself is not a legal entity per se. It is made up of six independent entities. People. I'm just a person. I don't know I have a company. Some people will do have companies though uh in there. And we each are tasked with a couple things. There's some explicit guidelines about upgrading tech for technical reasons. And there's of a general purpose guideline of you can you know, uphold the Arbitrum constitution.

And you know, this is a long story short, obviously. Okay. And and how did you get appointed or elected or even nominated? Well, there's it's it's a two-stage process. First, I said, "Hey." Actually, a few people within Arbitrum suggested I do it. And so, I was like, "Okay. Sure, let's go." >> And and do you think that was because you have a long history of doing this kind of DAO governance type Okay. Uh DAO governance and also white hat security. So, after the DAO was hacked, I led the white hat group, which is basically Seal 911, um but not as good.

>> [laughter] >> Uh between 2016 and 2019, we rescued lots of ICOs. We rescued $200 million in a parity multi-sig hack. So, you know, while I'm more of a non I mean, I'm a chemical engineer. I have a master's degree in digital currencies. I'm not a developer. I'm not the guy who's going to read the code, but I do have a lot of experience in fund recovery, incident response more than almost anyone. So, like uh that that was probably not And I also am very active in Arbitrum DAO governance. I'm a high-ranking delegate. So, I have like a mix of you know, incident response experience plus like uh context of what's going on in Arbitrum. So, that's why they suggested me. And then

there's a nomination phase where Arbitrum uh you have to receive at least uh some percentage Lately, it's been like 9 million tokens to be uh of ARB tokens to be able to run. So, there's like a nomination phase with ARB tokens. And then there's the actual election. And so, we already passed the nomination phase in the current election, and now we're voting on the real election. Okay. So, Taylor suggests or somebody suggests this. And um who I like I I don't know if it's okay for you to name who all the 12 people are, but I'd be curious to know. Or if you can't name them, can you give a sense of like what seats they occupy in crypto or DeFi or or Arbitrum?

I can name them. I'm not going to, but it is all in the documentation cuz they're all publicly elected. Unlike the security council of base, uh where it's secret and a lot of L2s, they have secret security council, which is also a fine strategy for opsec and like, you know, um reasons. That's good, but in Arbitrum, it's all public and on the documentation. And they're all rockstars. The dude, the Arbitrum security council, pretty sure the by far I mean, I don't know the secret ones, but these are heads of heads of uh you know, um like auditing companies. I'm just going to name some of the >> [laughter] >> Yeah, you can. them cuz I found the list. So, um Gauntlet is one.

Um somebody at Offchain Labs, which is um the you know, the labs entity for Arbitrum. Um Immunefi, which is um a security firm and bug bounty platform. Is that XBT, who's very well known. Griff. Um Michael Lewellen, who was just on the show. Um also talking about I think it was a different hack. I think he was talking about Drift. Um and then uh let's see. OpenZeppelin, which um I think I think they used to be an auditor, but I think they do a little bit more like additional things to that. So, that's just a sampling. So, okay.

So, this suggestion gets made. Then what are the conversations like at that point? Like, was it um controversial right away and there was a lot of argument? Or what you know, were you all kind of leaning one way or the other from the start? Or yeah, just describe, you know, how contentious it was and then what the arguments were back and forth. So, I can tell you from my perspective, but the actual conversations within the security council are confidential. And so, I can't really give that that thing, but I can say from my perspective and and what we were what we were thinking.

And and I can tell you what I was talking about with Taylor, who's also on the show, right? Um cuz really, her and I were going back and forth on whether or not this is feasible. And and like I said, the the the technical solution uh was ingenious. I'm telling you, this was not uh in you know, the best technical solutions end up very elegant. And that's what this was. It ended up very elegant because the the other ways that um at least I thought that we could freeze the funds weren't feasible. And uh I reached I I I talked to uh as many people as I could because I I don't know. For me, if if you can stop North Korea, you do it, you know? If you can recover

users' funds, you do it. If it's in your power, you take the power to do what's right. And and so, I I was uh probably I mean, I can't speak for other people, but I was very gung ho on uh on this on this action. And I was pushing it from different angles, mostly because Taylor was also being like, "Come on, Griff." And I would stop working and be like, "Okay, you know, I'll go talk to other people." And kind of coordinate this because also this is my role in incident response. I'm more of a coordinator, you know? Um so, yeah that's uh that's that's the only thing I can do. I can't read the code. But can you uh so, um can can you at least reveal what any of the objections were?

