Physical and Digital protection for crypto entrepreneurs

Transcript

Hello. Hello. Uh good morning everyone. Thanks for making it uh on time and uh um my name is Ourel. Um I'm from Zango and I'm here to talk about a very important topic, something that we should talk more about, which is uh digital and physical security and protection for crypto entrepreneurs and builders, which I assume we in this conference are um uh all are. Um so what I want to talk about is really how indeed anyone involved in this industry um can become a target. How it happens and what when what can we do about it when you are becoming a a targeted u

target uh for um for an attack whether this attack is uh digital or physical. Uh just quick word about uh who we are and uh why we're doing this talk. Uh Zango is a crypto wallet for individuals and businesses. We've been around for a few years. We're one of the leading uh non-custo crypto wallet. Uh what makes us unique. It's uh well very easy to summarize. Over 2 million users, zero crypto wallet ever hacked. No account takeover, no SIM swap, no fishing, not all of these things. Um uh ultimate security built on multi-party computation with delightful user experience. Uh and if you want to try

out you will see by yourself understand why um this is why it's so secure. Obviously because of what we do we are exposed to all sorts of stories. We monitor very closely what is happening uh in uh in security. So let's start with what does it mean to be a target when you are a crypto entrepreneur or a builder in that industry. Let's start with just some live examples and uh I'm sorry if I'm going to scare you a little bit but um the point of this presentation is to raise awareness and to raise the questions but more importantly to uh trigger some sort of thought process for actions. So a few examples um so here we had in France um the uh co-founder of of a crypto wallet

called Ledger hardware wallet which has been kidnapped um his wife also was kidnapped he was mutilated thank god he was rescued um but that happened here in this country in the country we are in today um another example US tourist um a lot of money over $100,000 stolen by ordering a fake Uber uh in uh in London. So, not far from not far from here. Obviously, this is starting to raise a lot of worries in the community. Entrepreneurs are starting to get worried and wondering what they should do about it. Um a crypto founder, for example, in Uganda uh was forced to send half a million

dollars at gunpoint. And obviously, when you are at gunpoint, anything you know about security and crypto security doesn't matter anymore. you will want to save your life. In South Korea, this is a different type of attack. This time has been performed by the girlfriend of someone who stole him half a million dollar of his Bitcoin at home. That's a very unusual typical of physical attack. Um, another type of attack that happens also is impersonation. Uh, but not the one that you expect. Um, someone has received in that case a a fake package of a hardware wallet, in that case a ledger, but that could be any hardware wallet. Uh, warning him that there was something that happened with his wallet

and that he should upgrade to a new uh to a new device. And as he did did so, he um he lost his cryptocurrency. This is, and I'm sure you've seen this footage. It was running on X for a few days. a live uh kidnapping that happened in the streets of Paris where the daughter of an entrepreneur well-known entrepreneur in France has been uh was nearly kidnapped and thank god that did not happen. Um what that means is that you may be the target but not only you people around you may become also targets. Um here is another case that is very very curious. a crypto trader uh in New York was kidnapped and tortured for weeks uh to get his Bitcoin private key. And uh

the the interesting fact is that as the investigation went on, things get got really really weird uh because it was not clear if it was kidnapping or the other person was complicit into it. What that means, and that's why I'm editing this story, is that sometimes you read things in the news, you should be wary worry about the truth until the truth is found out. Um you have also something that is very common not talked about is shoulder surfing. Shoulder surfing is whenever you are in a public place, it could be a conference, a bar on the street and you are going to write your pin code because um face ID doesn't work, touch ID doesn't f work and you have people who are going to observe you and do this pin code and then they steal your phone and from there they can do anything that

they want. Unlocking your iPhone, unlocking everything that you have on your phone, including obviously uh your crypto. that leads some uh people to do really extreme uh to get to extreme measures like this Bitcoin family who have split their Bitcoin passwords and and code and parallel keys in on metal plates that were distributed all around the world. I'm not sure it will um save them uh or it doesn't reduce all the risk but that's what it leads people from doing. Uh sorry about that. Um it should show something different for s for for some reason there is this RB.

This slide is basically showing that the attacks can happen everywhere or anywhere. The first picture happened in France. The second picture happened in the UK. The third one happened in the US. This is really a global phenomenon. A global phenomenon that is raising. And if you thought those were isolated cases, there is a a broad list of physical attacks that have happened especially accelerated during the past 12 months. What you should know is that we are all targets. All of you here in that room, everyone here in this conference, anyone involved in that industry, we are potentially all targets. Why? Because from the moment you have some cryptocurrency and that you are, and we're going to talk about

it, public about it. You are making yourself a target. The question is, are you a low value target, medium value target, or high value target? Question number one. Question number two, are you an a target that can be actioned upon and at which range? The important things is to never forget that potentially you are a target. So how do you become a target? How do one person working in crypto or involved in that industry can become a target? Well, the first one is by being public about it.

