The Ledger Drain, OpenAI Espionage and Models That May Self-Replicate

Transcript

they raise to give them more money. And in crypto, we have like one or two years year old startups that are, you know, they're saying, "Hey, like the best way we can invest capital is just going to be to buy back and burn our our model." And honestly, like from the investment perspective, it's such a turnoff because basically you're telling me like, "Hey, we think we're the best. We think there's nowhere to grow and like the best use of capital is just to to to buy back the token." >> [music] >> And obviously we know that's not the real answer for a lot of these companies, but they're basically getting bullied into buying and and burning the token. And I think that's just like it's just crazy, right? So I think one thing that's one thing. The second thing is I think generally some companies don't see

a path to like becoming 10x bigger. And so they're using that basically to to allocate the capital and make kind of investors happy, right? Like I would rather a founder like come to me and say my stable coin is like $5 billion of supply. I see like a clear market or pathway to becoming like 50 billion. I'm going to use the capital to do this like 100% like I I'd rather have that instead of kind of buying back the the token. Imagining a war where Ethereum acrews like several billions of dollar is just very very hard to imagine if not clearly impossible right because we have two things. It's basically the base layer is used to store assets like not much activity is happening at the base layer.

So it's not producing a lot of fees and basically activity has been outsourced to these layer 2s and frankly like mainly two layer 2s it's base and Robin Hood and like there are other layer twos like lighter and but it's basically like five to seven layer twos that have like 99% of the activity and those fees they're not acrewing to to Ethereum right like I I made the point with Robin Hood like Robin Hood was making several millions of dollars a day and basically Ethereum base layer was acrewing $100 like literally $100 to $200 right I think from a value crew perspective like It's pretty clear and I I kind of I've written about this where Ethereum has this um you know franchise model where basically it's scaling through fr franchises right like really base and Robin Hood you can think of it as a as a

McDonald's franchise right I think just the Ethereum foundation and people around Ethereum have internalized it and they're not realizing but growth is not happening anymore uh at the Ethereum layer 1 we were talking about this and today if I had like a normie friend that comes to me and that wants to buy Bitcoin for the first time I I I would probably recommend him an ETF to to be completely transparent which which was not the case like I think three or four years ago and I think internally even for people like myself which you know I've been self custodying for years I'm actually thinking now of consolidating a lot of the custody that I have because it's just like so hard to keep up with what is happening in terms of AI breakthroughs quantum and you don't only have that like even crypto protocols like closing right like I I don't know

if you know you've seen this but like abstract which is a layer 2 is closing and they're basically giving their users like a month to to withdraw funds, which is completely nuts. Like a month, like imagine imagine you're on holiday like in Australia for two months and you come back. It's like they should give at least a year or something like you know that that makes more sense. And so I think from that perspective, there are just so many angles right now where you can either lose your funds or forget about it. >> Like to your point, if OpenAI has figured this out, right, it's already been moved into classified sections of the government like it's being used for cyber security. I think the bigger concern for crypto like that gives us a window to act and and I think if there's anything to these rumors and again I

give them relatively low probability of being true but if there's anything to the rumors that like OpenAI is coordinating with the EF or whatever like we'll see things happening in pretty short order that tell us because the real risk is like with as with all the AI stuff is that the Chinese models are not far behind and in that case you do have you know first of all they're open weights but there's also an adversarial part to it you have maybe some number of months if open AI was able to do this with their cutting edge frontier model, then you have some number of months before a Chinese model is going to be able to do it, right? So that's that's like the clock if this were to actually be the case. People had to create these tokens that were not going to ever return value. There's no

dividends. There's no buybacks. There's nothing. We're never going to do that. It's just governance because if you said that you were going to do that, you were at serious risk of violating securities law. Now, the good news, I think, is that that's changing, right? And so what comes along with that, I think, is increased scrutiny on teams who aren't doing it, right? So, if you're a big protocol and you are monetizing or have potentially the the ability to monetize and you have a token or you're thinking about issuing one, you ought to have a story for how to drive value to that token that's actually rooted in something real, right? Like not some like moon math. We're setting up the incentive so perfect. It's like no, we're charging a fee and then we're distributing those fees or we're using those fees to buy back the token in this

like programmatic way. the way that like say unis swap or other you know big projects are now doing and the other thing I'll say is that I don't think that's like a small the point of governance tokens and governance in general for project is that you're supposed to be like it's to provide economic security right um so it's not just like oh the token doesn't matter I don't buy that excuse anymore right the regulatory excuse is going away >> I think it's just a different dynamic when Zach then makes something public it lights a fire under everyone cuz it's kind of like wait if this if this bro on Twitter can tweet this Why didn't anyone do anything about this beforehand? But the other thing is just knowledge. A lot of people don't understand the moneyaundering dynamics. [music] A lot of the teams don't understand like the

especially the centralized exchanges. It's a clear as day DPRK hack, but then they'd see really strong Chinese indicators in Chinese language and Chinese [music] everything on the accounts that were laundering the money. And if you don't have any like open- source public reporting on the the laundering dynamics, you're basically like one by one trying to explain and to convince these exchanges who are often Chinese by the way. like, "No, no, we swear these are money launderers who know that they're laundering money." If you follow me on Twitter or postbbit, even pre-BY, you would see me bitching at the a lot of the exchanges for for not giving >> reacting to this. Yeah.

>> Yeah. But I mean, the amount of times that I have sat there and explained to the exchanges, yes, they're Chinese, but they they're working like really handinhand with DPRK. >> Not all potential encryption breakthroughs are equivalent. something big enough that it's going to break almost all forms of currently usable cryptography like public private key cryptography has far bigger implications than crypto. Like yeah, your coins are going to zero, but do you realize private internet communications are now impossible? So we're back to like the 1990s where you can't put your credit card on the internet at all. Right? This becomes a totally different level of problem than the problem of hey we have some blockchain specific issues to deal with because in that case great ecommerce is dead and like email is no longer private. Those are call it step

function levels of problems far above the Bitcoin blockchain. Right? And I know crypto people like to look at and think about the crypto system, but look outside into the world at the implications of some of the predictions you're making and you'll realize this is a little bit like, hey, if stable coins break because the US Treasury defaults, it's like, hold on, if the US Treasury defaults, nobody cares about the stable coin. I also think there's been a big misunderstanding of information security in this space, which is to say people have looked at tools that allow them to self-custody or things that they sort of have a mental model of keeping the private seed safe that ironically rely upon a bunch of things like vendors you cannot really do diligence or devices that you can't easily take apart and

understand. And this is where people have got themselves into trouble because hypothetically, just hypothetically, if you had created a MetaMask hot wallet, which everybody will tell you is not safe, and just written the private key down somewhere secure, put it in a fully encrypted password manager, and then never transacted with that thing, nothing's been stolen, right? That is the answer. If you just stuck it in, I don't know, Proton Pass, you're >> I don't know. I think Joe Lubman's going to push back on that, that MetaMask isn't safe. Um, for sure. >> No, no. I'm saying that's the perception that hot not safe. I'm not agreeing with that, but I'm saying the meme was it's not safe unless you're using like a cold storage vault. And this to me is a misunderstanding of the security surface. When you're an individual, you have limited time and limited ability to

verify. You should actually be oversolving for simplicity. If you want to do these things and that is not what people have been doing is we've looked at political realignment. We've thought a lot about right left. What we haven't thought a lot about is young people versus old people. Because the argument is basically boomers are like, "We've been promised all these benefits. We need to get paid these benefits. Yes, the budget is large, but just raise taxes, right? Cuz we need to get these things." And the counterpoint, you know, I hear this from my students is I wasn't even born when you guys voted these things for yourself and then you ran up a negative $440 trillion tab on this thing by running a huge deficit. Why the hell do you expect me to pay for that?

Sounds like your problem. And I think the political parties are going to start having a reckoning of if you really start moving aggressively to defend benefits for the elderly. You are going to lose all of your young voters because young people rightly are pointing out, hey, we weren't a party to this agreement. Like the 65year-olds don't get to vote amongst themselves to steal all of our stuff to pay for their things. Like we're not cool with that. >> Before we get started, I want to ask [music] you for something. We're making a bunch of decisions right now about Unchained. what we make next, when we go live, what we should be doing more of, and I'd rather hear from you before we make them than [music] after. So, we put together a survey. It takes just a few minutes. It's anonymous, and there's a box where you can tell me what we could

be doing better. I read all the responses. The link is in the show notes, or you can snap the QR code on screen or go to unchained crypto.com/servey. [music] Thanks. If you like this show, there's another one from our network you should be listening [music] to. Bits and Bips is our weekly market show. On Mondays, Rahm Alawalia, Austin Campbell, and Chris Perkins [music] chat about where crypto and macro collide. It's sharp, it's fast, and it has its own channel. Search Bits plus sign [music] BIPS and subscribe.

$540 million. That's how much concentrated liquidity sat idle in a given week in the first [music] half of this year. About 30% of the DeFi TVL if you're wondering. That's according to Dune Research commissioned by 1 in. [music] But there's a solution. 1-in Aqua is the new shared liquidity platform. It lets LPS back multiple positions with the same token balance and keep their tokens in their wallet till a swap comes. Why does that help? Because the LPS don't have to split their tokens across positions. They can cover more market conditions and pairs with their full balance. That means more activity across deeper liquidity. See how it works at 1in.com/aqua.

