Smart Contract Security and On-Chain Fraud Prevention with AI

Transcript

well hello everyone and welcome to this def security webinar happening every month here on DSs and today we have a very exciting and relevant topic smart contract security and onchain fraud prevention with AI so buckle up and right before we start there is a very big announcement that I have to make so DSS is coming back in November Argentina so mark your calendars because you are not going to want to miss this okay now as a quick intro uh I'll be here your moderat

Pablo and I'm part of the coure team at spearit and cantina where we're building a Marketplace and an endtoend Security review platform where we are also building AI based tools to improve the security review process and Tackle complex security challenges now we have until 7 or my time we have one hour so there is time for questions if you have any question you are more than encourage to drop it here uh in the chat and we will ask them to our to our speakers now I am honored to be joined by these two amazing speakers hany and

Dan who are working at the Forefront of AI driven Security in web 3 so allow me to pass the mic to honey for introductions Honey hi I'm f Greenwall I'm founder of Olympics we started in 2022 our focus is on predeployment security so anything ahead of the audit just complementing the audit and trying to automate as many findings inhouse as you can before going to a third party thank you and Dan what about you hi uh so I'm Dan I'm the uh co-founder and CTO at hyper native uh we focus on realtime security so uh going from this

smart contract perspectives of prevention of hacks and exploits based on realtime alerts uh and also protecting wallets in real time detecting frauds fishing scamming stuff of that sort so uh and we're heavily invested in AI across the board so we'll be happy to share well thank you very much to both of you for coming and being here and now to to the audience so as you may know or you may have heard AI is changing the world in many different ways so in fact the compounded annual growth rate of the AI industry is roughly a

3% and for defi it's a whooping 53% now one simple yet powerful example of the intersection between this two industries is enhanced uh developer productivity such as writing smart contracts using AI assistants or agents uh with different tools such as csor or CH GPT or you name it now VIP coding is great but it is not great to build secure applications and manage millions of users assets uh using these kind of techniques so allow me to pass the mic to Honey who will tell you more about

the role that Olympics uh plays smart contract development and vulnerability detection and how all the predeployment part uh looks like here so Ana Flor is all yours great thanks Pablo so I'm just going to touch on the predeployment end of smart contract security and how AI integrates into that as well as the productivity side which Pablo also spoke about a bit so in terms of actually writing your smart contracts or unit tests that's a big role that AI can be very beneficial to um um being able to let's say accelerate your development timeline or leverage existing contracts to pull certain logic or certain um types of contracts from and

that that's where AI really accelerates where we see it fall short often is insecurity when you're relying on it to find vulnerabilities so Olympics the way that we leverage AI is we always build critical infrastructure first so making sure that all of our tools are Enterprise grade um and then on top of it we'll layer AI for optimizing results for making sure that we're um you know giving the right types of information back to our developers but we don't leverage AI solely to ensure that the tooling gives results so what does that mean well oftentimes you'll see people just put

smart contracts into llms and llms are built on pattern recognition so something like a simple re-entrancy it's going to be able to detect something like a cross contract re-entrancy it's not so that's where you're going to see it fall short and in security you don't really have the luxury of being able to fall short because if you miss one vulnerability that could be the life or death of your protocol right so um there's an interesting kind of balance that you have to hold when you're building security tooling so very different than productivity very different than unit tests which of course are part of the security stack making sure you have have 80 to 100% test coverage before you go into an audit making sure that you um have written every piece of code tested every

piece of code very different than um actually applying the tooling to the code and making sure that you've tested for all types of vulnerabilities um so smart contracts um don't really reason about execution flow well um and that really matters because these vulnerabilities don't exist in isolation they often emerge from complex interactions between multiple contracts and protocols so in defi execution flow isn't just about one contract's logic it's about how it interacts with liquidity pools um lending protocols price oracles governance mechanisms and external calls and an LM just isn't capable of that so I just want to start with leading with a level of caution