No, but what I can say is why I rejected it at first as well. Um because uh first with the technical solutions we had, uh that I could come up with at least, uh it required upgrading the Arbitrum node. And if we do that, there's two problems. Uh number one, uh if we just do it unilaterally without talking anyone, it'll break the whole Arbitrum network. Users' funds would have problems. Oracles might go off. Like, it would cause a lot of problems in the crypto DeFi space. So, just that and and upgrading the node is uh the most obvious way to do this. Like, we can just like change the state of the

node. And um it's not but it's not it's not uh it's it's actually less elegant than a normal transaction and then it would cause a lot of issues. So, um I you know, we I personally was not like a fan of trying to take North Korea's money, but then causing who knows how much existential risk to other platforms and other things. And we're like, yes, maybe we end up stopping North Korea, but then we have a lot of other people lose money because of liquidations or something.

So like uh but then for me personally, when we found a technical solution that didn't involve upgrading the node, then it was for yeah, I I I was I was stoked. You know, I there was no real reason in my mind not to do this. I think there is fear. Uh I think there are legitimate risks to doing an action like this, but most of it is philosophical. I mean, really, the legal risk from my standpoint in my opinion is like so small. Like, really, I mean, I've done crazy things in crypto. This is This is the third largest recovery effort I've been had been like

majorly active in, you know, not just like passively, like like active in in. So, and even though I've gotten legal letters about these things, no one's ever sued me. No one's even tried. So, like I I I I have a firm belief if you do what you know is right, like things will work out. And but there the the risk is the story, the narrative risk, right? It's like, "Oh, no, if they can freeze North Korea's funds, they can freeze anybody's." And I know I I personally just have a different perspective on how those type dynamics work than I think most people do.

Yeah, I mean, I think one of them though is frankly that and and this was what the argument was back in the day right when the DAO hack happened like in that initial Skype chat where the exchange operators were super mad because some of the Ethereum people were suggesting that they stop trading of ETH. And you know, at that point like people were saying basically there's going to be quote unquote rollback which really is more like of a Bitcoin term technically. You know, ultimately what you guys did was something very similar to what you just described here where it was more surgical and it only affected yeah, the DAO token holders and so there was a way to to kind of

conduct the operation where it didn't affect other people in Ethereum ecosystem. I think like basically one of the arguments that could be made is that potentially once a government realizes that they can there's a you know, some entity or group of people that they can pressure to do something that potentially that is a risk. But yeah. Yeah. For me that's like um uh security through obscurity. I mean, the fact of the matter is this is possible in Bitcoin. And I know a lot of people are going to get mad at me and already the Bitcoin trolls have been coming after me on Twitter. The Dragon's Den is activated if you know what I'm talking about. But like the the fact is

there's the this is a core tenant of blockchain technology that we just don't talk about. Blockchain technology is open, modifiable. It's it's it's just code, right? Running on servers and social consensus. And that social consensus piece is the thing that destroys the idea of immutability. It destroys the idea of like you know, complete agency. I mean, it is it does have agency, but it's like it can be persuaded.

If if if the Bitcoin miners, the heads of the biggest Bitcoin mining rings had guns to their head and with three Bitcoin miner pools, you can control 51% of network. They can, you know, do basically anything. They're talking in Bitcoin about stealing Satoshi's fund coins right now. They even think it's a good idea personally. >> them, not stealing them. That's exactly what we did though. We didn't steal them either. Right. Right. So, uh it's this is this is by definition part of the blockchain underpinning like how this technology works and it's it's difficult because the actual accountability for this it's not in the

multi-sig or even in the DAO. It's really in the price of the token. If Bitcoin wants to freeze Satoshi's tokens, like who what are the incentives, you know? Like eventually I think the incentives will be big enough that it should happen. But what really matters is all the people who are holding or will might want to hold Bitcoin and those reasons, those market dynamics are what provide the accountability for these for these systems. And so with with Arbitrum it's the same. It's like I've only from people that I know are real and exist in this world that aren't like crazy monkeys tied to a computer just saying horrible things like in

