How eMudhra Signed for a Year With a ‘4’ as a Private Key

Transcript

Any frontier lab that has the ability to make frontier models and stay at the frontier that flips from like cash burn to cash flow positive is worth infinity. We've never seen any company like that in the history of the world. [music] Hey everyone, I'm Kane Warrick [music] and welcome to find money because what happens on chain never stays on chain. Uh before we begin, here's a quick ask. Um, Unchained is running a listener survey and it decides real things. Um, interesting. Um, we'll see about that.

Um, whether there's weekly uh show recaps, what time the streams are on, what goes into premium, it's anonymous. [music] It takes a few minutes and everyone who finishes it gets a free month of Unchain Premium. Go to unchaincrypto.com/servey. That's unchaincrypto.com/servey. And it's open until the 8th of November. uh which is like 2 weeks away now. So [music] uh yeah, go do the survey. Um give us your opinions. I do not agree to be bound by them, but definitely do your worst. [music] Um all right. Um and let's go to ads uh for our amazing sponsors.

>> This episode is brought to you by Nexo, the premier digital assets wealth platform. Earn daily interest on your crypto or borrow funds all through one platform trusted by more than 10 million clients. Find out more at nexo.com. Geo restrictions, eligibility, and terms apply. Not listening to Bits and Bips yet? It's our weekly crypto and macro market show with Rahm Alawalia, Austin Campbell, [music] and Chris Perkins. Search Bits and Bips and subscribe. [music] >> All right. Hey everyone, I am here with my co-hosts Taylor Monahan, security expert [music] and Austin Griffith, builder enablement and clank engineer.

>> Slop slop slop uh purveyor [music] um at uh the Ethereum Foundation. Um all right, so it has been kind of a crazy week this week. It seemed like it was a boring week and then like 48 hours ago >> it's a crazy day. Yeah. >> Yeah. Crazy day, right? Like realistically, there was like five days of not much action and then >> action. So, Taye, do you want to walk us through this? We basically >> when I went to bed last night, we had two major internet problems, let's call them. Uh, yes.

>> One with like certificates and then another one with PHP, which is just like hilarious, right? I remember in the early 2000s we used to make fun of these like dinosaur banks and stuff because they're still running on like cobalt and you know we had all of these like fancy new technologies that the internet was running on because it was like you know the web was like 10 years old or whatever so we didn't have time to uh accumulate a bunch of [ __ ] and now 20 years later we look like idiots because we still have like 80% of the websites running on [ __ ] PHP.

Wild. It's wild. >> So So we had two >> This is so scary. >> But then I woke up and there were 10 more things that happened. >> Yeah, it just keeps going. >> Walk us through like is this like maybe before you even like step through the series of events, right? Like I know we know that clankers are responsible for most of this, but >> yeah. Is this one of those things where it's a chain reaction of because of the first issue then people are able to break the next thing and then the next thing or is this just people woke up and they're like oh you can just point clankers at the internet and break everything.

>> I don't know why there's like this deluge happening specifically right now because they do not seem to be related. I think over the coming weeks we will see a series of trickleons for each of these. Meaning that I think we'll see some follow-ups on PHP, we'll see some follow-ups on certificates and stuff, but as of right now, it does actually seem like all these things are >> unrelated. >> Yeah. [laughter] So, I don't know if maybe I mean it might be that the models have gotten better. It might be that what is it?

>> They just haven't. Like in the last few weeks, I'm telling you, the models have not gotten better. If anything, they maybe gotten like slightly worse. >> Yeah. Yeah. It's been a slow grind. You know, there's the >> I mean, it might be >> Yeah, >> it might be that. Um cuz Okay, I don't think either. Well, I guess one of these was found in the last couple weeks. You have to you there's still a human in the loop for all this, right? >> Right. >> Someone has to decide to poke. So, even if the models have not gotten better than the last couple weeks, like I don't know. Maybe it's just the persistence of the humans in the loop who are I don't know, dude. I'm just making [ __ ] up here. [laughter] It does feel like a deluge though. It is very weird. So, we'll start with what

should we start? You want to start with the private key one? >> Yeah, let's start with the private key one because that's the most ridiculous one. >> Ridiculous. Yeah. Okay. So the way that the internet works is that everything is sort of relying on these certificates and these certificates are signed and it's it's all like public private key cryptography. It's the same stuff that like crypto runs on, right? So you have public keys, you have private keys, you have these things called certificates, you have people attesting to things and all of this secures and makes the internet more private. And it's basically run by what we call certificate authorities. It is a literal cabal.

>> Certificate cabal. >> It's a certificate cabal. Most of them are people that you've heard of like Google, Chrome has like their certificates, right? Microsoft, Apple, like Mosilla, like all the OG internet computer people. But it used to be like, correct me if I'm wrong, it used to be like people you had until those companies kind of came in and stepped in and like you know it used to be a bunch of very obscure places like I remember when I first >> Yes. They still they exist. They still exist.

>> They still exist clearly, right? Like >> um but yeah, it's a mashup of people who are in the loop. So like Microsoft is in this loop because they're developing all the software. Certificates are used for like HTTPS but also for like code signing for applications or transport like there's all these different things. There are some organizations that just do certificate stuff trust they call it like trust identity like private key management that kind of stuff like that seems to be all they do. And the specific company that we're talking about here is called E. Oh god, I've never said this word out loud. Emra.

>> Yeah, sure. Whatever. >> It's an Indian company. Apparently, they're an authority. They do a lot of work as India government and governments in that region. Basically, their entire job is to create a very secure private key and then sign these various certificates with those private keys, which then helps secure the internet for everyone around the world. And it turns out that instead of generating the private key in a secure way where the private key was truly random, the private key was just the number >> four.

>> Four. >> Four. I mean, it's great because it's the Binance meme as well, right? >> The Binance meme. >> CZ was so far >> simulation theory. Like, I don't know, man. >> Like, of all of the single digit numbers they could have chosen, they chose four. >> Yeah. So, >> right. There's been >> there's very little >> very little information on how exactly this happened. What we know right now, the private key has been the number four for over a year. It's been signing stuff for since April 2025.

Apparently, they were audited twice in this period of time >> in which >> like came in and made sure that they actually had like HSM and secure signing modules. Clearly like that needs to be reviewed. You know the funny thing is right like you can you can totally imagine how [ __ ] humans are that the people the inspectors right the certificate inspector sounds like a [ __ ] Simpsons joke right like the certificate inspector waltes in and like checks all of this like fancy machinery but then back room they're like just writing

singledigit numbers on a piece of paper to put into the machinery and no one thinks to actually check like who's generating the entropy here. >> It's completely wild. And there's so the one thing that I'll say about this traditional private key world is like they do have audits. They have like not just one-time audits like they have ongoing audits. They also have like the most descriptive sort of policies and procedures that people have to follow. Like they don't just trust that people are creating the private keys to hear.

like no you have to have these hardware like these HSM >> you have to do it in this way you have to validate in this way it has to be done like to this specification on and on and on and yet like the hardest >> finds a way to be [ __ ] it's just how it works >> the hardest thing that I don't the thing about this one that I don't understand is like I actually have a pretty good understanding of like how like cold card for example how they screwed up their entropy Right. It was actually like they were trying really hard to do some really fancy things and then the sort of like stack of things they were trying to do got screwed up, right? And the way that they generated keys that were like

for all intents and purposes looked secure on the surface, they just worked, right? But you had to like work pretty hard to like brute force those keys. It took many many days and like a lot of GPUs to brute force them. In this case, >> how many use does it take to brute force four tries? [laughter] >> Yeah. >> Well, I start with one. >> I mean, you know, it would be so funny if you started at like something like way harder, right? >> I mean, I think that's probably what happened >> and went backwards. Imagine you wasted all that compute going backwards from like 80 trillion and it's four. You'd be a bit annoyed.