when you're thinking about how you apply AI to your security stack um as not a give all solution um or something that you can r liely on solely without the right level of tooling and infrastructure underneath because it will fall short and again even if it's a lower false positive rate if you're missing one true positive that's again the life or death of your company so you really can't afford that especially as a defi protocol or if you're interacting with any liquidity um so on the predeployment side just to wrap that kind of up AI really accelerates when you're writing your smart contracts when you're writing your unit tests um and you're trying to hit those security productivity kind of benchmarks

like a certain amount of coverage or um you know robust test Suite great leverage all you want right now without proper infrastructure using it for something like an audit is really problematic because you will 100% miss things there's been a couple actually articles that have gone out about that um there's one um I wrote it down by yuang do um I'm GNA butcher his name I also have a hard name to pronounce um and he actually looks at leveraging the large language models that are most popular like gp4 um and he says that they have a high prision rate of 96.6 but a low recall of 37.8 so

there's a tendency to miss vulnerabilities during detection and and that's a huge limitation that abandoning existing tooling and real like Enterprise grade security level tooling such as even if you're looking at like something like Cur if you want to get that fancy where you're doing formal verification or even a fuzzing tool abandoning one of those and just moving to an llm or AI based approach will mean you miss something maybe not the first time you run it but the second on a large level studies and on various papers that are coming out we're seeing this continually reinforced um so you don't have to just take my word from it you can actually read these papers but the standard idea alone is that AI does work for a lot of things and it does

cover some security vulnerabilities but not all and in a world where we can't afford to miss one you can't leverage it alone amazing thank you very much I guess that the audience is gonna have like so many questions uh about this especially since many security researchers have been trying to use large language models to find vulnerabilities uh on Smart contracts and not everything goes as uh it's expected so Dan uh passing the mic to you yeah so okay so I see Kan answered first his yeah so um coming from hyper native I'm not

sure if everyone knows us uh we're are running as I said realtime hack prevention so we are um not doing Audits and we are not um searching for vulnerabilities instead we're searching for attackers um I can uh I'll kind of describe and I'll share like some a few visuals soon um I'll just kind of connect I'll improvise here I'll connect to something that John Jeff I think asked on the chat about whether circuit breakers are part of the predeployment security posture so that actually Segways into what uh we do um I think from what I'm coming from a background of AI in security I was doing like endpoint protection in we to if someone is it's like a fancy word for antivirus

for coroporate um so I think from what I see when we look at hacks that we detect that sometimes the the nuances are so subtle and even coming from a background of AI is the most Pro AI you'll probably meet I think what H touched is a very kind of interesting point because at the end of the day you need to have very good represent like um representation of the features of the contract and and I think it's very easy because at the end of the day the AI is uh there's always a question whether AI people will always say does it learn or does it like a memorize right so at the end of the day um there is probably to some extent a

form like a very sophisticated auto complete right so I think it's very evident that you know you throw in contracts and it finds a lot of things so the uh the value in cutting the audit time is probably non negligible I don't know like I'm not an auditor never been and I don't I cannot speak to that um but I think there is a challenge and and I think that's exactly what is you know honey alluding for in representing The Primitives of the smart contract in a way which allowed the AI to uh to make more like interesting embeddings of the contract if you want if you're coming from that domain so for example like for for people who are not from this domain

of AI so an embedding would be like in Vector space how would you make it so that a hotel and a motel would be similar enough in one context but then again in the other context they're very different right like uh in one in like uh you could be it could be a derogatory term for a hotel but then again if you're looking just about lodging so hotel and motel are pretty close so context and and embedding of the meaning of things is very important and I think uh in in in the context of an audit it can be huge right like uh whether like a small Nuance can mean like a a drain whether and so I think that's a challenge and I'm I haven't seen any work done on the like intermediate