Super Mario. That's what I'm referring to. Anyway, they they everyone agrees with this move. And I think that's the accountability layer that these social social consensus engines really live behind. It's possible to do in Bitcoin. I've done I've been part of doing it in Ethereum. Uh and we just did it in Arbitrum and it's a little bit a little bit more shaky cuz not so many people knew these things were possible in in L2s, but uh yeah, that's just the reality. Bitcoin changed how money works. Satraya changes how Bitcoin scales. Satraya [music] uses Bitcoin as both a settlement and data availability layer. As Bitcoin's application layer,

>> [music] >> Satraya gives you access to the first trust minimized BTC on a fully programmable platform and a native stablecoin for Bitcoin, CTUSD. You can now participate in Bitcoin capital markets with lending, privacy, [music] payments, Bitcoin yield, trading, and predictions. You get expanded Bitcoin utility without sacrificing its security. Satraya mainnet is live. Put your BDC to work at satraya.xyz/unchained. Etherfi is giving Unchained listeners 15% cashback on ride shares, groceries, and restaurants right now. Which honestly is kind for a card like this.

On top of that, I'm getting 3% cashback on every single transaction using my actual crypto. No conversion fees, no nonsense. My bank never once did that. And it goes beyond just spending. You can borrow against your holdings at 4% or less, which is super useful if you don't want to sell your assets. You can also earn on all major assets up to 8% APY just by holding. And moving money is just easy. No hidden transfer fees, no friction. It just works globally. If you want to check it out, go to ether.fi/unchained to claim your offer. That's ether.fi/unchained.

Step into a new era of wealth. Discover Nexo, the premier digital wealth platform. Manage your crypto portfolio with confidence and control. Receive interest on your digital assets. Borrow against them without selling. Trade a wide range of cryptocurrencies all in one platform. Now available in the US with 30 days of exclusive privileges for new clients. Experience wealth club premiere. Access enhanced interest rates, reduced borrowing costs, and crypto cashback on swaps. Get started today at nexo.com/unchained.

Okay, so let's talk a little bit about like what lessons North Korea took from this. Because to my mind, if I'm them, I'm thinking, "Well, I'm never going to use another L2 that has the kind that kind of capability that Arbitrum has." So, you know, do you feel like now we're just going to see them as quickly as possible get into ETH and Bitcoin or like like, you know, like to my mind it set some kind of precedent and it sets um it it kind of like almost gives them a warning of like if you try this again, we're going to fight back. But I don't I don't know. What what do you think? I mean, I think that's the best precedent we can set against these people. It's like, you know, the there's a reason that you don't

negotiate with like people doing ransom because if you start doing >> except like we're going to fight back, but only on L2s, right? Because like I mean, what what are we going to do or what will crypto people do in Ethereum or Bitcoin if this happens? I mean, in general that that even though it's possible it is possible to do it in Ethereum and Bitcoin. It's it's more difficult than this. Uh but it's it's still possible. So, Well, yeah. But I mean, okay. And I think L2s with security councils, they will probably feel emboldened by the response of the community in this situation where they can do it. But the fact of the matter is it it's it was

lightning striking. North Korea never sits lets their money just sit two days. That's what I was going to say. This basically is like a replay of the DAO cuz the only reason it worked was because there was like this moment where they weren't moving the funds. Exactly. So, it's just like the DAO where the the money well, in the DAO the money was stuck. Here for whatever reason just didn't move it for 48 hours or however long. So, Yeah, I know. It's crazy. They're idiots and we can do it. >> Okay, but but then now I think I feel like their lesson is going to be to launder it as fast as possible. Of course. I mean, I think that >> [clears throat] >> I don't really understand how this is was possible. It's crazy cuz

they always launder as fast as possible. They always do. And I think actually this this goes to show like Steel 911 is just an incredible organization cuz the second this hack happened, behind the scenes, they're coordinating with law enforcement, they're coordinating with all the bridges, all the all the people that they could. They're blocking UIs this address from UIs. They're putting this address on all these lists. And like the infrastructure of Steel 911 is really the hero here. Like I feel like the security council's getting a lot of credit for executing. Um but the the real execution happened a layer up and it's Steel 911. Uh the it's it's just incredible what they've done.

Uh and and and and this was years of work to be able to have all the connections where it wasn't possible for uh North Korea to just like bridge off of Arbitrum. The the native bridge has a 7-day delay. And uh I will say that I thought they would end up using it and that's how we would freeze them. When I when I was first taking this action, it's like, you know, I I felt like, okay, all the bridges are frozen. They'll probably have to use the native bridge, and now I need to convince the security council that we can freeze it there, you know?