>> It's four. The other thing to know, and this is why like I'm just like, how the hell did this happen? So, it wasn't actually a oneoff, right? Where like a rogue key just with the number four. There was actually eight. >> No, there's eight certificates that were all weak. They were all numbers between zero and 256. So, it was like four. I don't know the exact numbers, but it was like, >> oh god, >> it was like 4 28 72 170. It's like a bit shifting error where and I've done this in a smart contract before where like the number I thought was going into this would be a certain size and I accidentally used too few bits and then I lost some you know some of the numbers there. It seems like

that where they they're like it meant to be a number. >> Well, I Okay, so it was the Lugies contract and it needed to be like a a color. So I needed >> six characters for colors and I missed the last two. So it lost the blue channel of the colors and I didn't notice until after I had deployed it. But it was like something like that where you think like there's this elaborate process you have of making this thing and it looks right from the surface because you're not looking at it. It it seems like >> I do wonder like is was no one like did someone know like did one of these four guys like I don't know if you saw the the website it's pretty funny. It's like the guy and his two sons like and one of >> sitting in front of the computers.

>> Yeah. They're all sitting in front of the computers just typing in single digit numbers. Right. But like you do have to wonder like were these guys walking around for a year and a half being like we just have to make sure never say four like don't say the number four they'll be on to us. Or did they have no idea like to your point you know Austin did they have no idea like >> like they thought that they were running around with like an 80digit number and it was a single digit number like I don't know >> it's a good question >> I feel like if you knew >> I mean the other question is that so I think I don't know this is another question that I guess will come out in the coming days right is like the the

these e- mudra guys or whatever have said that it hasn't they have no indication that it's been exploited or whatever >> about that like >> I don't know it seems like a great little thing for the NSA to have in their back pocket in my opinion. >> Yeah. or any nation state and the fact that they work so closely with India like I don't know maybe this is like I don't if you guys know this NSA actually did have like a back door in an old well they didn't succeed in this but they tried really hard to get a back door in an old cryptography specification right because then you basically just like have a back door into the world >> this is better >> it's like the Indian equivalent of that [laughter]

>> someone had to have found this like the fact that it's four if it was like hard, but this would be so this is one of those like like a dictionary or like a rainbow attack or whatever they're called where like >> four is so easy. Like if you if you were to put money in the private key four and put it on Ethereum, it would be gone instantly because not just like someone's checking like someone has already checked, they've generated all these addresses and they're watching them and as soon as someone puts money in, it's swept. Like, how has someone not put the number four into this private key, got the public key out, and just like searched the internet for it?

>> How did this not happen? >> Yeah, >> I don't know. I don't know if it's just because nobody looks at certificates or what, but it is >> bizarre that this took like a year. >> There are also a lot of certificates. I don't know about you, Austin, but I remember the first time I ever had to generate a certificate for a website. I don't even know, this is like mid 2000s or something, right? And I was like, "This can't be real." >> The whole thing is actually quite absurd to be honest. >> I was like, "This can't be a real thing." Like, "This doesn't make any sense." Like, I think if you have an adversarial mindset, you see this scheme and it sounds great on paper, but there's so many humans involved in emails and things that you're just like, "This can't be. What am I Why am I

emailing someone?" And then they email me back the like [laughter] >> before Let's Encrypt it was so it was so convoluted like doing an SSL certificate before Let's Encrypt. With Let's Encrypt it was like so much easier now. You could just like in the olden days. >> In the olden days. Yes. >> No. When you were Yeah. I still had to I had to generate my Yeah. And then we had to like notoriize it for the app signing stuff. It was like >> very human in the loop. Yeah. It's like a loop and you're like how is this how we're doing this right? Like I just remember having this thing where I was like this is crazy, man. Like how does the internet even work if this is the >> Well, and I was always wondering I was like wait so this secures like everything. Okay.

Meanwhile, I'm sitting there and like all my users are being like really basic fished for their private keys, right? Which are private and have money. >> Yeah. >> Right. And I'm like, why aren't there fish just running around grabbing these? Because like this should be really easy. It's so convoluted and it's like this big block of >> I think the answer is because getting them is >> it's like you got to do a couple other things to get the value out of them. >> Sure. But this is the thing that I think maybe to restate it, right? When I went to do this, there are a bunch of people who you can go to and they are like anointed to just do the thing, right?

>> Yeah. Yeah. Yeah. And you upload it to the web UI. >> But that's where I was like, this can't be real. Like how are you just like giving this to a rand who is enforcing this, right? Like this is crazy that these guys and once you understand the implications of e- mudra can sign a certificate and everyone believes it. >> Yeah. >> Everyone in the scheme agrees that everyone else in the scheme is equally valuable. That was the thing that I think was maybe the most crazy to me. I was like one person is compromised in this chain and the whole thing falls apart. Like how is this not already fallen apart? It's crazy.

>> Yeah. So the other realization that you'll come to when you are in crypto and then go to cryptography in that order. So in Ethereum like we cannot like revoke our private keys. It's like I've called it like the original sin, right? It's like you can't >> like you have to move your content to create a new thing. Like you said, Austin, like once you have generated the the like private public key pair for four, >> it just it's that it's that >> money's for key. >> Yeah, don't put money in the fork.

>> You'll never find it. [laughter] But so I went down a huge rabbit hole on revocation meaning like okay so there's other things in this world that you can revoke that are like the core of the internet like say freaking certificates issued by people and companies and entities right and what I found was a bit terrifying because the revocation schemes for this is the most ghetto atrocious process that you've ever heard about and that's what's going on right now is that basically there's an email thread a literal email thread with Google and Mosilla and Apple and this researcher, right? And they're now running around trying to revoke this trusted authority, trying to revoke these certificates and

they can't necessarily do so very easily because each piece of software does so differently and some of them just don't. Your refrigerator probably doesn't have a thing that checks the internet to see if certificates have ever been revoked before. This is the wild part, right? Like browsers, you don't even have to update your browser. Your browser is going to go update this and immediately not allow this to happen. Like they can immediately issue that and it's out of your browser. But like all these longtail IoT devices, all these things that have that certificate in it that don't live talk to the internet all the time. I even opened up an old computer and just like quickly like opened it, turned it on, went to Firefox, went to I

made echara or whatever and like immediately it was compromised. Like my my Firefox was still old. But I bet if I let that sit there for a little bit and then try it again, it's going to be fine. But the long tail like >> they're gonna be finding this in a decade still of just like devices here and there. >> And it's not like you could just like get into the device. Basically, you can see the devices traffic. They're naked. They're not like exposed like the PHP thing that we'll talk about later, but they're basically naked and the traffic that they're sending back and forth is viewable by anyone.