representation which which I know that Olympics are kind of handling so it's interesting to see how it will come with an an AI going back to what we do at least and that's not what we do um so what we do is actually more to do with what John has started here asking about circuit breakers so while we don't do circuit breakers we work on giving you the alert that would make a circuit breaker uh useful so basically we are uh looking at um like smart contracts that are deployed across like not only evm but like all evm chains in real time so we basically monitor them and like every transaction log and Trace everything we do um so we parse it and then we

understand that there was a smart contract deployment it could have been sophisticated one it could have been just a naive one um and then we start analyzing the smart contract in real time and while um Audits and like all the pre- audit like the predeployment uh process focuses on the protocol that you want to protect we focus on finding attackers so our goal is to basically say out of all the noise that you see on the blockchain I'll give you like a random number not random like about 100K deployments per month only on mayet you can assume that number is vastly higher on BC and arbit room and all I would say cheaper chains um like l2s um or side chains doesn't really matter for that context um so we basically to put it simply we follow the

attacker kill chain whenever an attack whenever we see a wallet that is behaving strangely so it can be classically deploy an attack contract usually you would need the attack logic to be in a contract because it's not very common to attack uh a protocol with an EA director because you cannot do anything substantial um and at that point we have a point of intervention because we can already analyze the contract and I said okay that bite code is malicious the way we do it is with AI so I can U maybe show um I'll kind of what one second I'll move to um yeah so I'll share a screen

here I'm terrible with zoom uh uh sorry and here so oh wait sure [Music] screen oh wait where is sorry there is an issue here we we have to improve security but we also have to improve our sharing screen technology look to be honest like it's uh okay maybe I can just share the entire screen like I don't know why I cannot find the screen with with we just did that when we prepared and now I cannot see it um

one second I'll solve it sorry about that one second um I'll just close all the other screen and make sure I remain on the right one and then it will be easier um now I'm closing all the e scan tabs right that's like what everyone does um okay let's try again I'll try and share my screen uh ah there we go found it okay so um I'll do you see my screen now yes sir yes so this is from our platform it was um this basically shows

like that we are this was a hack that was a small small Hack That was uh impact that was um I think it was public um against odos if you're familiar with the protocol it was a signature thingy issue um so what I wanted to show you is that like we are basically looking at contracts and we are scoring them in real time so we give them a score here you see my um you see my uh Mouse here right yes yeah so we basically do like uh and this is by the way a very tough one because there is no flash loan like it's easy when the the attack is kind of price manipulation think that you see a lot this attack and the reason I showed

it is because it's very very difficult to say like if you see a contract it was funded by tornado cash it does a fles loan it's like new whatever so you can suspect it I can tell you from doing this for a long time it's very noisy but what I want to show here is that with ML we can actually say I don't know what was the attack at this point like our platform just kind of looks at it and says okay this is malicious right um and when you see this like high maliciousness there are very few out of the 100,000 that you have a month it would be very very very few like single digit right so it doesn't mean all of them would cry an attack but it means that all of them require attention um so this time to be honest most time in

those cases we are right um and we AI gave a score of Zer to to one whoever does machine learning would know that if you actually do something then it needs to be a continuous score otherwise it's just like know a few ifs right like if you just change the if you have a few conditions you can bucket it into like four bucket six bucket eight buckets whatever if you're actually running a model which is what we do with it's actually a neural network uh the score is eventually continuous uh so this one got a score of 60 which in our scheme means that it's still in the very high area like most would get 0.001 so when you're looking at the score distribution you just see that everything that is above 0.5 or something it's it's unusual

right so for us that was enough to to alert on um so this is something I wanted to show you guys um um I have more visuals coming um so um for us AI basically helps sift through the noise so we see hundreds of thousands of contract 4 the chains but then at the end of the day I I know you guys sometimes see um like uh guys and girls I'll just say guys or English is not native language so sorry if I'm doing uh unaccepted Expressions here um so often times you can hear about uh you know like this company alerted this this company Al that so the way it's done it's basically you need to have an