Remember that providing liquidity carries risk and fees aren't guaranteed. Heads up everyone. We've now fully transitioned [music] Bits and Bips to its new dedicated channel. >> [music] >> buy.

>> [music] >> Hey everyone, I'm Kane Warick and welcome to Uneasy Money because what happens on chain never stays on chain. Before we begin, here's a word from the sponsors that make this show possible. >> This episode is brought to you by Nexo, the premier digital assets wealth platform. Earn daily interest on your crypto or borrow funds, all through one platform trusted by more than 10 million clients. Find out more at nexo.com. GEO restrictions, eligibility, and terms apply. Not listening to Bits and Bips yet? [music] It's our weekly crypto and macro market show with Rahm Alawalia, Austin Campbell, and [music] Chris Perkins. Search Bits and Bips and subscribe.

All right. Hey guys, we are back. Um, I'm here with my co-host Taylor Monahan, security expert and Austin Griffith, uh, builder enablement at the Ethereum Foundation. Hey guys, it's been a fun week. I just got back from a token in Singapore. Um, [music] which was good. Felt uh, felt like early bullish vibes, like bad things were still happening, but like people were partying. So, it's that little like dip as we come out of the the bottom. Hopefully, we'll see. Um, we'll see. All right. Our first story uh this week is Ledger. Um, man, Ledger, like Ledger, Ledger,

Ledger. Um, I get that. Look, I've been a Traor Maxi for a long time and so, you know, um, I feel kind of contractually obligated to break these guys over the calls, but like you have to feel for them, right? Like it's a little bit like running a DeFi protocol. You know, everything that you do is scrutinized. You have people that are attacking you constantly. Every possible vector or um you know mistake that you make is like massively exploited. And some of those mistakes are unforced errors for sure, right?

Like you know >> 100%. >> Like their company, right? Um, they keep >> and they're and they're French. They're so French like I don't know like [laughter] I mean you know uh so so I think like the the um yeah so the background is like Ledger has probably been one of the most like problematic attacked uh entities in the space, right? And part of that is because you know your job as a hardware wallet, right? is to secure a lot of money. Like that's kind of the purpose, right? Um you don't need, you know, a hardware wallet for your $50 uh [ __ ] slinging account,

right? You do need it if you're like the signer on the unis swap [ __ ] you know, multi-IG or whatever the hell you might be up to, right? Or like the Ethereum Foundations, you know, ETH trove, right? Like you want that [ __ ] to be secured by hardware wallet. Um, ideally you want the hardware wallet to be connected to a machine that's airgapped. Ideally, you want to be in like a clean room with a [ __ ] Faraday cage or whatever the hell um that you're doing. Um, and yet and yet here we are, right? Um so so this week's Ledger debacle I guess was yeah

>> that um one of their resellers and like correct me if I'm wrong but like there was a period of time where you didn't buy hardware wallets from resellers. >> Yes. >> You just wasn't done, right? Like >> but also if you lived anywhere outside of basically the US or EU, you you couldn't buy a hardware wallet either, right? Like where did you get yours from Jane? >> Like [ __ ] fly to the country. >> Yeah, >> you're securing millions of dollars, man. It's like a 20,000. >> Okay, but Ledger has to It's a business, bro.

[laughter] They have to sell their [ __ ] And this [clears throat] is I mean this is it's painful. It is painful. I think one of the reasons why Ledger keeps getting uh there keep being situations with Ledger but also with Treasure like none of this is you know is unique to just them >> partially it's because they >> have built a successful business that is still alive after nearly a decade >> for both Ledger and Treasure and I have mad respect for both of them for >> and hardware is [ __ ] hard man like you know you like building >> I tell people don't build a freaking software wallet. [laughter] These [ __ ] out here.

>> We're building a hardware wall. And you know, the funny thing is for me though as well is like, you know, hardware is the hardest thing you can do, right? Clankers can't even really help you that much at this point, right? Like they can do software stuff. Um, so you know, the degree of difficulty of what these guys are doing is very high. And one consequence we understand deeply now I think in this space but in startups generally of doing hard things is you have to find some easy things to [ __ ] up, right? Like when you do hard things, you will inevitably focus on the things that are hard and not focus on the things that are easy. Like vetting the [ __ ] people that are selling your

hard. Imagine you spend your whole life like you think about all of the effort and pain and suffering that went in and then you just like send a pile of these [ __ ] things to some like crackhead who starts opening them up and putting [ __ ] modems in. Right. So, okay. So, story is right. >> Oh, yeah. Yeah. Let's do the full story because it's a wild tale. This is not like we've normally seen. We've seen their mailing lists get breached, which by the way, everyone's mailing lists get breached and then emails are sent out, but we've also seen uh for I think all the hardware, right, the physical letters.

>> Yeah. >> So, it's not just like a fishing email, it's a fishing letter, which hits different. >> Yeah. Um, and then we've also seen historically we've seen um, you have to buy them off of a sketchy shop though, like a really like Amazon, you know, fake ledger.com or whatever. Like, but usually there's been these ones where um, basically like they'll either it's a sketchy seller, super sketchy marketplace seller situation, or it's like a return to a place that doesn't have good diligence. Originally, the first one I ever saw back in the day was I thought it was the most creative [ __ ] [laughter] They didn't get that many

victims, though, but I thought it was so creative. They had a little they would open up the box really carefully and they would put a little um they would pre-initialize the device with the 24word phrase and then they would print that 24word phrase on a piece of paper. >> And so if you weren't super familiar with the flow, you just people would think that that was the >> how convenient. And then the second Yeah. The second iteration of this was um they did it on this fancy card and the card was a scratcher. So you scratched off your 24 words.

>> So good. >> But they already knew about it and had painted it. Get the scratchy stuff on there for you. But you felt like you were Yeah. Some good human psychology. Yeah. >> I mean I thought that was like the most creative [ __ ] I still think it is actually like the scratcher. Like are you crazy? People trust scratchers. Like, how would someone know what's underneath? >> How could they know? >> So, those were like the ones. But again, these were like they were like oneoffs. They were not mass operations. And the solution was like, don't buy it from a random person on Amazon.

>> Literally, >> like, you know, the boxes from >> go to a conf like dude, go to a conference and they will get they will give you them for free. >> Yeah. like literally just go to a conference, they'll give them to you for free. Um I remember when when we uh when we launched um I bought uh tracers for everyone in the team, >> all of our all of our uh investors and I got like 50 people into a room together, right? Um and we went through the whole setup process, right? Yep. Like here's what >> did the same thing with my team.

>> Yeah. like you got like and it was so funny, man, because like we had a range of people in that room as you can imagine, right? Um and one guy who was my friend uh the only guy the only [ __ ] guy forgets his password forget. [laughter] So we we put we put like the 25th seed word on there as well, right? Tracers, you can add you can add you know I think you can do it with ledgers, but back then you could you could do it with tracers. Um, so I said like it's not sufficient that you write this down, these 24 words. You write the 24 words, you put them in a safe or something. You need one other word that extraord >> this [ __ ] forgot it like three years later. Um, anyway, that's a different story. Um, so

>> been there, done that. >> Yeah. So, so uh so >> major yeah so basically major evolution from those types of attacks to what's happening today and the biggest the biggest evolution well it's twofold. So one, it seems like they have um gained access to a distribution channel, a legitimate one or >> a businessman. It's [ __ ] cra like the chaining of vectors here is genius. >> Insane. So that's evolution number one.

And that's probably why this we're talking by the way we're talking about somewhere between like 70 million and $100 million stolen for what's basically like a three fourmonth operation right all of the ledgers were seem all the reports that we have seem to be bought in June July August September October very beginning of October right so we're talking about four months I guess five months maybe nearly hund00 million stolen so yeah distribution like they basically got these malicious devices onto a distribution channel. They got into the distribution channel into the supply chain. Probably something with this cryptobillis company, which we'll dive into in a minute. Um then the other evolution

though, which is like this is what this is what's wild to me because we've seen the letters, we've seen the scratchers, right? We've seen fake devices. And what this means is like we've seen where Treasure has these as well. The whole the [ __ ] device is fake. It's a glorified USB. You plug it into your computer and then your computer's like, "Uh, load up your D drive, the Ledger D drive and then you click it and it's like a little fake Ledger Live or like Treasor application and then the application is literally just a malicious app, right? It's just malware.

Um, it's just like it's almost the same as fishing. It just the delivery mechanism is like this fancy >> a hardware wallet. Yeah. Yeah. >> But they also like they feel cheap. Like the devices feel cheap. They feel different. Again, you have to buy it off a sketchy seller. Like it's Yeah. And then again, these are not real devices. So, it's a USB. You plug it in and it it looks like a USB and it has a fake app and then you whatever you have malware on your computer or it seals your seat or whatever. Okay. These ones, [snorts] first off, it's in a legit sort of like in the distribution channel. That's that's legit. It's not Ledger literally, but it's these authorized resellers who CryptoBillis has been working with Ledger and other people in the space

since like 2021. They go to conferences, they're known. Like, it's wild. >> Um, >> and then the other thing is that it's a genuine ledger that actually [ __ ] works. And inside the hardware, by the way, I wish I had my ledger in front of me so I could like show you how tiny these things are. like inside the little tiny >> It's crazy. >> They they managed to put an LTE chip, a little CPU, an e SIM. So that's like where your data plan is, right? It used to be you had like a SIM card.