>> Yeah. And luckily on the upside, your refrigerator is probably already compromised by a different vulnerability. So, your life hasn't actually changed at all. So, you don't actually need to freak out. >> Like, you know, TVs and stuff like like I don't know how connected they are. Like, you know, there must be old TVs where someone like put like a [ __ ] video camera. >> Oh, yeah. I'm sure my my >> like surely, right? Like you used to have those like, you know, >> CC TV. Yeah.

>> Yeah. There's a lot of things. And if the traffic is naked, the traffic is Yeah, it's quite naked. It's been a long time since we've had like truly unencrypted traffic just like hanging out on the internet, but we'll see. It'll be interesting to see what the impact is. I'm more interested in seeing how this forces the other certificate authorities to like or just like the people in general, right? There's like there is this cabal of people securing the internet. >> Yeah. >> And like they kind of dropped the ball with this. I don't care about your audits like >> but it's not clear to me and again I didn't spend this much time thinking about this back in the day when I first encountered it. I wasn't like ah someone needs to solve this. I was just like this is [ __ ] [ __ ] how operating

this way. But it's not clear that there is a better way. Like short of Ethereum, I don't know, maybe Ethereum is the solution here, but it's not clear to me that >> you have to trust. There's like this inherent trust model of the issuers, >> right? If Ethereum were generating these certificates and it was untrusted then m I don't know like maybe like surely someone it's it would be super weird if someone hadn't already proposed. I'm sure there's a Vitalic blog somewhere where he's like we should replace CAS with an Ethereum at a stationation using ZK proofs or something like that. Sure.

I'm sure that >> you had to make it so complicated. It could just be like the public key is in a smart contract and if you have to revoke it like there's like some committee or something, but then now I guess it's people again. Maybe it is attestations. If it gets enough attestations, negative or positive, then it becomes >> Yeah, >> I think you do it that way. >> Yeah. Well, with attestations too, you can also like you can kind of skew more decentralized or more like P2P. You can also like have some authorities that are more authoritative. Sorry. I think this is the thing that's a bit weird is like the scheme feels like it was invented by communists, right? Which like it probably kind of >> 100% was >> a little bit, right? Like there's like a >> OG the most OG communist on earth like

>> like they're like, "Oh, we can trust each other. It'll be fine. We all are really smart." Right. And then >> not necessarily, not necessarily. They were like, "We can't necessarily trust each other, but if we all sign this thing, the trust will build because it's transitive or something." >> Mike Lanker Mike Lanker says it's like a 150 of 150 multi-IG. It's a one of 150 multi-ig. There's 150 signers and one person has to sign. >> Yeah, it's crazy. >> And they just kind of keep adding more layers. Okay, so that's number one.

>> So, okay. So, before we go to the PHP, >> Yeah. Like I I just want to I want to call this out, right? Because we say this like every [ __ ] week, but like the world has operated on this stupid model for however long, right? And you didn't get exploit, you know, how did no one try this? How did no one exploit it? Whatever maybe like but it even if there were a few people that were exploiting this thing, right? They didn't blow up into a huge like global catastrophe, right? Because I guess if you worked this out, you're like, "Fuck, I'm not telling anyone, right?" Like, "I'm just going to, you know, inspect this traffic." It takes someone actually exploiting it and someone going, "Wait a second, that CA was explo like reverse

engineering like where the compromise came from to even realize." So, I don't know what the like disclosure method was here, but it just feels like there are so many very tenuous stupid schemes that we've invented that were predicated solely on people are lazy and we now have these aliens that are not lazy and they'll just run all day trying every thing and all of these things are falling apart. like all the these things are predicated like no one's going to sit there and type all the numbers into the machine and you know for every machine for every number for every combination for every variant of something on the internet and it's

like no there's a guy now who will do that all day long and it'll take him like a week and then he's done and he like yeah >> I don't know it just feels like >> our schemes are unraveling in front of our eyes and they were all based on like we're lazy [ __ ] And now like we've got people that are not as lazy as us. I don't know. >> I mean that's the thing is like I was thinking about it and I was like I actually don't know. I assume I have I assume in 2018 when we were checking like doing I was doing like my very first rainbow table to see. So I was curious to see if like people were using how prevalent these weak keys were on Ethereum.

I want to say I the number four, >> but I actually don't know because I might have >> I might have like done like a minimum like six. >> Yeah. >> Right. Like it's so bad. It's like so bad that like maybe maybe I didn't. >> After this, we're going to pick a number one to 256 and we're going to put 10 bucks. >> It'll be gone instantly. Instantly. I'll do it right. It'll be gone instantly. >> So, okay. So that's that's the certificate stuff. That's number one of like the world is just breaking. Oops.

Number two is >> PHP to shell which is >> okay. So PHP runs like 70% of the web or something like websites are just PHP. It just they are they always have been WordPress which is still massive. This also feels weird like how why are we not rewriting our websites in modern >> PHP feels like the cobalt of it now. Yeah, >> it is. I think that was a good analogy. >> And it's been a while that if you wrote PHP like people make like very hard fun of you >> like for years like for over a decade at this point.

>> Over a decade. Yeah. So I guess it's mostly because there's just these super core things that sort of underpin the internet like admin dashboards, government sites, banking sites, WordPress on the whole like and it's like not necessarily even if behind the admin is fancy new tech that original core admin login screen is still running on PHP or something >> because it's just ubiquitous, right? It's everywhere >> and I guarantee the user experience is terrible. all those things that you just listed. I'm just imagining how bad of a time I'm gonna have like clicking through whatever that crap is.

>> So, the other thing to know is PHP is a programming language that has existed for like 40 plus years or something. Very massively popular in like the 2000s. >> Yeah. >> 2010s. It was really It was good in like the early 2000s like you know uh >> I'm trying to remember there was an e-commerce platform that was like PHP that I had to work with. >> Oh everything. Yeah. WordPress. Well, so I knew WordPress Drupal the Woo Commerce. I mean if you were writing anything >> Woo Commerce. Woocommerce. That was it.

Yeah. Yeah. >> If you were writing anything in this era it was PHP. I wrote so much PHP. I don't know how to write PHP but I wrote so much PHP like email forms, e-commerce websites, anything that you needed to like do anything it was PHP. So basically some researchers I think we now know the researchers are from Khif wiz open AI open AI patch the world initiative and then I guess maybe even the PHP guys they basically just went deep and hard and were like we are going to find some like super critical [ __ ] in PHP we're going to go through the

history we're going to ask the right questions we are going to we are going to do this and they did. They found not one but two RC's. So this means that anyone in the world can remotely be able to execute code on your server if you're running >> different than your traffic is just naked. They can get in and do what they want. Much different >> remotely remotely. And that's a huge difference. So a lot of times when we talk about vulnerabilities and things sound really bad, it's like either there's two scoping things. One is that you either have to have physical access to the device and those are scary but they do require physical access or they require first to get an RC and then once

they're or first get in authenticated or something and then once they're in they can rce this one's a bit different like basically all those admin panels that we're talking about the WordPress panels and stuff that are just like exposed on the web if they're not patched anyone can basically just go hit that hit it with the with the exploit and then they'll be able to like run code on that server remotely. Meaning that like them sitting in their mom's basement and now have access to that server and then once they're on the server obviously they can do all sorts of things depending on what the server does. So best case is like man it's fine. Don't worry about it.