accurate enough system that when you're looking at 40 blockchains across all transaction and everything that happens you can know that oh this is not good like we need to get there and tell them and we do it it a lot and actually just a few days ago um I don't know if you guys some of you are in E Security Group um there was an incident with one inch oh yeah Nathan feel free to drop question yeah sure um so um there was a few days ago there was an incident with a 1in solver um if people were in the loop of that so actually behind the scene there was a very interesting um thing that happened because our like system alerted on it

and I saw that it's personally it was me that took the alert um and I saw that the impacted party is a solver of 1 inch and I know someone else who runs uh similar things so I send it to them uh I don't know who the solver is um but if you look closely on chain what you'll see is that the impacted party uh actually managed to to remove funds before the hacker managed to take the rest of the funds and the way it happened is that we detected it like I personally wrote a telegram message to someone he wrote a telegram message to them because he knew their contract and he told him to remove the fun so that's actually a funny story and um someone shared it on East Security Group as well

so um those things work those things can save us um and that where it goes back to circuit breakers because we already in real time saved millions of dollars for protocols and we withdrew funds for asset managers that work with us um based on for protoc it's circuit breakers for asset managers is automatic unwinding of positions um so if you have circuit breakers built into your protocol um you can configure monitoring platforms or like hack prevention platforms hyper native is is I would say the biggest of them but not the only one um to trigger an alert to prevent a hack and um it happened a lot of time before and a lot of time we save funds for

people who are not customers just like here they are not our customers but we manage to be fast enough to make them move the funds uh even though you know if they were automatically configured with us they would have been moving the funds automatically at like and saving almost everything um this pattern happened a lot uh we have detections that uh preceded funds with zero prior fals positive to that protocol um so those things are actually this post- deployment detection thing is is a relatively new domain like all the companies that that kind of started with that are basically we're established in 2022 so um it's it's growing we see we have like we work with more than 200 customers so

it's people are adopting this but as it saids it requires some adoption um like from the customer side to say Okay I want to be ready to pause my protocol I want to be ready to unwind my position how can small blockchain startup leverage AI for security without huge C so I will not speak to on behalf of H that um is uh you know I don't know the to each his own pricing um I think that audits are by any chance you guys found out where all the coin goes oh all the right questions um okay so for for the small uh blockchain startups so I'm not again

I'm not coming from an audit space so I don't know I just know that the for a good question um um like for a good reason probably because they're very smart people who are doing that audits are not a cheap business um so I guess that if you're running an AI and maybe Han can give more details into that you can at least like remove all the obvious things that um you have in your contracts I guess Pablo is from spit and H it can be more uh uh knowledge knowledgeable about the audit part on our end I think that for like the investment in a um real time like prevention platform the prices are

relatively not high so I think if you you know you can I don't know approach us approach someone else but you you would find out that the prices are um in expected value if the ROI is very very high like if you basically save the chances are that in the next five years if you're running a protocol you will get hacked and the chances are that it would be for probably a few hundred thousands of dollars at least um everyone get almost everyone got hacked by now maybe except for UNIS swap uh I mean even like even like some side contract of like in al they had like a periphery contract that got hacked right so and that's alve and they have like the biggest security budget that you can think of for aits and stuff like that um so typically I can tell you that if the

prevention platform saves you funds like it was with this Market maker um you would not be able like it takes Maybe 20 years to make a break even here so if you basically had the if they had the platform ready they would not be able to be with us for a long enough time to make it so that it would be unworthy for them the the price is because we we are not actually putting people like an auditor we have a platform it's a SAS platform so the prices are considerably lower and then if one time you got rescued the funds that were rescued would probably pay for the platform for like 20 years so that's basically the the make or break for prices I think that for a it maybe Pablo you can add maybe honey that it can save you