>> Yeah. >> Now it's like it's this little eim chip. Um and they've connected that to the legitimate ledger board. And basically what happens is that they're intercepting the data as it's shown as it goes from the secure ledger element stuff to the screen. They're sort of intercepting it and sending it to their own little CPU module. Uh and then that CPU basically will we assume sends the seed phrase to their C2 server somewhere via these LTE data plans. your Faraday cage. You said Faraday cage earlier. This is the only way to save it

would be other than taking it apart and looking would be to be in a Faraday cage >> or like underground where there's no signal or whatever, right? >> If you remember when I think when Zcash was doing their they had to do like a big trusted setup or whatever to kick it off or whatever, right? Do you remember the guys were like out in the middle of the freaking >> driving around with like laptops and and then like smashing them once they had it done. Yeah. >> Yes. Okay. So, this is why because they're like, "Okay, someone you could have a man in the middle and my network." So, like got rid of the network, >> the any network could be right like >> Yeah. Yeah.

>> So, go out in the middle of the desert where there's no connectivity, but also like smash your Wi-Fi card out. Like they, you know, they did all of these different things. This is like it's this level of like paranoia. >> It's crazy, man. Like >> for this level of attack, right? >> Yeah. >> Um >> they should have encrypted the screen. >> They should have given you some like encrypted glasses that like decrypt it or something like >> a different package. >> My dad has done hardware his whole life. So I like grew up in factories and stuff. He does a lot more like in the US than in China, but I'm familiar with like China supply chains, Mexico supply chains.

I asked him and I asked some of his friends and like they were like, "Why would you [laughter] why would you the screen you want the screen like the display encrypted? Like what is that?" [laughter] >> They all I was like, "Okay." So >> here's why >> not you have there are encrypted channels and there's a lot of different encrypted components and stuff but the the screen is deliberately made to show the end user >> the information. >> There's no >> clankers wouldn't care. Just [ __ ] point it at a clanker and let it look at the screen and like just show random >> blips. By the way, my dad and his friends figure it out like like a weird

cipher and like just hold you go hold it up in front of the clanker for like eight hours and it eventually like decrypts the cipher and goes, "Oh, I know what it is." >> Yeah. [laughter] >> My dynamist friends have like a lot of respect for me over the years. Although they've like lost it a few times as well, obviously, but like generally they have, but this question was the one where they're like, "Oh, she she's lost it. >> He's retarded." [laughter] >> Where is the screen encryption even coming from? like he doesn't even make I'm kind of joking. I'm just making sure I was like I'm not following my screen. So this is the thing is that the way that they do the way that they get the ledger. So okay so Ledger and Treser have a thing called a genuine check meaning that if the CPU is tampered with

if the uh secure element is tampered with if any of these components are tampered with when if the firmware is tampered with right when you plug the device into your computer it's going to fail the genuine check if anything is like you know yeah and the way by the way the way that the previous version like malicious Ledger devices got around this was that they weren't even a ledger they were just a USB Yeah, >> that's how they got around the genuine track was like we're not even in the same world, right? >> Yeah. >> Okay. So, this this >> completely different like it's there's nothing involved in this.

>> Yeah. Like FYI, your Ledger Live app doesn't tell you that like your random USB stick isn't genuine. Like it's just not relevant at all. Right. >> Yeah. >> Um and so but now what's happening is that they're it is a genuine ledger. It's a real ledger and it passes the genuine test or the genuine check because it doesn't actually tamper with anything. So, it doesn't it doesn't replace the CPU. It doesn't [ __ ] with the CPU. It doesn't try to replace the firmware. Like, it just completely bypasses all that. And my understanding, this might be like oversimplified, but my understanding is that because data has to go from one place to the other, >> they have to show you the [ __ ] words on a screen. Like at some point they

need to show you a thing. It makes that >> because you generate you generate the seeds securely. >> Yeah. >> But in order to have the backup you have to Yeah. And so basically what it's doing the person the words right like they can't be decry that was kind like I was sort of semi joking right. But like if you encrypt that part like I don't even know like what are you giving the person like the complexity just gets crazy right? like at some point >> you would never have to you wouldn't have a you would have to get rid of the >> you basically couldn't have a backup or like your backup would have to be like some I don't know something right >> like genuinely like the whole thing

can't be secured like there has to be some vector at some point where you have plain text that you show to the user >> or the user has to be able to read the plain text to know what the seed is. Like >> yeah, >> there there there will always be some door if a user is involved so that they can physically write down the seed phrase, right? Like that's >> right. And have that backup otherwise you you're going to end up relying on servers and >> Yes.

>> like >> Yeah. I mean you like you can just to be clear, right? Like you shouldn't do this but you absolutely can not write the seed phrase down. >> Oh yeah. People do this all the time. >> Yeah. You can just like put the pin. You just put the pin in and not care. Right now, if you did that and the ledger and you were like, "H, I don't believe that you don't have an LTE modem inside of you, Ledger. Do not show me." If you put it in that mode, like don't show me the seed phrase mode. Like, I'm going to protect this device with my life or whatever, right? Then yeah, then it would be fine. Then you wouldn't need to show the seed phrase and this would not be an attack vector. But do you know how much I'll say this, the amount of loss

from people not correctly backing up their seed phrases or not backing them up at all is like probably in the billions of dollars at this point. >> It's like Justin Drake being move all your crypto now. Like >> like like [laughter] worst things will happen if people start moving their crypto around randomly, right? So, >> and by the way, I do want to just say that if you are if you have a ledger, like please don't freak out. Don't panic. >> Yeah, >> I really want to emphasize this because all week we've been doing the Ledger incident, collecting reports. We're working with Ledger obviously. Uh Treasor's actually been really helpful as well. Like their their guys are so good. like, you know, everyone has to compete and like hate each other or

whatever, but like Treasor and Ledger are are, you know, they're they're all just like fantastic people who have survived this long and are super [ __ ] serious about this stuff. >> Yeah. >> Um, I will say that in the past couple days though, the reports that we've been dealing with are not actually Ledger drains due to rogue LT modems in the devices. It's people who panicked and then did something terrifically stupid. Um, and so we're seeing, yeah, like you guys like the Google ads if you try to install Ledger Live. There's like a chance that you'll click a bad ad.

>> There's also just like fake applications. There's also fishing sites that are trying to scare you. There's emails trying to scare you. And then there's also people that will call you on the phone and try to scare you. And all of these are going to create loss in addition to like the original thing just from people panicking. So >> don't panic. There's so much asymmetric >> loss here. Like we we went back to talking about a hardware wallet costing you $100, but then you store $20 million on it.

>> Like you're saying travel somewhere and get the thing from a certain place. >> You understand the business? They need to run a business. They need to have distribution worldwide. They need to have the hardware cost as little as possible so they can make a margin on top of it. But in the in the long run, it's like why are we paying $100 for a device that we store 20 million on? Like isn't that worth maybe like five grand? And then like if the device is worth five grand, what can we do here with a five grand margin in terms of like you know >> fly to the person's house and set it up for them? Like literally like that would be a better solution, right? Like um >> but then if someone shows up in Ledger gear, do I know they're them? Like

there's there's so many different Yeah, >> right. I I think that just the fact that you're making a hardware wallet makes you an asymmetric target also. So, I'm I'm I'm going to push back on the people don't want to [ __ ] around with hardware because I think that with AI, we're going to have a a whole blooming a whole uh renaissance of like people doing hardware, people running Linux things, things that like normies didn't do before. You can now just like ask AI about and you can give AI observability into your hardware and it'll be like oh that wire is wrong or whatever. So, I do think that we will have a resurgence of hardware and DIY Linux. And I think that like DIY hardware wallets are like the next step here where you're just ordering parts off of Amazon that

>> dude like an iPhone >> don't have Ledger names. >> The best the best hardware wallet is an iPhone like >> or like a Chromebook even. >> We're getting we're getting pretty close. Yeah, people talk about the iPhone, but like we're getting pretty dang close >> to having that be like an actual really secure thing that you can actually use, >> right? Because this is the other thing that people forget is like >> the reason that we recommend hardware wallet so much is that it narrows the the points of like compromise, the points of attack. It really does narrow them a lot. Like you can get malware on your computer and you're going to be basically safe with a hardware wallet, right?