saying that you own crypto or showing that you own crypto and public signs whether they are physical or digital stating that you are uh it's like you know you're displaying a sign you know kidnap me I have some I have some money on me right it's not always it's obviously not this accurate but uh being public is a first sign that you give to the world about the possibility of becoming a target the second one is being obviously successful the more you are successful uccessful the more you are a higher value target. Being successful doesn't mean that you are rich or rich yet. It means that you are publicly uh I would say uh you are publicly made a celebrity or on the way to become a

celebrity and that's sometimes enough to uh to become a target. The last one is the most important is making mistakes and it is not talked about often is that the um source of those attacks are sometime many times the uh actually entrepreneurs or the builders themselves by the mistakes they made. I will give you some examples. You have three types of attacks. Digital attacks. So anything that can happen through your phone through your computer. Uh a typical example of that would be a fishing uh a fishing scam or a fake download of a software that you believe that you know and that will take over your computer. A physical attack, so kidnapping, gunpoint, etc., etc. And self-sabotage, so meaning you yourself are doing

something some harm to yourself by, for example, thinking you're doing something safe to protect your private key or protect your security. Uh and you're going to realize you screw up. An example of that was what happened with Last Pass when the password manager was taken over and people lost their crypto thinking they were using a a secure software. Let's do some autopsy about potential attacks. This is an two examples. Those are real examples, right? This is someone who's coming at this conference saying days in advance, I'm coming to this conference. You can meet me here. There is even a link to book a meeting with him, right? And he's saying that he's coming at the conference. Everything is there. You know his name, you know when he's available. This is a attack served on a

gold plate for someone who would like to target. Doesn't say will, but we would like to target this person called Kevin. Won't name him of course. Uh the second one is a public case. So I'm not hiding it because it was uh it was live on X. It was it went viral someone and I'm sure you've heard that stories. people are getting approached by journalists uh by fake investors, impersonators and they ask them to download a fake zoom software uh which takes over the computer and drains completely their wallet and the wallet doesn't matter how safe it is if it's on the computer uh it can be taken over and drained. Um this is another example something that happens quite common impersonation of services that you use regularly for example do you sign here you think you're going to sign a document sounds

familiar an NDA stock option plan whatever and just by clicking on that link you have installed a malware on your computer so now that we're aware that we all can become targets and that all these uh things can happen in life in real life and we're not talking about sci-fi and they're happening happening more and more what do we do about it so first question. Does anyone have $6.5 million to spend? Raise your hand. You don't. You do. Okay. All right. Well, good for you. You're target. Uh, that's Anyone knows what this money this amount is? I didn't put it. It's not the value of my portfolio. This is the amount of money Coinbase spend per year to for the protection of their CEO, right? So, we're talking about physical protection,

digital protection. Uh, not everyone can afford to do that. So, so what can you do about it? What are the six commandments for your protection? The first one, and I'm going to be very blunt and direct because we don't have too much time. I have four minutes left. I believe the first one is to shut up. And I'm sorry for being extremely direct about it. Obviously, you can apply that with a degree for all these commandments. But the more you are public about what you have, what you own, when you claim something on Twitter or on LinkedIn and you post those screenshots of your portfolio or even your ENS which links to your portfolio, you are making yourself a target. Uh you should be moderately paranoid. Be very very very paranoid about direct messages about clicks and links. anything that

you receive via email via any channel should think always twice especially when links are shortcut and you don't really know what what's behind it uh be humble uh don't assume that you know anything about security you know about security and we work in that industry 24/7 there are so many loopholes and so many ways you can lose your attention and I've met in this conference so many people told me look I've lost x amount of money in crypto I thought I knew what I was doing they had no idea what they were doing be humble that means to continuously, always questioning yourself and improving and learning. Secure your digital life.

Upgrade your password management, firewall, anti-malware. Don't hesitate. Invest in that. Secure your crypto life. Securing your crypto life doesn't mean having a hardware wallet. That's a myth. A hardware wallet is only a protection for your private key. It's not a protection for yourself, right? You don't protect yourself by protecting a private key. You protect yourself by protecting yourself and the people around you. Um, we'll talk about that. Secure your physical life, not just your digital life. Think about things like cams at home, alarm system, self-defense, etc. Paper jet, whatever you can use to potentially defend yourself. Um, so how should you react when an attack happens? Because

inevitably something will happen. Maybe sometimes something not not bad, but could be could be worse. The first one is don't panic. if you can. It's easy to say, but don't panic. You need to stay calm and you need to kind of be able to stay calm to navigate the crisis because you have very little time to react. The second one, second tip is to secure yourself. Make sure you are in a secure location. Make sure that your peers are in a secure location. You need to worry about that immediately. Notify immediately trusted trusted peers, your chief security officer or anyone around you that understand about security.