from like the stupid hours that are spent right like on on things that you can just you know just mistakes that are common and can just remove yeah I can I can um address all those point so the first thing that Dan touched on is cost um of course it's the thing that people think a lot about lot especially a smaller stage teams um we've all been there we all are there um it's really hard to allocate money to anything security oriented because you have to also allocate money to developers spend everything else within the ecosystem what's important to think about is how big the tax surface is in the ecosystem that we're operating in versus the web two ecosystem and how

small our security expenditure is in comparison so if you think about like a web 2 org they're spending probably more than you are average company on security um and yet they're what they stand to lose is a lot less um and because security isn't driven by regulatory like it is in the web 2 environment these decisions are your own pretty much so the only thing that you're really mandated to do is get an external audit now 90% of exploit contracts have undergone an audit so unfortunately that's not foolproof and if you're responsible you'll know that you need to implement multiple layers of the stack um so like Dan said they sit on the post- deployment side we' sit on the predeployment side um something also interesting I think Dand did was kind of

go through as tools I spoke about this before at a high level but not how it actually equates and translates to Olympics not all of our tools leverage AI so we actually have a free tool a static analyzer it has a free and a premium version so if you want like to detect something like cross contract rency signature replay the more complex in newo vulnerabilities you're going to need to upgrade to our Premium plan we have a startup plan so for smaller stage teams under certain amount of City developers really really affordable um and uh obviously we grow with you so as you grow and your team grows um the plan will grow but our free version alone 30% of facility developers are utilizing it's because we do have um a more complex and Enterprise grade IR

intermediate representation that allows us to understand your code and where vulnerabilities can exist we do Benchmark best on market in terms of static analysis um going into starting Olympics I thought we could leverage AI um to get better results turns out the answer is for certain tools you should stick to rules based for um the reasons i' had mentioned previously which is like you can't afford to miss one vulnerability and if you're layering AI on top perhaps you will so you need to be very careful how you're using AI now in terms of other tools like our automated unit test Generation Um that's a perfect use of AI because we can actually train on existing contracts majority of contracts are forked from other contracts and we can get your branch coverage up um leverage also

existing tools like Forge or something and Target Branch coverage as our Northstar metric and and get you up before an audit so that's important predeployment so there are places where and you can kind of do that on your own it's going to be a lot more complicated and you're not going to have the same training set and everything but you could try using existing llms for that um then there's another piece which is you know how robust is your test Suite ahead of an audit um that again you can use like mutation testing which is another tool we offer um if you look at the pen Pai exploit that happened a couple months ago would have been prevented had teams used our mutation had the team used our mutation testing tool because they missed the reentrancy test so the robustness of your test Suite does directly translate um again

not AI specifically but there are pieces where AI plays and pieces where AI doesn't um if you're really you know security oriented team again you could be using formal verification now could AI write the specs for that well even humans sometimes messed up on the specs so I think there's a similar dialogue as there is in like software development it can help enhance the development flow and speed it up but not necessarily replace especially security researchers or people in on your team what I think you really need to push for is a budget for someone internally on your team to cover both pre- audit checklist of making sure from a Northstar perspective you're automating as much of the audit as you can before you go and rely on a

third party not because these third parties aren't amazing but because any auditor will tell you they have one week they didn't write the code they didn't author the code they're just trying to understand it if you leave a bunch of low hanging fruit or something tools can detect or you internally can detect you're not giving them the space and time to find the more complex vulnerabilities that humans are aware of that they're spending time researching right so you're neglecting your own protocol and then there's a post- deployment side again you're not going to and I'm not going to speak for D but like your team does if you don't have this software in place there's no one positioned to be monitoring everything and and looking for so so maybe you'll get lucky and they'll alert you and you can pull out your funds at a certain