>> That's like a that just cuts out a huge amount of loss. But you can also like use it. You can use your hardware wallet. If you really want like the most secure thing, just go back to paper. But realize that you're not going to be >> you can't do transactions, right? >> You're not going to be sending anything with paper. >> Yeah. Exactly. I mean, you know, the thing about an iPhone, right? Like talking about like spend $5,000, right? Like the newest cheapest iPhone is like 700 bucks, right? So it's like three times the cheapest Ledger, whatever, right? Um there is zero chance today, right, that if you buy an iPhone, it's going to be compromised in the supply chain because it's just security through obscurity. You're like one person out of

a billion buying an iPhone. You go into an Apple store. Like there's no way that someone has like set up a fake Apple store that they bought on eBay and you know like Tim Apple just allowed them you know now if you go into a random Apple reseller >> and that Apple reseller has become known for selling Apple devices as hardware then obviously the asymmetry flips right but if you go into like your town's Apple store I don't know where the [ __ ] you live right but like You go and there's an Apple store near you. There just is like an official app store and you buy a [ __ ] hardware device, a phone, and you go and [clears throat]

tell your clanker, "Hey, help me to set this up as a hardware wallet." It can do that for you and it will be more secure. It might not be like quite as ergonomic because you might not have all the software, but like it probably is. It probably will be fine, right? You just never connect it to the internet. You only connect it via USB, whatever. It gives you like there's just a bunch of different things you can do. Um, but I mean the proximate cause of all of this stuff >> is crypto is too valuable. >> It's too Exactly. That's what I was going to say.

>> Like Bitcoin should not be worth [ __ ] $80,000. If it wasn't for that, if Bitcoin was worth $8, none of this would be a problem. >> This is that's the fundamental issue here is that crypto's just simply gotten too valuable. >> Yeah. And if you put and if you spend all this energy and resources and time to to to do this attack on a thing where literally 100% of the user base, right, 100% of the people that buy a ledger have serious money to protect, >> right?

>> Yeah. >> Suddenly the supply chain becomes worthwhile. Whereas if you look at the Apple supply chain, >> hey, [clears throat] the vast majority of people buying iPhones don't have anything that you want. Yeah, >> quite the opposite, right? However, if there's a custom iPhone that's made for like government officials, you're going to see that be targeted for espionage like instantly, >> right? And so it's Yeah, it's it's a whole it's a whole game. >> I I don't know. I still, by the way, I'm still using my ledgers. I'm still using my treasures. I'm going to continue to do so. I'm going to be way more careful about where I buy them from. I'm going to be way more aware. I'm gonna keep my strategy for the longest time because I

live this life of like terror all the time is never have all of my eggs in one basket. I have ledgers like the multisig also like having a multi-IG where the ledger or the treasure is just one ser and can be replaced if you lose it or it leaks. >> I mean at this point is safe, right? Yeah. >> If if this was a ser on like a one of two even, right? and the other, you know, the other signer, uh, sorry, a two of three, uh, in this case, right?

Because the the seed phrase is compromised, right? A two of three, like the other signer could be a hot wallet and it would be fine. >> Yeah. >> Um, you would actually have been fine. >> And Martin said it the other day, if you Google knows safe, the top thing is someone trying to fish. >> I was about to say, just be careful when you're doing your safe [ __ ] because they're just I mean, the attackers are just crazy. But yeah, my my basic strategy at this point, and it has been for years, is that there's not there's not a single thing that will completely wipe me out. Like I have so many ledgers. I have so many treasures. They're in different places.

I still have paper. Like because I just like you can't you can't live. You can't use crypto. You can't live if if like you you know like I wouldn't do anything. I just hide in a bunker. like literally if all my stuff was in one thing. >> So that's my best advice >> who we had on two weeks ago uh on slap computer told me about basically Samir Shamir secret sharing but with your 24word where you take the 24word and you split it into three and then you put it into sealed bags and you even store that in three different places and you have to have two out of three.

>> It's like it's [ __ ] wild. >> Yeah. Yeah. And I do I have I have se seeds that are split and stuff. Although again it's like the risk goes back and forth because in my what is it is I've been answering support tickets for a decade now, right? I would say that there's probably still more loss from people who got like super paranoid and created these big elaborate schemes to store their money. Yeah. >> Especially long-term storage. >> Yeah. Like, you know, Kane was saying earlier that the 25th word will [ __ ] people up.

>> 25th word. Dude, even writing down the 24 words. Some people don't write them down. They write them down in the wrong order. They can't >> take a picture and tweet. [laughter] >> Yeah. The picture on the device is a big one. >> The um so the ledger cards, I talked to Ledger about this forever ago, but the ledger cards historically were in two columns and they were sort of numbered. But it turns out that humans naturally like will either go one either brains >> 1 2 1 2 3 4 5 6 or it'll be 1 2 3 4 5 6 down the left column and then 12 13 14 down right.

>> Yep. >> But then when they read the words back in a year or two, they might switch it, flip-flop it, or they might like listen to the numbers or whatever. So yeah, we have like all these things where people have have just they basically lost their crypto because of one of these things and the more elaborate the scheme, the more likely like that you are to actually just lose your money. But plus side is that you have like an in those cases you have almost an infinite amount of time to like figure it out. >> Though like there's scripts and GPUs that like we have so many scripts to try to like brute force these things.

>> Yeah. Throw 24 words in and like try every combination or whatever. Yeah. But it's kind of like the dumpster guy, right? Like where his hard drive he lost he accidentally threw away the hard drive. >> Yeah. >> Sometimes, not going to lie, sometimes the the best thing for your mental health and sanity is to have someone like steal your money. Sometimes it's worse to have it locked up >> cuz then you know it's like there. It could be recovered. It's just like one Yeah. And it just sort of pers you and it's like every year you come back and every time the price of Bitcoin goes up you go back and then you pay another guy to run his GP the new improved GPU scripts >> and you don't ever get to like release it. Like I did some big thefts after

like FTX. So it's been four years now and those people have basically moved on. They've rebuilt their life. They have their jobs. Like it sucks, don't get me wrong, but like >> because you have to find Yeah. you're like forced to find the closure where I I I still have people from like 2016 2017 who locked up like 10,000 ETH and every you know every couple years they come back and >> they're like how do I mean yeah it's like the parody >> can I try this can I do this can I yeah it's just hanging there >> it's just sitting there like it's right there you can see it it's like in the thing right like >> yeah yeah >> so anyways my best advice for this

situation, every situation, multiple baskets, multiple eggs in multiple baskets. That's it. >> But try not [laughter] to over complicate like try to find a simplistic way to have a multi-IG like setup >> or a shamir secret shared like setup where you custody your funds from a few different accounts that are very clear and easy to understand. Just just scratch off the little scratchy off. It's already made for you. I don't know. [laughter] >> Exactly. Um Oh, more ads, too. We have one other little side story on the story which is >> everyone was like, "Oh my god, they traced through Zcash. It's not private anymore."

>> Guys, I did not trace through Zcash. I think some people actually did manage to trace through like they managed to like do a a proper demix. They cross their inputs and their outputs, meaning that they have money over here that's going into tornado and also into Zcash. And then they have money out over here that's coming out of Tornado and also out of Zcash, right? And so ideally, when you're laundering money, it goes in one end and it comes out the other. And you force everyone to properly follow you through. However, when you have like thousands of addresses, you have gas, your funding, right?

You get confused easily. Okay, the wallets are not that great. Okay, they don't you have amounts need to be different, too, right? Like, if you have a an exact amount in and then an exact amount out, it's easier to follow that, too. >> And you know what? If you're moving fast, you're trying to launder this freaking money. You got $100 million to get through. Okay. >> T's guide to laundering money. >> Part [laughter] one. >> Let me tell you, the gas will [ __ ] you up every time, kids. Yeah. >> Stop. Don't stop [ __ ] with USDT. Because what ends up happening, right, is they come out in USDT because that's what has the most liquidity, right? But then they're very rapidly trying to get out of USDT because it can get frozen.

Okay? And so then they send gas from over here to over here. And that is how I DMX Zcash because >> you you just follow this little trail over here. >> Yeah. >> Everyone else is like brute forcing it through the pools or whatever. Like no no. So anyways, Zcash still sufficiently private unless you're laundering $100 million incredibly rapidly and and stupid. And by the way, all the XMR people were like, "Manero is so much more private. Use it. It's exactly the same." Okay, we trace it in the exact same ways. You can brute force the ins and outs.

>> Yeah. If you [ __ ] up your OBSAC and you fund the gas like come out of the pool like Yeah. people are gonna like >> and that's by the way that's been on chain for Yeah. And that's just on chain before they >> Yeah. >> So don't I don't know people there's so much drama around this. I just want to like everyone needs to calm down. It's things are still private especially for I mean be careful right if you want to separate your ins and your outs make sure that you're doing so. Um, but it's a lot easier.

>> How do you build? How do you build your own Faraday cage? Just like some some aluminum foil around the the windows like uh a big it's a big screen basically a big metal screen. >> Yeah. >> Make sure your phone is dead. Yeah. >> Coinbase used to have tents. That's Coinbase is cold storage. Yeah. Yeah. Okay. So, they would go to a random location. This is like my favorite Coinbase story ever. Okay. They would go to random locations somewhere around the city of San Francisco that like only a few people noticed >> and there's already up everywhere. So, >> okay. And then they [clears throat] would sit in a Faraday cage where the power was like sourced from somewhere that like nobody was expecting it to be sourced from because you can't have people side channel attacking the power

supply while you generate your cold storage keys. >> Yeah. >> And then they'd sit in the Faraday cage and they would generate stuff and they'd have like printers that were all like brand new printers and the printers would be like destroyed. like they had like there was so many things that they did. It was completely bonkers. It's my favorite thing in the world. Um but it was all Yeah. Because like if you're gonna be if you're going to be generating cold keys for long-term storage that have millions billions of dollars in them, like the number one thing is like don't be in the building that's called Coinbase. Like the attack surface is too big, right? So like narrow it down. Get some new laptops. Go to a random location. Be in a cage. Uh, make sure nobody can tap the Wi-Fi or the power supply.