Um And I don't know like I like I said, I can't talk about the deliberations during that, but um that was the first conversation. Uh so, uh or that Yeah, you know, that was the first my first thought of what we could do. And and that was where it sat. And because there was because Seal 911 did such a good job at just blocking all the exits besides the native bridge, which doesn't have the ability to be censored like that. Okay. Well, it does, of course, if you're the security council.

Okay. Okay. Um last question. Uh I'm just curious. I'm sure your social media's blowing up with criticism of the action. So, what are You know, I what's what's amazing is like I think it's a more like disappointment in the narrative of blockchain tech than it's criticism on our action. It really is across the board. Everyone's like, "Oh, man, you know, after billions of dollars being stolen by North Korea, at least we got a little bit of a punching, you know, and got 70 million back." So, like, pretty much everyone who's a real person is like down for this except for people who already hate Ethereum and they're Bitcoin maxi maximalists or some

other chain or uh or like there's a lot of people also that just are contrarians and want to take the social media thing. I think the best argument came from Gabe Shapiro, which is just like, "Hey, security councils need more underpinning than what they have." He also agrees and he is on security councils and would would sign this transaction, right? Uh so, pretty much everyone says they would sign the transaction. Yeah. There are ways that we could improve things, and he he his argument is the best, I would say, and it's uh you should have more legal underpinning, and you should have more rules about when you will act and when you won't act, and you know, I don't

agree with the legal underpinning. I actually think that our our structure is really beautiful um with 12 independent entities that have to come to an agreement on a multi-sig. Uh but, I do think that we could probably have more, uh you know, understanding of what each member's guidelines are. And I think in future elections, we will. Like, every member is going to be asked, "Hey, would you have signed this transaction? What are your rules?" And um I I think that's actually the the better thing with the security council.

It's it's very difficult for the security council to agree on anything. And I think that's how you want it. You don't want it so that there's clear guidelines. Oh, we're supposed to act. We're not even going to think because these guidelines tells what to do, you know? I actually think that it's better that there's like independent people with independent positions, and that the security council is like this really rarely used supreme court of Ethereum that hopefully we can get rid of them eventually and have a fully, uh you know, permissionless stage two roll-up.

Okay. So, at this moment, you have these funds that you've rescued. Now, what happens in terms of Arbitrum governance? Which entity decides what happens to those funds, and what are the main options that are being discussed at the moment? So, right now those funds are in basically a dead address, 0x 0 DAO, right? Uh DAO 0. And uh it's like uh Arbitrum DAO has So, the security council is here for emergency action. And we very we had, of course, options of what we could have done.

Um we decided to put it in this address so that the DAO is to decide. It's And so, that means Arbitrum DAO token holders will eventually have a vote on where these funds go. And this is actually kind of similar to what happened to the white hat group in 2016. Uh so, we rescued, you know, uh so, when the hacker in the DAO stole money from all the DAO, he only stole about a third of it. Uh we took the last two thirds of it, and, you know, then the hard fork took the money from us, and it took the money from the bad hacker, right? Uh but, then Ether Classic emerged as a parallel dimension where the hack still happened. And uh and so, we had 10% of all Ether Classic

in existence. And in 2016, this we didn't know what would happen. So, we thought the ETC tokens were just going to go to zero. And uh my personal opinion was that we should sell it for Ether and then like give people Ether back because who knows this ETC chain is unlikely to exist. Uh everyone in Ethereum had was airdropped ETC. So, like, how the market kept it alive blows my mind. It's kind of like bit To me, it would be like Bitcoin Diamond or bit Bitcoin Gold, you know?

It's not going to have any value compared to Bitcoin. But, it ended up surviving, and uh but, when we took that action to sell the ETC for Ether, uh we had to use centralized exchanges. DeFi didn't exist. And uh and the exchanges actually froze our ETC. Uh long story, you can read about it in Laura's book, but uh when they froze it, they weren't going to give the ETC back to us, right? Who are we? Uh and uh and so, we had to all work together on a solution to get the money to the right individuals, right? And so, uh we built a contract a smart contract that we could deposit into, and anyone could