There's nothing like a >> if it's a old WordPress site we'll see them do like fishing campaigns. We'll see them use them as like C2s. >> There's got to be there's got to be some like PHP sites that have been running for like a decade and no one knows who's paying for it and it's just like hanging out there doing a thing and >> Yeah. >> Oh, 100%. Yeah. WordPress has always been I don't know I guess like relatively insecure. So we see it with WordPress sites, right? There'll be just like these robot masses of old Pilates instructor blogs that [laughter] are like floating around like doing evil things suddenly like [laughter]

you're like why is that the C2 or like it'll be like SEO spam or it'll be like yeah it'll be like a controller for some fishing campaign or whatever. >> This all the time. If you get a if you get an X like, hey, we are going to delete your post in the next 48 hours if you don't respond to our thing, check those domains. They're always like some domain that's been compromised. And you just like that that whoever is running the server that controls that domain, they're always like some random old site that that no one used. >> Yeah, it's the old Pilates blog, dude.

Like [laughter] it's like >> I can imagine it stock image on that already. like I can say >> and then behind you look behind the scenes it's running like three crypto fishing campaigns at a time and mining Monero. >> So that's sort of like the best case though. Worst case is like and why you see like the governments are coming out. I think like the Japanese Ministry of Cyber Security came out this morning was like please patch your PHP guys. I swear to [ __ ] not. It's because like there's this long tale of services that actually matter if they're compromised.

And so if the system admins and the DevOps guys do not go in and really take this seriously right now, it's going to be worse than just like >> But the question is right like this was not something that was like discovered by a random guy and like posted on the internet or like surface like this is like open AI going in like why? >> Yeah. >> Why? Like why is this a is the catastrophe that there's no way to get in touch with all the people that are running this? So they had to like kind of publicly announce thing like what like it feels a bit strange the whole >> Oh the announcement for the patch.

>> Yeah. Like >> Okay. So I was thinking about this last night. I think there's a couple things going on. PHP lives at so many different layers of the stack that they have to slowly make the circle of people who know about know the details of the vulnerability bigger and bigger and bigger >> in order to realistically patch it. It's not just patching >> PHP. You have to >> you can't just be like PHP 18.2 >> upgrade guys like yeah okay >> because it's like you have to update like your Linux you have to update like WordPress has to update. There's like all these different like web host.

Remember how we talked about the admin panels? >> Yeah. >> So I don't know any shared web hosting thing that has a PHP admin. >> There's going to be like so I guarantee you there are certificate authority [ __ ] issuers that are running on >> Oh no. >> I'm telling you there are like 100% there are >> ideally the PHP that's running on these shared servers the end users like the bloggers don't have to think about this. The host just does it. But then you do also have companies, enterprises, governments who are running their own infrastructure like on prem. They have to update their PHP or secure their parameter or whatever. And so it's like there's only so much that you can do at the core and you have to slowly make it

bigger and bigger and bigger. Eventually it leaks and then that's what happened yesterday was like the leak started happening and then it was like race is on. Let's go. Right? Because it is going to be public at some point. It's just a matter of when. And the other interesting thing about this one is they brought Cloudflare in. Cloudflare also runs a huge amount of the internet. In this case, it is actually good because Cloudflare has I don't even know what it stands for. The WF, the W. Okay, so basically it's like how they manage traffic for you so that you don't go under and it also stabilizes everything.

It's really great. If you have a website run on Cloudflare, you just like get all these automated rules, >> right? So like the bots don't attack you, it's great. >> In this case, they've been writing custom rules specifically to prevent this attack from getting to the PHP admin screens, >> right? So they're like protecting people as people are updating the roll out. >> They're like this first initial shield >> and saying like no, no, no, you can't do that. Like you can't touch any site on Cloudflare, which is super super interesting. Could we just like get a couple of clankers to like go like like remotely exploit the thing, update the server, and then like close the door on the way out? Like surely that's the

solution. >> I saw a tweet exactly like this. Maybe they didn't run all this stuff. Like why isn't there like a white hat clanker just going to work right now? Yeah, because that you can and it there have been instances in the past with big rce where people like these white hats have been going they'll go in and patch your >> wow >> VPN or whatever. I don't >> probably I'm assuming >> I mean it's I guess because there's down I'm guessing there's downsides, right? So like let's say you update the PHP >> and it breaks and else doing something nefarious and they blame you.

>> I mean if someone needs that web app, hopefully they wake up and go, "Oh, I should probably check on this thing, right?" Like if there's users of whatever that thing is. >> This is going to be the next Open AI tweet. Like we detected that our robots escaped the sandbox and they've patched a thousand computers across the the web. But it's like I think because it's I mean I've heard of it happening in other instances with other like big bad like rce. I think for this one it's because you don't the fear is that you don't actually know what that PHP is powering and if you update it you might break like the web app or like the thing that's I don't know powering ATMs or the banks or like whatever. And so it's like

you patch it and then the none of the bank tellers can log in or something. >> So we're going to go to ads now because this is uh an endless um an endless conversation of the world uh evaporating. But before we do, Austin, did the money get stolen? >> Oh, instantly. [laughter] Okay, so first of all, first of all, there's not a number less than 256 that doesn't already have a nons. And you can see clearly that it's already exploitable. So if you go through 256, >> yes, you could just go look at them and see that they're already exploited. They probably have like a 7702 drainer on them or something.

>> Uh so my bot picked 6969 because he's a funny guy because it doesn't have [laughter] a noun. I put a dollar in there. >> Yes, he's 12. My bot is 12. As soon as the dollar landed, there were three transactions in the me pending trying to steal it. So, not only did it get stolen, but there was a race to steal it. And 6969 is like, you know, pretty small, but not >> Yeah. >> Do we have a do you have a sense of like what's the like event horizon for this? Like in terms of >> like how many digits you need before they start >> question >> four digits like is it like 10?

>> I would say between eight and 12. Yeah. Same thing with passwords being brute forceable, right? Or maybe eight and 16. This is a good question for the the robot. I would say probably today at least 16, but that's just going to slow it down. Probably well probably 12. >> I would say 12 14 16 is like where you're getting into like it would take a minute. >> All right, we're going to test. >> It's not secure. >> Next week we're going to put we're going to put a dollar into like a a range of numbers and see where where's the break point for auto auto theft. Okay. All right. Let's go to ads quickly.

What if your crypto could do more than just sit in your wallet? Nexo is a digital assets wealth platform where you can generate daily interest on your crypto or borrow funds against your assets. Today, Nexo serves more than 10 million clients. Find out more at nexo.com. If you like this show, there's another one from our network you should be listening to. Bits and Bips is our weekly [music] market show. On Mondays, Rahm Alawalia, Austin Campbell, and Chris Perkins chat about where crypto and macro collide. It's sharp, it's fast, and it has its own channel. Search Bits plus sign BIPS [music] and subscribe.