Nobody can can tap the printers beforehand even, right? Like >> they don't have like cameras pointed at you. Hence the >> You're in a tent. You're in a bar tent. >> Yeah. >> Yeah. So, >> all right, let's go to ads. Um, let's go to ads. Then we'll come back and talk about uh more espionage open AI [laughter] like Jesus, man. This is amazing. All right. Uh, we'll be we'll be back after a quick ad break. >> What if your crypto could do more than just sit in your wallet? Nexo is a digital assets wealth platform where you can generate daily interest on your crypto or borrow funds against your assets. Today, Nexo serves more than 10 million clients. Find out more at

nexo.com. If you like this show, there's another one from our network you should be [music] listening to. Bits and Bips is our weekly market show. On Mondays, Rahm Alawalia, Austin [music] Campbell, and Chris Perkins chat about where crypto and macro collide. It's sharp, it's fast, and it has its own channel. Search Bits plus sign [music] BIPS and subscribe. All right. Um, so our next story is also about people who have too many valuable tokens and people wanting to steal them.

So this week, OpenAI's office um, they revealed I don't know if this I don't know if they called the guy this week or whatever. Um, I think I think they may have arrested him this week. So, uh, OpenAI's office was bugged and, um, the guy put a, uh, recording device, some like somewhat homemade it seemed like, that he had that he' cooked up. >> Um, he also asked Claude to help him >> build it, which is amazing.

>> Hardware renaissance, I'm telling you. >> Yeah. And I was gonna say Austin called this in the previous segment. [laughter] He called this. He's like, "People are going to be doing their own hardware." >> Yeah. >> Okay. Pro tip. This is like going to be the episode where Taylor teaches you how to be a criminal. Pro tip. >> If you're going if you're going to have the AI help you turn into a hardware nerd, don't then use that information to hack the AI company. >> Yeah. >> Come on, guys. What are you doing? >> Yeah. Yeah. This is so so basically this guy and again this is the there's some interesting things about this and you know I'm so paranoid and cynical and

suspicious right that like I'm now like trying to work out is this guy playing 4D chess right so one of the things that everyone kept talking about is that he wrapped the device in toilet paper right and no one would wrap the device in toilet paper that's add tradecraft, right? Like why would you wrap it? Doesn't it's not going to do anything. It's not going to hide the fact that >> toilet paper is white, by the way. Like the whole thing is so weird. >> Okay, but but and again, this is I'm not trying to teach you how to do espionage either. But there's something to be said for if you were a nation state actor looking [ __ ] and we've seen this in

crypto many times, right? but looking [ __ ] and like you've just had a psychotic break and like the agent has told you to go in and like bug the place, >> you're going to get a much much you're not going to get executed, right? Whereas if they believe that you work for like the Saudi crown prince and you are like a [ __ ] guy that's been hired and planted there to exfiltrate the weights of these models for like the Saudis. Yeah, like you're probably pretty [ __ ] right? Um, so so this guy was the only Saudi employee apparently of OpenAI. Um, and >> he like used his wife's account. But

again, like these are things where you're like even like a relatively smart person who could get hired at OpenAI should be too smart for this. Like there's things where it's like this is it feels too dumb. Like this feels too >> I have so many questions. >> I don't know. So many questions. How many pe How many employees does OpenAI have? Like 10,000 or something? Like >> I mean thousands for sure. >> Thousands, right? Okay. So like let's say it's 5,000. So like the dumbest person out of 5,000. Like some random people will get through the filters, right? Like there's going to be some retards at OpenAI. Like they're not they can't all be smart, right? Um and so, you know, maybe this is like the dumbest guy that got through who also is trying to do espionage. I don't know. It see there's some stuff that seems a bit off

on this, honestly. Um, >> I mean, when I first read the story or saw the headlines and hadn't dug into it, my first thought was like, wait, is this espionage or is this like someone had a crush on someone else and wanted to >> He went to the he went to the executive and that'sive room, right? Planted this thing behind the TV, you know, he he looked to see like which rooms the executives use. like he was [snorts] looking for like the boardroom where they were going to be talking about whatever, right? Um >> the most important things.

>> Yeah, the most important things. Planning like which [ __ ] math problems they were going to break next week. Like what? I don't know, right? Um maybe we should ask this guy if they broke crypto. He might know. Um, so, so, uh, so yeah, like I mean, but again, you have to imagine that for every like fumbling bumbling guy, right, that is doing this [ __ ] there's got to be 10 guys that have like crazy [ __ ] like actual trade craft like >> Oh, yeah. No, the funniest meme I saw was the one where it was like the NSA, Mazad, and like the CCP all like spying and like the one Saudi guy with this

like toilet paper implant and [laughter] they're just like all like watching him like what the [ __ ] bro. Oh man. Um so, so you know, again, this is this is like if you have if you have valuable stuff in the world, people will want to steal it, right? And you know, um, it's hard to imagine a more valuable, uh, intellectual property case than inside of OpenAI and Anthropic, right? Like maybe at the CIA, but even that's like debatable right now, right? Like that the CIA has cooler [ __ ] than these guys. Like >> I don't Yeah, I don't I don't know if they do.

>> Yeah. Me either. Like genuinely, like what? like they've got some [ __ ] for sure, but like these guys have things, >> but also the government has contracts and is using these models, right? So, >> so probably end around it, right? Like if you can get into the Yeah, you get a back door. So, so um I mean, you know, >> the interest the interesting thing about this is like a you can build your own stuff, right? You can make your own hardware as you were saying. Um >> Yeah. Yeah. It's like $20 on Amazon.

>> So, yeah. Have you Have you been Have you been do like Are you building your own Can you even see this? [laughter] >> Are you building your own five? Like, what? Like, what are you building? What are you building? How are you doing it? Like, what's the Yeah, give us the TLDDR on on like whatever the [ __ ] is going. >> I build all sorts of stuff, man. I build I mean, like, yes, I have spy devices in my house. It's I replaced my Alexa with my own Alexa. So there's a thing that's always listening and taking all of our conversations and >> Wow.

>> Yeah. Yeah. So dumb thing number one. Dumb thing number two, I made like a blood wallet that you have to like bleed sign. Uh so that that took like a ton of hardware and it took a lot this was the worst. It's like the psychosis loop of iterating with AI while it's like just one more fix, bro. If we just if we do one more fix, it's going to work. And I'm like over here like bleeding for this this wallet. I'm I'm making my own hardware wallets. Like I think DIY hardware is a thing. I'm going to be showing people that DevCon how to do that. So, >> okay. >> I I love it, dude. Just give the give the >> set up Linux. Set up SSH so your clanker can talk to your Linux. It can control your whole operating system. It's scary,

but I let it rip. And then that thing has observability into my whole uh electronics bench and it can see things and I can plug things in. So, it it can run the chips. It can see where I have the wiring and it can tell me how to, you know, do it better. Now, if I was doing something nefarious, of course, they would like track that back to, you know, the fourth thing or whatever on my >> That's why you run like a a GB300 cluster with GLM 5.3 local. Um, if you're really >> really criminal act number three on this show on your own local GPU, we're going to launch. [laughter] >> Do not send it to the cloud, guys.

They'll cut you. if you got a a cluster of uh you know I think it it's about um I I've got a group where there a bunch of rich guys that are uh that are like you know crypto ogs that are hacking on this stuff. One guy I think bought four GB300s. It was like $2.5 million or something like that as a cluster but he's getting like uh 150 tokens a second using GLM >> local 5.3 like the brain and everything is right there next to you. It's right there. It's in his house, right? >> I'm so jealous.

>> Yeah. So, >> you know, I have a bunch of victims from the last decade who can't access their wallets if this guy wants to throw some ram at this [ __ ] dude. Like, >> I'm not kidding. >> Every time I see this, every time I hear about this, I'm like, "Wow, there's power right there." Like, >> it's right there. And, you know, it's funny because I I went down this path, right? Like I bought a um a Mac Studio in like before they even cancelled like earlier this year, right? Before they January, February 512. Um >> and and you know, it's it's the gen it's the M3 uh Ultra whatever with 512 gigs of RAM. Um but the Frontier models are just like that much better. It didn't make sense. And you know uh you have to

run like a a quantized version of most of them because it can't fully run like a lot of them are like 800 gigs or even one you know now like 1.6 terabytes of RAM. Um so yeah so so it just uh I don't know it it um didn't feel positive EV to go and buy these things. Um but I do think we are getting to the point now with like GLM you know GLM 5.4 four comes out, let's say, right? And it's like Fable 5.1 class. At that point, like I'm probably happy. I'm probably fine with that guy living in my house being as smart as they are. Um I don't know if it's worth like, you know, $2 million or whatever the [ __ ] it would

cost to to be able to run that locally, but like maybe it's probably not far off, right? Um, you know, uh, >> I mean, dude, I've just been falling back to the whatever, not chat GP and not Anthropic because I just I I'm just so annoyed with them nerfing me every second. >> Yeah. >> Like it's And it's even stuff that's like like I'm asking about Ledger. I'm asking about supply chains, but it knows that I'm investigating the Ledger hack, so it just nerfs me. But I'm not even asking about like I'm not even trying to be a hacker.