Don't stay alone. Contact authorities. There are many ways to do it, usually through uh the local police. And be extremely careful when you call for public help because as you do that, you are actually sending a warning to the attacker that they can impersonate you, impersonate help services to help you and they will scam you and drain you even more. Uh so what else could be done for crypto owners? Well, not necessarily anything that you can do by yourself. State level deterrence is very important. France for example this year took very very drastic measures to better cryp protect crypto owners and entrepreneurs uh uh legislation speed of intervention international collaboration with different policies uh

around the world with a swift justice uh system not every country has passed the speed but France has because this year has been really uh bad in this country uh continuously monitor continuously learn always learn about crypto security and the risk uh you have um great accounts like B security oz expert that will u regularly update what's happening and give you some interesting tips how to deal about it. Rethink cryptoc setup. Rethink it completely. Forget about the myth that a hardware wallet alone will save you. It will not save you. You need to rethink it properly. What does that mean? Decentralize. Decentralized means don't uh put your crypto uh and diversify crypto your cryptocurrencies

in different custody type of solution multi-IG MPC uh you know MPC with smart locks and and time locks that will protect you if you have a physical attack diversify the risk type put on some custodial system non-custodial system not everything in one basket and diversify the access structure don't be necessarily the only one signing your transaction try to have a scheme where you can for example We allow that in Zango to have multiple people to sign a transaction so that you're not alone depending on that. Um I believe that I still have five more minutes. Is that correct? Okay, good. Um so um sorry I'm not sure why this slide is here. It should be uh there before but you know they just illustrate what happened in

France where um the ministers agreed to upgrade the policies to defend uh entrepreneurs after a number of kidnapping that has happened in uh the territory. uh obviously you know the most important uh tip that I could give you today is to stay safe. I want to come back on two uh on on three ideas. We are all targets. We don't know it yet but we are right the moment we are involved in that industry. The moment we own crypto we are potentially targets. Doesn't mean that we will be targeted but we are potentially. Second is whatever you know about security you need to rethink about it completely. And that means that you need to be curious about security need to learn about it. It's not an option.

It's part of the job and it's part of all our job. Whatever you do in crypto in addition to that you need to be aware of the basics of security which involves different um different measure that you can be aware of whether this is in your digital life in your physical life. Um uh finally and that's my hope with that presentation is I hope that you get out of this room with more questions than answers. uh and also with the desire to warn people about about it around you. I think this is topic that is so uh important and not talked enough it's nearly taboo. Uh it's not the happiest news uh to share about. We would would

much prefer to talk about all-time highs and uh god knows what else in the US and regulation and uh you know bitcoin reserve and god knows what else. But this is important. The more this industry is going to grow, the more we will need to care for our security, our self security. And I repeat, it's not about protecting the private keys. It's about protecting yourself. This is super important. Whether you choose the solutions that make it possible for example like Zango which protects you against cases of physical attacks or even cases of death or even cases of device theft that you have the proper mechanisms and there are options on the market to allow yourself to be protected against all the cases the things of life that makes it possible for you to lose

stuff or get attacked. Uh I'm going to stop here. Maybe some questions uh in the room. We might have like maybe one one or two minute three minutes. So if anyone wants to raise has a question about what I said or what I haven't said yet. No questions. Everyone feel safe. Oh, someone has a question there. Go ahead.

Can you elaborate on that? You're talking about the physical community. Okay. So, but with your your security your your community protects you basically you're saying interesting. All right. Never heard about that. That's the first uh interesting initiative. Uh just I have a question for you. How many people feel safe in that conference today? Raise your hand. Right now I have a second question for you. How many feel safe in this city outside of this conference?

Well, I think you have to ask yourself more questions. Uh I think this conference is well well secured. Okay. Obviously you've seen the gates and everything. I think the moment you are not in a protected area, the juries are there. And while we can feel safe, remember we are all targets, potentially all targets, and we should be uh always careful about our surroundings. The moment we are not in a protected area or in a protected community, um I don't know if there is any more question, but if not, oh yes, there's a question here. What do you recommend?

I like the ideal. What's your recommendation? So, so we wrote about that. The problem with fake wallets is that attackers knows they exist. If you are a target, it means that it's already too late. They already know you own something. And if you have a fake wallet, that won't deter them. They will know you have a real wallet. So, while the appearance may look like you're good and you're safe because the wallet is indeed fake and there's nothing into it, normally if you become a target, the attacker will know that you own something. And trust me, at gunpoint, you will give everything fake

or not. So, so it's an interesting idea. I don't think it's good enough for protection. I think it's good for privacy. I think it's good for example, you know, minor cases when you go through an airport, for example. I'm not sure it's a perfect solution in terms of diversification. What I meant is that you should look at different wallet systems, not just private key based wallets which are single factor bas based on private key. For example, multi-party computation wallet which is one we we operate or multisig wallets or smart contract wallets which are diversifying the risk structure and the access structure to to how you access the cryptocurrency. And for example in Zango we have something called secure

vaults where you can put an amount of crypto in there and you cannot move it no matter what even yourself and you have a time lock that protects it against you for example you can say this week I'm going to be in can I'm going to put it there for that period not to move my cryptocurrency I'm not planning to trade anyway uh so I think you need to think about like looking at all the other options that are on the market and of course understanding them understand the risk that they have also so that you can be better protected Do you think that having time? I think it's a good option. I I I don't say that it's the only one. Union security nothing is 100% but I think it's a good option. Uh I know we out of time and I see there are questions. I'm

staying around. If you want to ask me questions, if you want to learn more about Zango, you have the URL here, zeno.com. Thank you very much for your attention. [Applause]