All right, let's talk some crypto [music] stuff. We had a very interesting launch last week, Paper Trade. I think there's been rumors and stuff. People have been talking about it for a little while. They basically built a bucket shop, which is kind of funny to me, right? Because when we first pivoted from Haven, the stable coin, to synthetics, all of these OG traders that we were talking to were like, "Ah, this is just a bucket shop." And it was like, "Yeah, it's actually fine. It doesn't matter because we have smart contracts." So, it's like a bucket shop that runs on smart contracts. the idea being like back in the day like in the early turn of >> I'm definitely googling bucket shop right bucket right so like in the in the so basically here's where this term came

from right and there's a really good book that's worth reading if you're like in crypto it's like memoirs of a trader or something like that I can't remember the exact title and it's basically this guy who makes and loses his fortune in these bucket shops in like the turn of last century right so we're talking like 1912 or whatever, right? And it's hilarious because we literally have this. It's just that we now have fancier technology, right? And they would have a ticker, the Oracle, they would print out prices and then they'd have a board where the prices would change in the room and you would go in and you would take your slip of paper and you'd write your thing down and pay for the bet and throw it in the bucket and you were betting against the

house basically, right? So it was like just pure gambling but you know stock investing right and now we have RWAS on hybrid liquid and 50x leverage. So we've come full circle but >> 50 is not enough. >> 50 is not enough. >> No [laughter] >> leverage is too damn low. Blur and Jez OGs in the space said what if we did a 1000x leverage? Let's do this thing. But obviously these guys have been around for a long time. And so they also cooked up like a yield farming style scheme, right? And you know, I'll just say like I'm here for this all day, right? Like we should definitely bring back crazy yield farming high APY schemes. I do think that this is going to make a

comeback because it's so easy now to build stuff that DeFi summer was a weird period where almost everyone who was in the space had the ability to do the thing right had the ability to launch a fork of a smart contract and you saw like Yams v1 v2 v3 [clears throat] harvest finance everyone could deploy a smart contract everyone knew vaguely enough how smart contracts work it was a small enough group of people and then a bunch of new people came in and the vast majority of people couldn't have launched a protocol and so you kind of had this shift in the dynamics. I think we'll come back to this. I think we will come back to this. This is kind of an indication that this bull market. I expect that there will be a lot more

crazy Ponzi yield farming schemes because you can literally say to a clanker like hey I want to build a weird yield farming scheme. Here's my model is the trapezoid. and give it a couple of prompts and it'll come back to you and be like, "Oh yes, trapezoid finance. Here you go." Right? It'll cook the whole thing for you. Right now, as someone who has run an onchain bucket shop for, it's harder than it looks. What used to happen in the synthetics days, especially when we went from like Ethereum was the only chain to like there were a bunch of other chains that people would do stuff is people would have the bright idea of forking synthetics and running it. And they did this for like Ave and Unis swap and you know that's how we got sushi swap right

forking unis swap especially like uni2 not super dangerous pretty easy to manage protocol like it's you know you just drop it in there and not that much can go wrong things like synthetics where there were like 80 contracts the maker is the same right like there's like 120 contracts no one knows how it works >> and oracles like b does not have oracles >> oracles and like the functions are called bleeps and bloops and flips and floops and >> it was inscrutable what was going on, right? And if you turned up to that and you're like, "Oh, I could fork a contract. Let's fork maker." Right? You would probably get wrecked. And so, a lot of people did. But, you know, the challenge is that when you have a system that has these kind of dynamic inputs to

it that is highly levered, then it's very easy for people to manipulate the oracle whatever the input is, right? You could have, and this is the case for like any Oracle, right? And we've seen funny things like this before, like Poly Market. You guys probably remember the guy that went and got a haird dryer and put the haird dryer on the temperature sensor at the Paris airport to heat it up so that it was above 30°, which paid out like, you know, 20 to one or whatever because no one's going and checking the temperature in Paris. They have like one sensor that is the oracle that says like what the world is, right?

You have to have these proxies and so people could go and find the proxy, right? Find the thing that is like the exploit vector and then manipulate that. Now, in the case of thousandx leverage, it doesn't take much manipulation because of reflexivity of the system to do bad things. And so anyway, they launched paper trade. You know, again, these guys have been around for a long time, but it's almost impossible to simulate what will happen in a complex dynamic system like this, right? Like you can sit there and you can model it and you can think about it. You know, there were so many people that were like synthetics fundamentally cannot even work. Like it will collapse under its own weight like instantly if you release

it, right? Which it didn't. It took like eight years to collapse under its own weight. Jokes's on you. So the issue is that they created this like complex system and of course people try and manipulate it and now the market for manipulation is so much more efficient than it used to be, right? And so instantly they were like fighting this battle of like how to set the inputs to the system to prevent people from exploiting it. But one of the biggest issues is that they the incentive scheme is based on paper. This pseudo token, right, that you earn when you do the thing. The same way that like you got yams or you got, you know, sushi tokens for doing sushi swap things and you know, whatever, right? Like there has to

be conclusion of DeFi summer I think is that like if you have the ability to print a endogenous incentive thing inside of a system you can bootstrap that system really quickly in a really crazy way and you know fun things happen right and so you need paper to incentivize the system. The problem is that the incentive structure is somewhat recursive as well, right? Where the incentives can become an attack vector. And so they basically said, actually guys, the $138 million that was deposited. And the funniest part about this is you got paid for losing, which was like I don't know, as a per trader, I thought

that was quite quite >> psychology was very good there. Like after when you first of all like a thousandx leverage is already fun. >> And then when you put in $100 and it's gone, but then you're like and I got some paper and this paper is everything everybody's talking about like oh like I could I could >> and that was the only way the only way to get it was losing right and so we kind of had these two outcomes. You could trade and lose and get paper which maybe you wanted right or you could accidentally win and in that case you won right and so anyway there's a whole bunch of dynamics here but they've spent the last week the funniest part to me of all of this and I was making fun of blur in one of the channels I'm in with him

because you know everyone used to always say time locks why don't we do time locks right like >> like on multiigs for big >> yeah multiig time locks right like it makes it I'm sure Tay you would say like, you know, >> it's 24 hours. >> Yeah, whatever. So, they did a 7-day time lock. But the funniest part of this is time locks are time locks, man. Like, if you [ __ ] something up, it's seven days of being [ __ ] up. Like, we literally saw the reason why I never put a time lock on any cuz I was there when the Dow hack was happening and we're sitting there for 28 [ __ ] days going, we can't do anything. This is really annoying. Wouldn't it be great if we didn't have this [ __ ] time lock, but you can't even take the time lock off

because it's this like >> on purpose. >> It's on purpose, right? Like the time lock is time locked. If you make the mistake of putting a time lock in and realize your mistake, you have a 30-day time lock and 2 days in you go, "Oo, we really should have not had a time lock." Guess what? You have 28 days of pain that you're going to now live through. So, they put a time lock on. So, they can't even change the system, but they now I guess it's been seven days, so they're able to change it. and they're like, "Ah, maybe we won't make paper tradeable." And as you can imagine, everyone was like, "This is a hard rug scam. You know, these guys scammed me."

>> And for what it's worth, you do make money by holding the paper. It's not just like you're you earn paper. You feel like eventually one day you could sell this, but as you're holding it, you're making like, you know, 5 cents or something. >> Yeah. You're you're like you're making fees. You're staking, you know. So, there's multiple layers to this game, right? Which is why I say I'm so here for like DeFi summer renaissance or whatever, right? Like, we're going to see. I'm so convinced this is going to happen. It'll only take a couple things that go horribly right and wrong at the same time for people to be like, "Wait, I can just build this crazy [ __ ] >> that billion." Yeah.