I don't know. >> Even rolling back models. I I was we were in Rocky Mountain National Park and I had Opus 5.5 getting me a ticket. They go on sale at a certain time and like get me this ticket. >> It It like wailed through the capture, a bunch of other things that it needed to do, but it wouldn't sign up for an account on the website for me. >> Yeah, dude. >> So, I had to drop to four I had to drop to 45. 45 signed up for the account, handed it back to 55, and 55 did the rest. >> I mean, maybe that's what Why are we doing this? What are we doing here? >> No, I look over and I'm like, >> yeah, but that's the thing is like every time I have to like look over and be like, "Okay, so now you're stuck because

you've decided this is cyber or whatever." But then I Yeah, I like force it to fall back. But then even sometimes you just get a different nerf message with the cyber stuff. It's so annoying. Like it's so I've just been like, well, if I'm going to be dealing with these shitty models anyways, might as well deal with one that's not like like I just go into it and I expect it. You know what I mean? >> But it's so pleasant to not have your workflows constantly sort of like nerfed and I have to like, you know, switch like my brain is in eight different places already when I have to go and like address the fact that it's being nerfed and adjust the models and stuff.

>> Yeah. Like you've already spent the time prompting it and like getting it going and and then you're like, "Oh, wait. It's not working." Yeah. I I mean >> because it'll decide five minutes in that it's a cyber task. >> Yes. Yeah. It's crazy. That's why like GLM 5.3 is fine. Like it's smart enough. Um and you know they have fast mode as well. Uh the fast mode stuff is is pretty cra like you know you you see these like kind of uh little indicators of what the world would be like in 3 months I guess or a month or whatever the [ __ ] it is. Um but like the there's uh there's two models that have like ultraast mode like um you know uh Astra 6 400 tokens a second like

it's so [ __ ] fast. I I did a test. I was like, I'm going to just get two agents um 5.5 and and Astra to run uh the same thing. Like just build like a quick little uh test. I've got like a bunch of of little like test projects that I'll give them. This thing did it in like three minutes. It was insane. >> Be almost real time soon. Like software will be almost real time where it's building the software for you as you're like navigating through it like a >> It was faster than I could reason about what it was doing. like it was literally ahead of my ability to like figure out what what was happening. It's crazy. So, um you know, like at some point you hit like a thousand tokens a second and it's thinking faster than you can prompt it,

right? Like it's it's crazy. So, >> good times. Um all right, next. Let's go to next story. Uh so XRP had a infinite mint bug. Um, and in fairness, >> wild, but XRP has been around forever. You can't be having infinite mint bugs in 2026. >> It turns out It turns out the taxi cab drivers don't understand safe math. >> Yeah. [ __ ] man. So, this is this is a decade old, right? And this is again this is where like very obviously AI, >> right?

>> 100%. Amazing. >> It just like if it it's Yeah. I mean it's and even if you said like it's not AI that found it, right? AI has allowed people to think about things in different ways. Even if this was a human that found this, right? It's going to be AI assisted in the sense of like go and look at all the places where there could be vulnerabilities and help me like parse through it so that I can like identify the part of the code where this could be. There's no way that this is like a 100% human work because otherwise we would have found it a decade ago if it wasn't if it wasn't buried. So,

>> but but there is this new level of lendiness where things got lendy pre AI. Yeah. >> And it's pre pre AI Lindy and that means nothing now, right? Balancer was probably the first instance of this. Something that had been around for years. Billions of dollars out the door. >> Agreed. >> Yeah. Sorry. It's wild. >> No, no, no, no. Like it's just like Yeah. How do you think about Lindy when all of your, you know, priors have been blown up? >> Yep. Super intelligence, bro. >> Yeah. [laughter] >> So, so, so Taye, I'm I'm curious your take on this because there was the the there was this bug. It was found. They paid a 250k bounty.

>> Yep. >> So, it wasn't like they were like, "Thanks, go [ __ ] yourself." Right? Like, they paid a 250k bounty. Um, it's not clear necessarily uh that like there was any attempt to like exploit this or whatever, but basically a bunch of people including Zach XBT were like, "You [ __ ] retards. You only paid 250k. You should have paid 2.5 billion." >> Way more. Yeah. >> Whatever. Right. Like if you have a bug bounty and the bug bounty is like, "We'll pay you 250k. That's our max bug bounty, right?" Um, you know, >> it's not clear to me. Let's say it was 2 million, right? Let's say it was 20 million. Like, it's still positive EV

for you to steal the money like >> Yep. >> in a vacuum. >> Yeah. >> Right. Like, this is an infinite mint bug. There's so many vectors. You could you you know, you could mint $21 million worth of XRP and probably exploit it. no one would ever know because there's just a like >> so many places where you could wash that money and and and it wouldn't even be noticed, right? You could probably set up a bot to like print you a million dollars a week and no one would notice and you like drop it into different exchanges and like it's just never going to get picked up, right? So, it's not clear to me that you can say 250k is not enough, but 2 million would have been like,

>> yes, >> how do you reason? Okay, so because I think about this a lot. So the first thing to remember is that crypto and crypto bug bounties are fundamentally different beasts than sort of the regular world and security and bug bounties. 250k for reference is also like at the at the top end of like Google's bug bounty program. And there was like a really amazing bug bounty that someone got from Google where I think a full remote code execution series in Chrome. Meaning you could basically like have you could go and it's like a good one. They haven't they haven't disclosed exactly how it

works, but like they went to town. They found an amazing vulnerability in Chrome that got full remote execution capabilities, right? And they got paid 250K. When you look at these two things side by side, 250k just [ __ ] hacked the Ledger website, man. Like it would have been way >> so now and then there's also an argument to be made that like if 250K is the max payout and it's disclosed and it's been like that then you should as the company you should sort of stick with that. you shouldn't randomly come up with a bigger bounty just because someone found a bigger bug because then it's like well you don't actually have a budget or a bug bounty program, right? You're just

it's very arbitrary. >> If critical the most critical disclosure is 250k that's what it's always been. >> That's what you pay. >> This is this is another question. Sorry. So has has this 250k bug bounty existed since like 1982 for for XRP? the same and they just haven't updated it because that would go back to the like we have too much money now, right? Like XRP used to be worth like >> it's possible >> $100 million totally possible, >> right? >> And you know, we I've dealt with this because I've dealt with teams that have out of sort of let's say out of date bug bounties, right? like they were operating as a little team and then they you know then they raised money did an ICO had you know let's say 100 million

TBL and then they got disclosure but their max bug bounty payout like on paper was 5K or like even like a mug right what do you do in that situation and it's tough because again you don't want to there's a problem with doing everything just like completely arbitrarily right because it goes both ways Right. If you have a max payoff, >> now you've got like, you know, someone's trying to >> Yeah. So, but there's creative ways there's creative ways to reward people without, you know, just completely going into arbitrary land. If they if the if the situation is truly special, you can treat them special on non. Anyways, the other thing I just want to say is that 250k is also a lot of money for all

intents and purposes. It's only not a lot of money when you like look at how much the chain is protecting or you look at the treasury of XRP. But >> Google Google's worth [ __ ] trillions of dollars, right? And they paid 250k right now. You know, >> exactly >> what what how if if someone had exploited that um remote execution bug in Chrome like and like you know and mass right across like the internet or whatever. how much money in the market cap of Google would be, you know, evaporated, right? Like a hundred billion dollars, a billion. Like, so it's still, you know, it's weird that

like suddenly there's this pressure of, oh, you're a crypto company and we could have done this thing and exploited it for a billion dollars or 10 billion or whatever, right? therefore you owe us $10 million when Google if they got owned would you know lose billions of dollars in market cap and and you know shareholders would be harmed and and and they still are paying out 250k it feels like a double standard a little bit right like >> it does and it also the other thing like when you look at it from a company's perspective right if you pay if your bug bounty is basically like limitless right or if it's scoped to like the cost that it's going to cost you, right? Like to

your market cap or whatever, the long-term impact or like how bug bounties sort of pan out is that eventually like no companies can afford this [ __ ] >> right? And then it actually makes the whole sort of security apparatus and bug bounty programs. It sort of like diminishes their value because you know it's actually it's actually more ideal for a wide variety of companies to have a wide variety of programs rather than just Google or just XRP, right? You want there to be a variety of places for different like levels of people to hunt and disclose. You also just want people to be able to level up over time, right?

A mug is an appropriate like a mug or a t-shirt is a totally appropriate reward for a brand new company. Right. >> Right. >> Like it it is um and also the value for security researchers to be rewarded for hunting these bugs is also something that I think we don't talk about enough. So for example, what how much money do you need to incentivize someone who's capable of finding bugs, right? How much money do you need to incentivize that person to hunt your bugs? Ra not rather than exploiting, but like literally dedicate their energy to finding your bugs.