point but if you're not leveraging tool to optimize your security stack as a whole um you're really setting yourself back and then I know speit probably said is coming out with some tools don't know a lot about those tools but knowing spear bidden a lot of our customers use them as an auditor they're exceptional so there probably are a bunch of tools in that stack that also can help accelerate your audit timeline accelerate your security just overall posture right um and I feel like there's another question I didn't address because I'm a little ad I can catch it up for you uh you were talking about llms right and one of the questions that one of the users had is that if llms are actually you know are there learning or are they just memorizing and how for

example you at Olympics how are you folks using llms are they memorizing vulnerabilities or are you teaching them about vulnerabilities right so the training data is is teaching them whatever you're feeding them um and and so but majority of LMS are just pattern-based what's interesting and what we're seeing application of right now is Agents so actually leveraging agents to try and work together to find vulnerabilities potentially write exploit contracts um but again these agents are subject to the training data that you give them so it's often and I've seen some cool startups SP up that are doing that of course every team has some version of that going on the question again comes back to accuracy what kind of results

are you getting how many vulnerabilities are you getting and the way we Benchmark it internally is very simple I say take the the same GitHub commit that they gave the auditor and that they gave us and run the tools and what percent of the audit did we find that's the best way to Benchmark it right now how are you comparing to the human and what can you take off the human's plate because then you know most teams aren't getting one audit they're getting three four if they can afford it or maybe two if they're an early stage team but what if two got you like 50% more findings because you swep things off the auditor's plate and they had time and space to think about things because they are humans they're exceptionally valuable and you know that because you're paying so much for their time the

good Auditors are are hard to come by and you want to really make sure you juice the most out of their time um so that's kind of how we measure it at Olympics just what percentage of audit findings very simple very straightforward um so you can actually use these agents to Loop through different tool findings if you have proper tools and infrastructure to write exploit contracts and actually try and um produce the audit findings there's different ways and implementations that um people different teams are doing it um I think majority of teams are experimenting with agents we've been experimenting with agents actually since 2022 but it does c so for example ethernut which is a very common like web 3 ctfs they're not like that complicated but even two a year and a half ago

agents would have passed all like all ethernut challenges at least internally we did that but it's that's not enough because that's a good start but it's not enough so so you can look at how how they begin to work um but they need the corresponding and correlated tooling and infrastructure to really optimize the results that's that's that's amazing and for all those people that are not actually in the AI security space they may have heard about agents and agentic Behavior Uh would you be able to elaborate or explain them a bit more of what's the difference between doing an audit with an llm and doing an audit with an

agent right again I would not ever put your audit in an agent's hands maybe just as part of your internal process if you have some agentic tooling or something like that that that's great but do not negate the fact that you need a human need a third party to audit um and again I've yet to see agents that really successfully um find a high percentage of vulnerabilities because a lot of them rely on tools that are open source that aren't built properly so for example you know you look at a tool like Slither which is amazing but it lacks it's amazing for what it is is an open source tool and there's been amazing contribution but it's not going to hit the same accuracy as an Enterprise grade

tool um just because it isn't built with the same infrastructure the same hour um the same ability to understand code paths so if your agent is using that tool it's limited to the capabilities of that tool does that make sense um so if your question was um do llms how do would you use an so I would use any security tooling that s support internally but you can't negate that external process and then you as a company need to evaluate which tool stack is best for your company and you should run technical evaluations across all the different companies I can't speak to Octane security I can't speak to I saw in the chat like you are the

founder the CEO the CTO whatever of your company you need to do a real evaluation you need to take the GitHub commit that you gave to an auditor you need to take both tools and you need to run them and you need to see what results are best for your team and then choose the provider that fits for you I I know every provider who's working in this ecosystem on my side on Dan's side there's a lot of really smart people and and you know we all exist because we have customers and people who trust us so um all these companies are doing great things you need to from a technical perspective evaluate which finds the most findings and the most accuracy um and do that technical evaluation you'll get the answer yourself of course each team is going to say my product is the best I'll say that