>> Yeah. Yeah. And so anyway, so now we're in this situation where they're trying to figure out can they make it a token because the token is an exploit vector. If they don't, then you have this other problem of like people only want tokens and so if there's no token then will there be any volume and so staking won't even matter. It's all amazing. I love all every part of it is amazing. >> You're here for the drama >> conclusion. It's not even drama. Like I just love the incentive. Like mechanism design is my favorite thing. >> Mechanism design is my literal favorite thing. And the more complex the mechanism, the better it is. That's it.

The end. >> So >> has anyone I was just listening to you talk about all this. Has anyone gone back through history or had the Clankers go back through history and write a book on the mechanism design lessons that we hardw >> Cammy's book? Okay. >> Yeah, she's writing a book. >> Okay. cuz like I feel like there's so much juice here, but most of it was written off at the time as like >> raw drama or like >> those silly food tokens that summer in the middle of COVID or whatever. But if you actually think about it, like we learned a lot about like there's some really deep very deep lessons about mechanism design, about incentives, about governance, about coordination

that are like hidden under this facade of just like complete degen degeneracy, right? I mean, Sushi Uni is such a like >> yes, >> you know, object lesson in like and you know >> like if you change the names of the [ __ ] and put it in like an academic paper format, >> like scientists will go bonkers for this. >> Yeah. >> It's like the >> I think the most interesting thing to me of all of this stuff is there's we have two intuitions that are both wrong. One is that our intuitions are intuitive and good. That's the funniest thing. Like most people like, "Oh, I know things. My intuition is probably sound here,

right?" And then the second one is that our intuitions are so wrong. Like if we didn't trust our intuitions, that wouldn't be funny. But the fact that our intuitions are horribly wrong and yet our other intuition is that our intuitions are actually quite smart and we're very clever is just hilarious. And so you see people when Sushi came out there were so many smart people like this is not a thing. This won't work. Like the midcurve the midwig guy like you know on the timeline that's like this will never work. And then all of a sudden it's like it starts working and people like oh [ __ ] like >> Yeah. Yeah. No. We talked about this last week the Vitali telling me that the Nosis ICO was never gonna was completely

illogical that it would ever do what ex what it did. And I was like, I don't know. Like, I'm literally quite stupid. But just based on the volume of support tickets and the hype and the people pre-sup support ticketing for the Nosis ICO, I think it's going to immediately sell out. I'm pretty sure that's the only time in my life I've been right and Vitalic has been wrong for the record. >> But again, even even Vitalic intuition is like, no, no, no. My intuition is that, you know, people are rational and they're not going to do this dumb thing.

It's like, nope. And then sometimes you go, my intuition is people are irrational and they definitely will do this dumb thing and then they don't do it. >> And they don't do it. Yeah. I've also been wrong there. That's why you should always anti-copy trade me. [laughter] >> Okay. So, >> so yeah. Anyway, I cannot tell you how here for this I am. Like every part of this, I love it. And the fact that they're able to get a,000x leverage and it's kind of sustainable, right, is pretty amazing. And I've seen a few things. When I was in Singapore, there was a team that's working on this like 10,000 APY scheme where like instead of trading, you're actually earning APY by like doing like ultra concentrated

liquidity, which I think is going to be super interesting. Like you've got like a concentrated liquidity band that's like a tenth of a tick wide, right? and like >> one trade provide all the LP for like one trade. >> Literally that. Yeah. So, yeah, I'm here for all of this. I'm excited about it. All right, let's go to our next story. Deepseek. And so, Deep Seek is really weird, right? So, they released a new model. They've done this now, I think, four times. They're doing the opposite of what all the other labs are where like every new model gets some fancy name. Saul, Terra, Luna, Astra, [ __ ] you know, whatever. Right? These guys had two models,

4.1 Pro and 4.1 Flash. And Flash was supposed to be the fast, dumb one. They did say four to 4.1. They did have like a version bump, right? But this is like a month ago. Then they deprecated Pro and just moved to like 4.1 Flash. That was like their, you know, whatever top guy. And then they just keep updating it without changing the number and they just like push they're just like the new one's here and they call them by like the date that it was released. It's like a super weird thing.

>> Oh my god. This is like the most nerdy nerd stuff. >> Seems like the worst marketing >> where you do like >> Yeah. the beta 0.0 but then it has a dash and then it has like the date. >> Literally the model release thing is such a good way to market though. Like everybody's waiting for Opus 56 now and 57 and 58. like everybody's waiting for it. It's such a good marketing mechanism and then they don't do it. >> By the way, it always makes me laugh when the nerds figure out like the the nerds in the marketing converges. Yeah.

>> Right. Like ERC20 was another one when everyone started calling like the ERC20s, the ERC20s, the ERC20. I was like >> this should never have worked, guys. >> Yeah. >> Why does why do all the normies know what an ERC20 is? Like it's a terrible name, right? But then to this day it is like a core brand. >> It's a brand even though it's literally the nerds being like we make names that don't mean anything. >> My favorite thing is Tron's token standard is TRC20 >> which makes zero sense. It wasn't like >> a lot of these Yeah. Actually improvement >> request for comment 20 on the Tron chain like the token standard right. No.

>> Yeah. Yeah. >> Yeah. >> Yeah. No, it's funny. And I feel like it's the same here with the model. The models have figured out how to make >> literal version release numbers >> like the literal model update numbers. Super trendy, but everyone's on board with it. >> I know. It's weird. It's weird that like like a minor version bump like >> solves, >> but people know what it means. Like normies. >> Yeah. normies know what it means and like are in >> when something is important, you can kind of do anything and it will take on a life of its own, right? Anyways, Deepseek does two weird things. One, they don't have a subsidized Max plan style thing. It's purely APIdriven. I was using Pro and in a week I burned through about $500 of API credits when

it first came out because it was really, really good. It was a very good orchestrator and it's the only orchestrator model for red team exercises that you could really use. Like GLM is like a little too autistic. This guy is quite good at coordinating other agents. And so all of my red team exercises I run on DeepSeek. And so 4.1 Pro I burn through like 500 bucks in a week. And I was like this is kind of expensive. Like it's not even cheap compared to like Sonnet or something like that. And then they were like ah just kidding. the 4.1 Flash is out now and it became like 10 times cheaper and so then it went from like you know 500 bucks to 50 bucks and then they keep releasing these models and they keep lowering the price and the other day I

was looking at it and I like I used $3 in a month. I think I have like a hundred bucks in my Deepseek API key and it was at like 97 and I was like what am I doing here? Like this is going to last forever. So, they keep releasing better and better models. And like this model is like [ __ ] insane, man. It's so good. It's one of the smartest models, but also like one of the cheapest models, which is pretty wild. >> And it's a good orchestrator >> and it's open open weights. Like, >> do you even need a subsidized model?

Like, is that good enough? >> Yeah. They could very easily just be like, "Hey, it's a hundred bucks a month, right?" Like you could switch off the API thing, but they don't. But the same weird reason why they keep like not releasing new versions, but like un like you're changing the version underneath. Anyway, I think the other thing is that DHS is like, "Ah, no, you can't have this anymore. It's banned. No one no one in the government is allowed to use it anymore." They basically just don't want it anywhere close to anything. >> Like BLM and Kimmy and stuff is fine.