deposit Ether Classic into, and then the token holders could the DAO token holders at the time of the hard fork could come and claim their the equivalent ETC of what we had that was in the DAO. Which is very interesting cuz it made the DAO hack the only hack where everyone made money. All the DAO tokens holders got all their Ether back and ETC. The hacker got ETC. Really, it's like Slock.it and my company who did the DAO, we're probably the only people who got screwed in the whole DAO. And then the Ethereum Foundation was selling ETC for like over a year and didn't have to sell their Ether. So, just incredible uh situation there. But, the the part that I wanted to illustrate was that by having these three parties

that all had to agree on the distribution method, uh I think it actually made for a stronger solution. And in this case now, Kelp DAO and Aave have 70 million reasons to coordinate better than they were, uh I think. And uh and actually have uh a good public distribution of what funds are left over from the the Kelp DAO exploit. So, you know, I think and and probably LayerZero will come in and will probably come up with a good uh proposal. And that proposal will actually have to go to Arbitrum DAO token holders.

So, ARB holders are going to be the ones who decide cuz they have sent we have 70 million dollars, and they have to go through public governance to decide what the final outcome is. Which I think will lead to a much better outcome than what would have happened, not only because of the 70 million dollars, but also because of the public discourse. Yeah. Yeah, hopefully. I mean, the challenge is, you know, it's hard enough for one DAO to coordinate. We needed two DAOs to coordinate, and now we need three. I mean, that's the opposite side of it. Yeah. Yeah, I I'm I'm going to be very interested in watching this conversation unfold because um yeah, we'll we'll see what happens. Um okay.

>> I'll tell you, rescuing funds is way easier than redistributing them. That's always the hardest part. Yeah, like like even just, you know, the little bit of the story that you told about the DAO, like there was so much more to all that. Um you know, the exchanges didn't agree with you about returning it in Ether, but then on top of that, like just setting up the withdrawal contract, you had to figure out like at what point in time were you going to honor the, you know, the amount of DAO tokens that you had. There were Yeah, there were just like so many considerations about how to redistribute it. So, um if you it feels like that's probably going to happen again cuz, you know, the devil's really in the details of these things.

But, all right. I mean, you So, last time you were on the show, you talked about this new security fund that you set up. [laughter] And oh my god, wow. Like, the timing on that compared to, you know, just the sheer number of security incidents we've had since then. Obviously, this is coinciding with AI, you know, becoming much more readily available and improving just at such a quick rate. So, um talk a little bit about, you know, what you like just all the lessons that you learned from this, and how you think security should be handled going forward. forward.

You know, I've been disappointed in our status our our state of Ethereum security in a lot for a long time. I will say I do believe Ethereum is by far the most secure blockchain. We're a way more decentralized than any other blockchain by a long shot, including Bitcoin. Uh the the because Bitcoin mining pools are such a centralization uh point, and the staking is way better distributed. Uh so, I really believe Ethereum is the most secure blockchain in the world. Uh however, we have the technology to be better than PayPal. We I I don't know any We have We have the technology to be better than banks, and yet I don't know anyone who has their bank account fished.

I don't know I don't know anyone who like accidentally sends money to to the the right person on the wrong chain. You know, like that doesn't happen, right? So, like we have a long way to go for user experience, for just making it safe. Like Ethereum is extremely secure. It's not safe. It's not safe to use. And And I I really want to change that. I I've been I've made lots of efforts in the past to change that. And this is by far the best chance I have to actually make an impact in that direction. So, we need to better wallets and better wallet tooling. We we need you know, better user experience.

We need better bridging. We need better Oracle security risk analysis. Like really the the you know, there's a lot of reasons for this recent Kelp DAO exploit. One of the biggest things that made it as bad as it is is is and and but maybe allowed us to actually rescue some of the money. But it's the it was the risk analysis of of the Ave Ave um you know, lending pools. They they probably should have done more. They did great economic research on the volatility of the markets, but they they didn't do enough technical research on the central points of centralization in each of the things. And And we learned that, you know. I really believe the goal of blockchain technology for me,

what gets me excited about it, is building something better than governments. And you know, the only thing that gives me hope is in 27 BC democracy died for like you know, 1,500 years or something. So, like you know, I I don't think I I just takes time. We're we're learning with every problem we get stronger and more robust. This we're super antifragile. And so, we just you know, it took 1,500 years for democracy to come back. I think crypto and blockchain technology, maybe it takes 10, 20 years for us to get it stronger and better and safer than the banks, but it will be, you know. So, that's that's that's what the goal is of the DAO

Security Fund. It's It's to get us there. It's to make Ethereum the financial backbone the financial backbone of the world, but also the backbone of civil society is what I'd like to see on top of it. Okay. And surprise, surprise, you guys are actually launching one of your QF round remind me QF is what what does that stand for? Quadratic funding. >> Right. Right. Right. Quadratic funding is one of my favorite tools that has come out of the crypto space. I think it can distribute funds better than governments do.