Dan will say that about his team as well um and of course because we pour our hearts and souls into it you can do that technical evaluation you can see for yourself yeah benchmarking is certainly uh not that obvious and something very big that should be standardized especially now as you know AI security applications are being developed we send out benchmarks to all of our um customers in a sales process so they can actually like evaluate those findings on their own and then cross compare them with their own audit and any other tooling oh that's that's amazing and another question for you so what are some real world examples of AI catching vulnerabilities uh before the audits that you've

had um okay so like I said the the agentic component with the ethernut is is a great example um but we're not actually using a we're using Ai and interesting components like for example on top of our fuzzing um solution we have ai and and that'll find like for example the hedgy finance exploit would have been prevented using our fuzz um but actually with the AI or without the AI layer so I'm skeptical to again pin it just on AI because AI isn't finding these things it's optimizing the results for finding these things or it's running through the findings of existing tools and infrastructure and finding you know where is this a true positive where

is this a false positive does that make sense so like the AI is the helper it's the hand to the robust security tools or to the robust security team internally that's going through the um exist components I think if you talk to a pure AI company which there are a couple in the space I've seen they might have a different answer but what I've seen so far on Market is like what they're finding is again similar to the limitations of what existing open source tools could find like you're telling you can find a re-entrancy attack with AI okay I can also find that if I run slyther I can find that if I run Olympics when do we need Ai and when do we not need AI um on the post- deployment side you always need AI right on the predeployment side I'd be careful

how much you're throwing that in for Unnecessary purposes vers necessary purposes and making sure that again your accuracy and your benchmarking is higher rather than like oh I used AI thank you uh Dan some people were wondering about uh scam preventions how how how does hyper native uh handle those cases yeah so I will resure my screen um okay so let me let me mess this up again not sure why it's so difficult like sometimes I click sure and he shows me like a different window okay let's let's do that quick

again um um share okay oh there we go all right uh okay so fishing um yeah so well maybe I'll I'll put a like a ground word first uh so definitions like every someone who studied anything in computer science or math likes um so so far we've discussed like hacks and exploits which is something that um you

know now getting the benefit of AI and it's mostly targeting smart contract um fishing and scamming targets individuals usually um you would also say that the bybit hack is a I don't know like a social engineering but at the WID scale uh when people say fishing and scamming or fraud they usually mean uh targeting individuals um so in the context of this conversation um fishing would more talk about like things that um I would say okay so basically it's making the the victim trick into compromising themselves the difference between that and I would say a fraud is that when you

have an investment fraud so someone would say okay send me money and I'm putting it into like a mining operation and like a you know mining crypto mining right um so that would be a typical fraud or an investment fraud is that they'll send you'll send crypto they'll invest it for you in somewhere they'll show you a screen very nice with all the like graphs and things and you'll be like Oh I'm up like 30% you know like let's go um so you're willingly sending it there and you're sending it to an actual thing that you believe is real but just at the end of the day they will not send you the funds back so it's more like binary options scam that used to ran like uh years ago um so fishing uh would be the the notorious malicious

approval malicious per perit malicious whatever so you will go to a website you want to claim an or drop you'll go to a website you think that you know you clicked on a link at Discord that what we would call fishing um Soh examples would be address poisoning um so examples in this conversation would cover address poisoning which is if people are not familiar is when people are bombarding your uh address with like sophisticated transaction that come to mimic addresses that are similar to addesses you previously interacted with and they have various ways of doing that but basically they'll just like randomly generate like they generate addresses like Brute Force

until they come to an address which looks like something that on ether scan would be similar to an address that you had prior interaction with and the key to success there is to timely place it in your timeline of ether scan right um so you if you're like just sent some people people would say oh like uh Pablo I need to send you like a million dollars so I'll make a test transaction yeah now he's happy I don't have a million dollars um so um I'll send you like a test transaction and those are supposedly they gamble if it looks like a test transaction I'm sending you a little bit they see I have 1 million they see a new address like Pablo I'll send $100 right and then they'll put