>> No, I don't. That's the thing. I don't I don't think that any of them are fine and I don't think they ever have been. I don't exactly know what this ban is. Like if you work for the government, spoiler guys, if you work for the government, what you can have on in, you know, on your devices and stuff is very locked down. You generally cannot have Chinese software on your computer. [laughter] Well, I'm really sure what like what exactly they're banning. I don't know. Maybe I should look at it more. But yeah, they're basically worried as they should be, right? that if a whole bunch of US government employees or contractors or whatever are using this software, whether that's like

the models, whether that's putting in sensitive data in them, whether that's them just being on the machines, like bad things are going to happen because as we talked about a few weeks back, right, the Chinese government is putting stuff in the Chinese models, which is then actually getting routed to the US models. >> Yeah. as part of the distillation attacks and then the US government and the US companies are seeing the prompts and the data that the Chinese government is putting in them. Right? And so the US's solution to this is like we don't do that, we don't touch, >> right? I feel like another piece of irony here is like if you are working for the government and you are using AI, you're actually better off using you can

run deepseeek locally and you can't run Opus locally, right? >> You're better off running deepseeek on your local I mean you have to have a hell of a machine but you can run these things locally. So the government should be using that. They should have their own and I'm sure they do, but why >> I >> Yeah, they should have like data center. Wait till they start nationalizing the data centers. Then they'll have all kinds of cool stuff. >> And that's what I think is that was sort of like also the undercurrents of when they were banning anthropic and stuff and I was like this is going to end badly because the government actually needs our models. Like that's >> they don't need, by the way, they don't

need our models in the sense that like they need to be able to use Claude. Like no, no, they need a special relationship with Anthropic to have Claude in a locked down mode in a environment in a whatever for like super sensitive government stuff, right? And then Anthropic was like, hell no because you're going to go use it to kill people and we're not okay with that, right? And then on and on and on. That's sort of where we're at. And then yeah so it's quite interesting like the dynamic here just because again we're still seeing the government try to get their feet under them right they're not happy with how the US companies are operating but then also the fallout is like

you also don't want your government employees running these models. The interesting thing here, and I don't I'm not suggesting that this is like deepseek strategy, but you know, when you have a deepsee, like I could give you guys my DeepSeek API key right now, right? I don't even care. Like, I've got too much money on there, right? And you could sit there and use it all day and all of your [ __ ] that you know, the Ethereum Foundation, whatever they're asking you to do, I don't know, is going to go to China. Right now, maybe for the EF that's not a problem, right? But if you were like a government employee and I was like, "Oh, hey, I've got this cool new thing. Here's an API key." It's not like you're going to a Chinese website and signing up for a thing and putting

your credit card in, >> someone just shares an API key with you. Like maybe this is the the thing that's like, you know, like you go to the put it this way, you go to the Quen [ __ ] website, you are not confused about the fact that you're giving your data to China. It is the most child [laughter] coded website you've ever seen. Like Alib, it's so funny. You've got Alibaba and then you've got Amazon and they're both like so old now that you go and try and use their sites and you're like what is this? Like you know the like AWS IM there's like 18 layers of [clears throat] like complexity. It's just like layers and layers and layers of of like trying to go and sign up for

a Quinn account. I got emails from two different places and I was like did I accidentally sign up for two different account different platforms Alibaba cloud plus Quen cloud plus this and it's not different API the whole thing is insane right but you will not be confused if you sign up for Quen you have to put your credit card in you have to create an account it's in Chinese when you turn up you got to switch it to English there's no confusion if I hand you a Deepseek API key and say hey check out this cool new model you will have no idea like there's no way for you to know >> that that's so you know it is maybe in that way kind of smart that they're not making people sign up for accounts >> and the psychology you get lulled into

you give the thing a task and it does a good job and you give it a harder task and a harder task and pretty soon it's doing all of the things for you and pretty soon it has all of your information like going back to like the social network days where we were giving all of our information to other centralized folks. People are doing it and they're going to do it more and more and more. Agreed. Agreed. >> Yeah. And you and it's it is a bit of a slow roll. But you and ask it like I have my little personal models that don't do much, but like I do like to ask. I'm like, "What do you know about me, sir?" And they'll go back through. Remember, they'll go back through.

>> Yeah. >> And they'll Yeah. It's like a It kind of feels like astrology, but it's like it's actually based on everything you've ever asked it or >> But it's accurate. Yeah. Astrology, but accurate. [laughter] >> Oh, you're talking about your history with them. like after you've talked with them a whole bunch. I thought you were saying you ask it what it knows about you like a vanilla model and you find out if you're in the weight. So I do this with select computer whenever I have a guest it does research on them but the first thing it does is take a vanilla LLM that doesn't know anything and ask them about them to see if they're in the weights and sometimes some of my guests are in the weights and that's like a different thing. It's like having your own Wikipedia >> but >> yeah you're talking about it it knows

way too much right? Oh, and it'll it'll the [ __ ] that infers >> cross reference other things to hear. I'm like, you know, like should I take this vitamin? And it's like that thing you told me like 60 days ago about that other thing. That's why you should >> That's what I mean. Yeah. >> Yeah. But it'll assess like and the things that it like recalls to you're like what? Where did it come? Like that's >> I don't even remember. >> Yeah. >> And it's like it assessed it from a screenshot that I uploaded even though I was asking about the second half of the screenshot. You're like, "Shit, bro. >> You got to crop c drop those screenshots."

>> But you get lazy, I think. Okay, so one thing I've noticed, tell me if you guys have experienced this too. My personal discipline with like prompting and asking questions and especially for like the general talky questions has gone so far into the pits of hell. >> Yeah. >> Like I don't crop the screenshots. I don't bother with punctuations the typos. >> I'm like I'm literally the keys. I'm like every other word is red underlined as I'm typing if I'm even typing. Usually I'm just yelling at >> Yeah. And it's like a completely it's a garbled sentence but it's like it figures it out anyway. So it doesn't matter.

>> Yeah. But then sometimes it crosses over into my real life and I'm like [laughter] >> with your kids you have to give very explicit instructions and then check in and then check in again if it's like Sonic 4.5. Are you really sure? Like I have to ask you the third time. Are you sure? You're absolutely right to double check on that. [laughter] >> Yeah. >> All right, let's go. Let's go to the next story. Anthropic. Dude, anthropic gives me such SPF vibes. Like, and I know they're like the same guy, but like it's still >> like there's something about just the way that they go about everything in and I think like the the like through line is just being completely convinced that

you are the only one that should be allowed. >> I hate it. I hate it so much. >> Like you're the smartest one. Everyone else is stupid except you. And so therefore, it's better for you to do bad things than for someone to do anything. And so they're like, "Hey, let's go and do a bill. Let's go to Washington, create our own bill." Like, we literally saw this the [ __ ] SBF going to Washington trying to be like, "Hey, let's ban DeFi." Like, >> it's so bad, man. It's so bad. And like, you just know that they're like sitting there going like, "This is good. This is good." good that we are trying to take

control of this thing. No one else can be trusted. It would be better if we do it. >> Definitely will not >> definitely know like centralization is is bad. We know that. But so I think Wall Street Journal got hold of the draft plus the IPO and they had a big story about it and the numbers are crazy, man. Like the numbers are crazy. The revenue is crazy, but like they also and some of this is like accounting nonsense, so I think we should be careful about about like drawing too many conclusions, but like they made like $20 billion in the first half of the year.