Right. >> Right. So, one way to look at it is like it's a competitive market. People are more likely to look at Google because there's a max payout of 250K. However, they're also morely like likely to look at any program that's fair that has like a variety of tiers, right? Because if you're going to go spend say two days or two weeks or two years hunting, >> right? You don't want you don't want to have to only find the 250k bug to get paid anything to to you know find a 5k bug or a 10k or whatever. >> Exactly. Because you can find multiple like 10k bug 10 and Google's really good for example at at paying out every single release they're paying out you know and they're very fair about it. Um and so yeah there's just like so many

different ways to look at this. I think that in this case with XRP, I understand especially the fact that the XRP Foundation, those guys are they're all like multi-billionaires at this point. Why 250K seems to be like an absurd number. However, that's their number and that's, you know, if you don't like that number, you can [ __ ] about like you can, if you're a security researcher, go [ __ ] at them. try to get them to to do the number, but they do have a program they did pay out, which is more to say than, you know, a lot of programs in this space.

>> But yeah, it's it's not clear. It's not clear that like if that had been a million dollars or 5 million or 20 million or whatever, right? That this would have necessarily been found faster, right? Like to your point is enough that like >> that's a big payout for a security researcher, you know? Like I know guys who were security researchers and like a 10k >> thing was like their month, >> you know, they're like, "All right, we're going to eat for for [laughter] the rest of the month." >> Also, don't forget like you're not when you're 250k like >> you know that's a year, two years, three years even, right?

>> Yeah. >> Of not going to an office, of doing whatever the hell you want, of funding more. You know what I mean? Like it's a decent reward. Um, I also think that like I think one thing that that programs do need to reexamine. So for the Google one recently, right, the team disclosed, the people who found it disclosed that they basically was like three or four guys. They hunted for like six days straight um and they spent 40k on compute. >> Wow. >> Okay. Okay, so >> that that is shifting right >> that's interesting to me and I think it's really interesting to look at the bug that they found which was a really good again rce right but what's the total cost like what's just the baseline cost for that right in

a in a totally objective resources how how much are those guys getting paid what's their time worth right number one number two you have a hard number 40k on the compute >> um and then to pick like you have to have a little bit of incentive just to pick we're going to spend this six days on you rather than the other person. >> Yeah. >> I think there is a much more interesting math problem to say is that 250k objectively worth it, >> right? Because if they're going to do this again, would they pick the Google 250k, >> right? Versus 500k >> and you know you're going to and like I mean there there's a whole bunch of factors here, right? Like you have to think like how likely is it that we >> and that's the other thing is like so

you get to the end like how much are you willing to spend in order to >> and you found nothing right like oh that's not that's all >> that's so much more interesting to me like I I think that the math is going to we're going to have to math and maybe it comes in the form of like you know the guys that are doing this sorts of work they get subsidies right >> from on the compute or >> I don't know there's all sorts of different things that you can to, you know, make it all sort of pan out in the end and keep people hunting. But I think that that's I think like the Google situation and when you're talking about like compute and like really objective how do we expend resources to find really valuable vulnerabilities. I think that's a way more interesting

conversation than the um than the XRP one where you're basically saying like they have a billion what they have hundred billion dollars they're greedy fox >> pay out more like okay sure yes like >> but Google has also no >> so like you know like are they greedy like >> it doesn't you know it doesn't Google's probably got some crypto as well. All right um let's go let's go to our next story. Um so you know this is this is uh interesting to me for a bunch of reasons right so stocknet is saying um we may become an L1 and and I think that this is the path that like in the limit I I think this is

where we end up the whole L2 thing you know uh Ethereum sort of said L2s were a mistake to some extent right? Um, you know, uh, like it only makes sense if you're an L2 that's like not generalized, that's like specific purpose or app chains or whatever. Even that honestly feels like a bit of a copout. Like I think that it just it maybe doesn't make sense at all. Um, and maybe we end up with like you just it makes sense if you're a chain, right? Um and and so you know we might be back to like the L1 proliferation thesis. I just think that's what's going to happen.

Like you know the the the uh the premium that is applied. The problem is right that there was a period of time where you could start in L2 and it was much easier and you might not have the L1 premium but you had like 50% of it right. That's not the case because you know there were too many L2s and now it's like maybe you have like 5% of it and so there's a very obvious like 20x play if you can get to some level of credibility as an L1 that the numbers just look better right as an L1 as an independent chain. Um, so yeah, stocknet's like, h, let's frontr run

this and and let's, you know, especially your stocknet. You're looking at near is an L1. You are an L2. You think that your math is pretty good, too, right? You got some privacy, you got some AI, you got some chops, right? Um, you know, your founder founded Zcash. like there's a whole bunch of things where you know like you're like why are these guys worth 50x us or whatever the number is right uh 20x us um and it's going to you know if you believe you have a credible path to being an L1 I think that's just what's going to happen right so um stockware has said uh a we're fully quantum resistant by 2027 we think we'll beat Ethereum now

like there is an open question of like can anyone beat anyone at anything anymore when clankers can clank faster than you can think, right? Like maybe everyone's quantum resistant by the end of this year if it's become super easy, right? Um obviously there's coordination problems in Ethereum. Um you know that you that you've got to work through. Um but that hasn't necessarily been like the limiting factor for uh change in Ethereum for a while. I would argue it's been it's been maybe as much technical as it has been coordination. Um and so if the technical constraints are gone, you can probably just do things much faster. So Starknet is saying like if we were in L1, we'd be quantum resistant.

Uh and you know Justin Drake is scaring everyone so it just I don't know like you go ah maybe that makes sense, right? Um, especially when the market then pumps the [ __ ] out of uh the token when they when they, you know, talk about this stuff, right? Like a lot of people are going to be looking around going like, "Yeah, I want to get me some of that, too." So, >> well, okay, Austin, what's your take? What do you think? >> Well, I'll just say this. Do you think they should be an L1? >> I think they could probably make more money if they become an L1, but I don't think it's the best thing for the ecosystem if they become an L1. Uh but >> I I think we all should be quantum resistant by 2027. I think we should

have an arms race to get quantum resistance, >> right? >> And I I think that like why do you think >> people are going too slow? >> Why why is it an issue? Uh what's the issue for the ecosystem if um if stocknet becomes an L1? >> I guess less L2 block space. I don't know. like less. >> Why do we care about that? Like like genuinely, right? Like why does that even like we have enough block space in Ethereum now >> and we're g we're only going to get more, right? Like the the the >> there's well it's sort of going out the window. So historically like one of the advantages of like being an L2 over an

L1 was I guess the assumption it doesn't always hold true but like that you're basically going to be incredibly compatible with EVM with Ethereum >> which was a lie. >> So that was a lie first of all right >> but you can also you can do the same thing >> is not compatible with the L1. It's a [ __ ] completely different scheme, >> but it doesn't have to do all the consensus work. But you we the question was what is the ecosystem other hard work, right? Right.

>> Some of it by the way some of it is is >> some of it's on like the userf facing integration land where >> there [snorts] was a p like okay so if you didn't change anything right you're launching arbitum or whatever if you didn't change anything versus ethereum you can get the integration in the wallets on the APIs in etherscan relatively easily because it's basically the same you're changing >> you needed a bunch of infra like it was all a lie right so >> but it was like for example when when metamask when we were working on Like if you want to add arbitum, you want to add optimism, it's literally you just change the chain ID. Everything else is the same >> as a wallet for sure as a wallet for a user.

>> Whereas adding Salana was like, "All right, we got to start from square one on all the libraries like everything's different, etc., etc." Now, the problem [clears throat] is that over time >> the L2s evolve >> and then they add more functionality or different functionality. I remember the first one was like, "Oh, shoot. All of the L2s need to have like their own custom gas parameters." That was the first sign that we were going to be [ __ ] >> right? >> Y >> because now it's not just changing RPC. Now you're like, "Okay, how does the gas work?

>> What are the transaction types?" >> Of course. And then they start optimizing >> even just the gas pricing, right? It's like >> um the APIs and now you're talking about proprietary APIs on and on and on, right? So on the one hand, the L2s have an advantage in that sense, right? Like it's just more familiar. The interoperability can help with the network effects, especially early on. Longterm, not so much. It also doesn't guarantee the integrations. It doesn't it doesn't guarantee the the usability. Doesn't guarantee even like the consensus stuff, right? I don't know. It's kind of a restraining factor, right? Like the reason why the L2s like it's like okay we're going to try to like you like you're self

constrained. >> Yes. >> Compatibility is hard right? So you you're like trying to play in this compatibility window right you can't really innovate. You're trying to remain EVM equivalent or compatible or >> comable at least >> words you want to throw at it right like and and you know so you've got this like range of things you can do. Um, meanwhile, Ethereum has woken up and said, "Uh, actually, [ __ ] all of you guys. We're going to like increase our own block space and make kind of the point of your entire existence like moot."