And most DAO voting, even in Arbitrum, most DAO voting and DAO tools keep the numbers of decision-makers well below Dunbar's number, 150 people. And quadratic funding is one of the best ones that actually well exceeds the number of decision-makers of 150. It's going to be thousands, maybe tens of thousands of donors that are going to donate to security projects and decide how a million dollars gets distributed amongst them. So, quadratic funding is like you know, a lot of these donation like tools, they'll have a matching pool. And if you It's like you donate $5, we'll match it with like 20% extra. We'll give you another dollar, right? Um what

quadratic funding does is it does that too, but then it says also if you're a unique person, you get more points, right? So, it still has a plutocratic angle, but it's like if someone donates $100, that's just as powerful as 10 people donating $1. And so, there's this like square root formula. And of course, the algorithm's a little more complex than that, but there's a square root formula that says the more people you get to donate to, the more of the matching pool you get. And so, I'm really excited I mean, it's been such a stressful week. I can't tell you because the DAO Security Fund is we're like onboarding security experts to participate in the round. So, on this this week, yesterday I announced the

final 100 security experts that joined the round. I was supposed to do it on Tuesday, but the day before, but things got held up with this hack, right? And then GiveWell just like a couple hours ago launched the million-dollar quadratic funding round for the Security Fund. So, I and I think what's really interesting about this, it's not even donating to the projects, but it's about getting all of these awesome security projects all in one spot. I think GiveWell we we did like an excellent job of making sure that it's only projects that are really focused on security and not just random projects.

Like I think a lot of these rounds in the past were like you know, people come in with ideas and they apply and they get in and then they raise money and don't do anything. We actually had really strict rules. You had to have evidence of public benefit in the past. You have to be an actual security project that's forwarding, advancing security. Like there were lots of amazing applicants that were do privacy tools or newsletters and and they do some security stuff, but not security projects. Right now, we have about almost 100 projects that are rockstar projects that no one knows about so many people don't know about all in one place. If you just go through and actually peruse, you're going to be

a safer crypto user because there's all these tools you can use yourself. You can learn about security, what's going on. It's It's It's going to be really incredible. So, yeah, and that just started today. It goes on for 3 weeks. Applications to join the round are still open. And this is our first like big effort from the DAO to actually advance Ethereum security. There's going to be a round every every quarter-ish. Depends on the price of ETH a little bit. We want to make the rounds big and we we get our money from staking. So, depends on the price of ETH, but our target is quarterly to run rounds that advance Ethereum security. And but

beyond that, beyond the funding layer, we're also going to be a coordination layer for working together because I hope you don't mind if I keep it this rant, but there's like security is a public good and it's one of these things that also benefits from economies of scale. Right now in the Ethereum space, it's kind of like everybody is securing their own house, but there is in in a war zone, you know? And it's great that Uniswap and all these guys have bars on their window and great security alarms, but that's a lot of work just for their house. And actually we spend a lot of money on security. Not just from the hacks, but actually up front to make things secure.

If we can build tools that make everyone secure, I think all Uniswap and everybody else will spend less money securing their house and they'll actually benefit. And so, it's really a coordination issue at its heart and we can have better security for less cost if we just coordinate and secure the Ethereum space as opposed to securing each Ethereum project, which is what we're doing now. And so, that's really the goal of for me like beyond the the funding gets us in the door. The my our my real strategy and I I think the curators would agree. I haven't asked them blanketly blanketly this, but my

real strategy is if we can coordinate and and bring everybody together, we can secure the whole Ethereum zone and actually save a lot of money on security. Huh. Interesting. I like that philosophy. All right, Griff. As usual, it's been such a pleasure chatting with you. Thank you so much for breaking down what happened with this freeze and you know, giving [music] us some insight into how this surprise move managed to steal some of the funds back from North [music] Korea. Yes. And thanks to everyone who joined the live stream.

It was a mega show on all things that happened with this hack. I hope you found it informative and we will catch you next week. Thank you, Laura. >> [music]

[music] [music]