>> That's like a lot of money. >> It's a lot It's a lot of money. like you know it's it's I know in the last decade like inflation's really gotten out of hand and we're like kind of a bit annured to like insane numbers companies didn't be worth a trillion dollars like it's a bit weird right and now there's like >> 20 billion >> yeah like ah 20 billion like it's good like so anyway so but they also they lost a bunch of money some of it it's accounting stuff but like clearly the subsidization of this stuff and you We've seen this with OpenAI where they have started to like pull the reins a little bit on subsidies, but they're kind of keeping ahead of it.

>> Like at the moment, no one's using OpenAI, just to be clear, because Opus 5.5 is so much better than every model that like Opus 5.5 on low is better than [ __ ] Astro or whatever. So, like I I only use Saul to like go and grind through some like reviews and stuff, but like I barely use Astra. If I accidentally use Astra, I'm like, "Fuck this guy." Like, he's so dumb. And I used to love that. >> Double check. It double checks. Great, man. Like, so Opus 5.5 plans, Astra double checks. Astra always finds some stuff and Opus fixes it. And then Opus goes and builds and then Astra double checks and Astra always finds stuff and he So, I feel like I I need both of them. I pair them well, but I don't have to talk to ask.

>> Just to be clear, you never talk to it. >> I hit like one button in my harness and it >> but if you find yourself and this has happened to me a few times where I'm like like I need to jump into this guy and see what he's doing and I start talking to him. I'm like, man, get this [ __ ] guy away from So, so, so at the moment, OpenAI has taken this and this is very smart. they've taken this opportunity to just dial back the subsidization of like how much inference you're getting and they're going to come out with a good model whether it's like you know Astra 6.5 or something like that and it's going to be better than Opus 5.5 and everyone's going to go back to it and they're going to have forgotten how much capacity they were getting you know and

and you know you can see you can see they're trying to like reel in the the cash burn a little bit but also the models are getting so much better that for everyday activities like deepseek like it's 100 B like 100 bucks will last you for the rest of time because it just keeps getting cheaper and cheaper and smarter and and so there is this weird thing where like the subsidies were so large they were losing so much money but they do seem to almost be on a path to like profitability and if these guys suddenly become profitable like they will be worth $10 trillion. It's crazy.

>> The subsidies published anywhere like I can guess. >> They have to infer it from looking at their leaked numbers, right? And also the S1 and they started filing and so they're looking at what their reported numbers are, but you know there's a lot of [ __ ] you can get away with even with audited financials of how you present things. So it's not 100% clear how much money they're losing and why. You can bundle costs in and oneoffs and opex, capex, whatever. But they're definitely losing money for sure. But like if they suddenly weren't losing money because they have a model that's like so much cheaper to run, they're worth like infinite money. Like the only thing that's constraining them from being worth infinity right now in my mind is that they are not making money.

They're losing money. Like the instant it flips and it goes from a venture style like cash burn insanity thing to like a thing that throws off cash. It's Google times a 100, right? Google is one of the most successful companies in the history of the world because it had a money printer. A pipe of money that just poured into the middle of the Google campus from advertising revenue that was infinite and would never be turned off. It lasted 20 years of infinite money just pouring in to the point where they could do nonsensical things, waste money. If Anthropic becomes that, it's petrifying to know what they will do with that cash. But two, how valuable they will be. Infinity. It's worth

infinity if you control the world's intelligence. Hence why I think they're going and trying to do all this crazy [ __ ] because they're anticipating that moment like the moment where it flips from they burn cash at a proflegate rate to they throw off cash. It's going to be [ __ ] wild. So yeah, >> how how do you view the competition? Like you're saying Astra is not good enough. Deep Seek's great, but not like I don't know. I like a visual analogy of like they're like a pizza and then there's like a bagel over here or something like that. To me, there's some competition. Like I would say that if Claude disappeared, I could still basically do my job and I still figure it out. So I feel like competition is

something here that >> it's Sorry, just to be clear, it's leaprogging. Like I would be saying the same thing about OpenAI, you know, two weeks ago. Okay. Right. So Open AI will also be worth infinity when they start making revenue >> for sure. Yeah. Like any frontier lab that has the ability to make frontier models and stay at the frontier that flips from like cash burn to to you know cash flow positive is worth infinity. We've never seen any company like that in the history of the world. They control intelligence. Like it's it's insane.

>> This is like the permanent underclass thing. Like they're upper class if you control the intelligence. >> Yeah. >> Yeah. So like you've never we've never had a company like this in the history of the world. The closest analog that I can give you is like Google with advertising. They controlled all of advertising for like two decades and just made infinite money. >> Infinite money. They literally didn't even try. Like go and talk to someone who ran AdWords campaigns and they're like, "Can you please like fix?" And they're like, "No, there's a pipe of money. It's like Scrooge McDuck swimming in gold coins." They're like, "Ah, when we're done swimming, we might go and take a look at this thing." Right? They did. They gave zero [ __ ] about their core business. And they were like trying to invent [ __ ] flying cars. And I

mean, we got like literally out of that is where the attention is all you need paper came out of, which is Google. The worst part is that Google has not gotten their [ __ ] together to actually monetize these things. Because if Google had been able to pull this off, then yeah, Google is the only company and they're worth infinity. But somehow they fumbled and stumbled their way and now Anthropic and Open AI exists. >> What's the Google AI game look like? Is it Gemini? Do you use that for anything? >> They're Argon is their new >> No, they just launched, right? Like maybe a week or two ago. It's somewhat indicative of like it's been a week and I've been trying to get Argon into my harness and like I haven't really bothered >> the reviews a bit like meh. So whereas

any new open AI or or anthro or even like deepseek model I'm like [ __ ] it I got to have that on >> not 100 LARs posting all this crazy [ __ ] on Twitter then I know it's not good. >> You know it's bad. Exact like 100 Yeah. If there's not like people laring you know. Yeah. Yeah. Yeah. All right, let's wrap it up there, guys. Thank you very much. Thanks for joining us. >> Oh, wait. Hold on. We have one little update, though. Austin, what keys got drained? [music] >> 10 10 digits right away. >> 10 only. >> 12 digits. Not yet. So, our sweet spot is between 10 and 12. And we'll see.

I've got a 14 and a 16. Got got the, you know, the fishing line out there looking for someone to steal my dollar. [laughter] >> The worst part though is when someone takes this [ __ ] when they take this [ __ ] and do something nefarious with it and then it traces back. Like I had a trace back to you flanker that leaked a private key and then someone took that private key and deployed a token on Robin Hood and I wake up to that in the morning like a >> sleep. Exactly. Bro, it traces right back to you.

>> It traces right back to a 7702 drainer that anyone can see if they can look at it. [music] Not you. All right, >> we'll see where they go. >> Yeah, let's see. Let's see if they get to 14 digits by next week. >> All right, guys. Thank you for joining us on this episode of Uneas Money. Remember, what happens on chain never stays on chain. We will be back next week to find out if Austin is poor. Nothing you hear on Uneas Money is financial advice. We're just three builders talking about what's happening on chain and we want [music] you to always do your own research before aping. You can find all our disclosures at unchaincrypto.com/unemoney.

[music] Hey hey hey. [music] [music]