>> Sure. >> You know, like the point of the point of uh L2s was to have more block space, cheaper blocks, and like more compute, right? You could do bigger transactions, you could do cheaper transactions, you could do all these things. Ethereum is going to do that. It's just it just is. It's in the process of doing it. It's going to have like infinite block space. You're going to have bigger blocks, thicker blocks, wider blocks, deeper blocks [laughter] every dimension of blocks that could be heavier blocks, right? [laughter] Like we always tried that. Like we need heavier Ethereum blocks. Um, so, so like I just I think like you know the the most equivalent thing to Ethereum is the [ __ ] Ethereum chain. Like don't go

and build your own weird fork of it, right? Like you want like EVM equivalence or or compatibility like [ __ ] build the thing on Ethereum, man. like it just like that like you know we didn't have the technology in 2019 2020 and we built way too much [ __ ] and we ran out of block space and so we went on this weird side quest to try and solve it and we learned a bunch of things and you know whatever made some money lost some money cool but like it's 2026 we have clankers Ethereum is just not going to need L2s it just won't >> I still use L2s every day but you Well, it

>> like like >> need an L2 in in 2027 like realistically. >> We'll see. I I don't know if Ethereum will ever get as fast as like consumer grade apps. And when you want to make like a instant like subsecond transaction, we never may never get that from Ethereum and it may be expensive to do that, but it's like subent subsecond transactions on L2s. That makes so much sense for consumerf facing apps and then have all of those settle to Ethereum. Like I'm still >> I don't know. I'm still bullish on some L2s.

>> Okay. All right. >> All right. Yeah. But okay. So I guess maybe this is the problem with Starknet, right? Is like that's actually not why they're talking about being an L1. They're talking about me and L1 because they want to do like some crazy nerdy [ __ ] for quantum and AI and Starks and Snarks and whatever, right? Like the most nerdiest stuff. Okay, if you guys want to do that, I applaud you. If you want to nerd out and have this network that is nerd network, okay, go for it. And also like share your learnings, share your research, hire people, pay those people, have have bug bounties for people, right? Like I totally 100% on board with this.

Don't expect anyone to use your network necessarily, right? Like I don't I just I don't know why as as a regular consumer of crypto and change, >> it's a bunker, man. It's a bunker. When we're all fleeing, we'll flee to that. >> [laughter] >> What do you guys use darknet for right now? It's probably D5, right? >> I think I claimed my I claimed my airdrop on >> Yeah, me too. I claimed my airdrop. I'll be honest. I claim my airrop. I tested X back in the day. DYDX was a thing. Um, you know, I think one thing that we're seeing, uh, is, um, you know, chains are realizing that they can't rely on, at

least, you know, non- Ethereum chains. Ethereum still, uh, is able to do this, right? And Salana probably, but like most chains are realizing that like they need to be a vertically integrated thing, including apps, you know, DYX and Starknet is such a good example, right? Um, so, you know, um, yeah. So you went to Starket to use Dydx? >> Yes. Yeah. Yeah. I mean they were my competitor actually. Then what happened? Check them out. Well, I mean then they left. Dydx left. And when did >> and DYDX left? Because there was nothing else. There's no other reason.

>> I don't know, man. Like why the [ __ ] did people do anything? >> I'm guessing it's because there's no one there. [clears throat] >> You have to have some sort of ecosystem because >> Okay. So like it's Yeah, it's the network. It's just classic network effects, right? having DYDX on Sarknet is going to bring a certain amount of people over. >> Yeah, >> because they want to use this thing, because it's better, whatever. However, there have to be like other apps and other reasons because then they all build off of each other. >> I mean, look at me. >> Just >> look at me, right? Like Mega E is the like >> quintessential example of this, right?

They curated >> three cohorts of like 10 teams maybe, right? teams to build consumer apps on this like real time chain and and and like literally 95% of those teams absolutely wrecked them like abandoned the chain as soon as they got enough you know traction started making their own chains like all kinds of crazy [ __ ] right and and you know like as a chain that's trying to build its own ecosystem >> if you're vertically integrated from like you know you're Weirdly in this position, especially for the L2s, right?

Where like Ethereum is the bottom layer. You can't own that, right? So, you can't be fully vertically integrated because Ethereum is your basement, right? But above the basement, you have this whole house up until like the roof where like there's a party going on and you have no control over it. And then they're like, "Actually, let's go down the street. There's a cool club. Like, see you later." And you're left with a [ __ ] empty house that's trashed. And you're like, "Ah, fuck." Like what do we do here? Right. >> You are wait you become an L1 that's quantum resistant.

>> Yes. But at least then you're like you know we'll build our own >> you build your own and like do like you know DYDX is the example of this right? Like they left the chain they went to Cosmos right and Starknet is now like [ __ ] it we'll build our own perplex. >> Oh >> which like fine cool like build your own per deck. Like how is that? At least then it's not going to leave. Like at least they [laughter] you can close the doors and the party will never stop, right? It might be a shitty party, but like the partygoers are trapped in the house with you, right? So, you know, uh >> you guys remember Argent? Argent was a cool wallet that did good social recovery and then they built on Starknet, right? Is that where Argent

went? >> And so account extraction had to have been part of their secret. Like every L2 needs to have a secret move or a secret weapon. secret weapon had to be partially accounted. >> The reason why Arjun went to Starknet was because when they were on Ethereum mainet, right, and when you set up a wallet, it cost them they burnt so much money in gas, man. Like they it cost >> I remember looking at that$30 wallet there was and the VCs that >> I was looking at because was the hottest thing as I was getting ready to raise the next round >> and I'm stuff like you couldn't sign with the wall. I remember talking to those guys.

There was something with the wallet where like wallet signatures weren't respected across apps. So even if you have the smart contract wallet, like apps still all had to I mean you probably >> they were too early. >> The analysis the analysis I did on Argent totally blackfilled me on smart contract wallets because it >> because and this is why we ended up joining MetaMask because I was like I think they've got it right. For all the problems that I had with MetaMask, I was like, they they actually from day one, the vision, the strategy, and their understanding of like retail behavior and like nerdy cryptography things, like they actually nailed it.

Interoperability is king. People are going to move faster than you can ever imagine. And every time you limit their ability to do whatever they want, anytime it's not even a it's not even like an actual lost money experience or like unable to access experience, even the perception that it might be, right? And with smart contract wallets, there were so many questions that basically you were you were locked into this little ecosystem of things that you knew worked and there was no way that a team there's no way that a team can can keep up, right? I think a few things are changing >> literally Infinex like this is what happened to us this thing and we're like oh it's fine we'll just integrate all of the things and you just can't there's no

way >> you just can't you can't and so it's like you have to you have to unlock and the second thing you unlock anyone and that's the thing the biggest problem with MetaMask and its biggest success right was that it was so unopinionated it was like viciously un opinionated about everything it was like we are not even going to add tokens we're going to allow people to have their own tokens but we're not My favorite story, Metavas didn't have Tether as a token, as a default token in the wallet for years, right? Worst thing but also best thing because it forced them to create this wallet that was fully accessible anywhere and the priority was like expand the ability for other people to like integrate and do things with it.

>> All right, smart contract wallets though. Okay, I think there I think another comeback will be smart contract wallets. Uh the R the R1 curve first of all is a lot cheaper on Ethereum. That's nerd [ __ ] But basically like pass keys can sign on smart contract wallets. Yeah. Gas with 437 and other account abstraction things can be sponsored. Yes. And the third thing and I think the biggest thing is that AI is the new UI. >> Instead of will the wallet integrate with all these different DAPs, it's going to happen at like the chain level. You will go to your wallet, you will express your intent and it will go do the things it needs to do. You don't need to go do send calls to some website and it signs things. You express your intent to your smart contract wallet.

You sign with a pass key and it does goes and does the stuff. >> Well, yeah. And if the AI gets good enough, right, it will, you know, >> if the AI gets good enough, it pace the frontier. Like we're going to have super intelligence next year >> because the biggest hurdle that you're going to need to overcome, right, is like um so right now like the reason we have UIs, the reason we have DAPs, the reason we have wallets, the reason we have all this stuff, right, is to uh limit the risk as much as possible. And in crypto, crypto is different because we actually want to enable people to take a huge amount of risk. But like you don't want to just press a button and then have your money just like magically float away, right? Like that's a bad experience.

>> Like clankers are going to be another attack vector that diabolical. >> It's going to be Yeah. But at some point the clankers are going to get good enough to at least like have basic sort of like let's call them like they're going to know how to for example like stimulate. Yeah. >> And right now like when you have like in Metamas, right, like there are we have a ton of indicators in our wallets, right, that kind of like try to hint like, yo, this might be bad. But the one thing that the AI can do like way easier and way better and way more robustly is actually like test the flow beforehand, right? And do all these things beforehand and have a better understanding beforehand. So I do agree that it'll it'll just be a different interaction style. What I don't

necessarily agree with is I mean, okay. Yeah, I agree with all that. Actually, I just don't necessarily agree that it'll be a smart contract wallet. I guess like like a contract wallet thing. It'll be it'll be something though. I agree with that. >> All right, let's let's close out here. Uh before we close out, uh one minor point. Uh we talked last week after Blast shut down, like when Blur shut down, and it was this week. Um, so, uh, end of an era there. Um, yeah. I mean, I don't even know what else to add to that, >> dude. Shout out. I remember using Blur.

You could sweep the floor. It was just likeoop and you get 15 NFTts. Now I have 15 NFTs that go to zero instead of just [laughter] one. >> Good job, Austin. >> Thank you. >> All right. Thank you. Thank you everyone for joining us um on this episode [music] of Uneasy Money. Remember, what happens on chain never stays on chain. We will be back next week. Nothing you hear on Uneasy Money is financial advice. We're just three builders talking about what's happening on chain and we want you to always do your own research before aping in. You can find all our disclosures at unchainedcrypto.com/unemoney.

[music] [music]