their transaction within there and then they hope that I'll copy uh the the transaction and then I can send it to the to their address um so we'll show an example this D we call it like drainer as a service so uh if you're all familiar with like pink drainer Medusa drainer all those uh infrastructure so basically it's um scamming that works on uh at the end of the day it's malicious URLs that you're they will put the links in Discord servers in hijacked crypto accounts replying to existing crypto accounts that are like High Fidelity like a Lio account and it'll put a lot of comments about like Li drop coming and they'll hope that people are coming um meth tutorials very common um that

people would go oh yeah like look at this mfbot you'll do this you'll do that and uh and pig butchering which is a different thing and we'll cover this um address poisoning so like I said it it works by sending tiny transaction it has to be tiny because they're spamming all the blockchain with this whoever follows that um he knows the spam um so for example let's say that the victims um oh like moving the whole Zoom widget Tre around really annoying um okay so we'll have a victim real address is this one and then uh the other fake address would be something like this so they'll kind of run addresses until they get something which looks good and this

actually looks not bad um and it'll start bombarding at timely uh places um so a very famous case was that um someone I'm you know you guys don't see it but they keep moving the widget Tre around because I don't see the presentation um okay so someone basically uh sent fake transactions to a wallet that they anticipated is about to move a lot of money in wbtc um so that's a nice case because you could see on chain that the U attacker gained $70 million in w BTC uh but then they returned it they were probably scared or whatever but

they returned it um so what you can see here is um so you see uh basically they are sending here U and we can see the fake fishing one has a similar uh one second yeah so you can see that uh D9 a a91 so you can see it here right like the same uh thing obviously it's not the same address but when you looking at ether scan you might be confused so they're basically like this is our victim so they sent here some test transaction or something they slit their transaction here and then that's the hack here and we can see it in this uh

very sad picture um so basically the victim this one sent now it's called fake fishing at that time it was not fake fishing it was the address I previously showed um wait oh okay go back oh here yeah so it was this one and then of course postmortem they they label it fake fishing um yeah so that's address poisoning um I'm not sure it's very AI related but it's fishing and it's something that we we detect and we help customers avoid um but it it costs Millions every month we see it all the time um so never copy anything from ether scan um and by the

way ether scan are doing a good job by like highlighting when you're trying to copy they're telling you don't copy um so they're trying uh but again people are doing it um okay I'm I'm naturally asking any questions but uh it's not a this type of uh medium so if you have questions just write them and I'll try and of work my way through them uh draining as a service so like I said basically the black market offered offers like automatic wallet draining the way it works is that um you get the contracts that are uh kind of it's a kit that you can work with so your job is mostly to uh like deploy the kit and make users come to your fake website and

Grant a permit and approval or whatever to your um uh to the contracts that you deployed and the dust the draining of service basically like SK like skim the token the wallet once it gets the approval so usually the users are kind of you know they just see the wallet drain and they don't know how it happened they like oh no I was on this website and and then they realize it was a scam website I have to say that over time because I'm seeing those a lot they're really really good like the websit that you're going some I mean some of them look like crap but a lot of them are really really good so like people can say ah yeah you know who falls for it like I mean honestly uh the website themselves look good I guess the ways to reach them is not they it's kind

of the same it's like links in email uh hijack Discord servers fake support uh all those things uh so again less AI but uh very effective um example for fake support right so those are like the things so uh you can see that they will basically say uh you know openc IO uh blah blah blah and then you can actually have the wallet drainer here right so it's a very like you can see how Discord can help those guys do their job um yeah and here we see something from like uh like how it looks on the dark markets so basically if

you're looking for versions of and and this thing is ran like a software company it's not some you know garage thing of a script Kitty so they have versions and they have new features and uh you can really see like uh yeah so now we have TRC 10 addit tc20 um supporting Ledger but like so it's very very industrialized and it's it's like tens and millions of dollars a month and I can probably it's probably like easily you're talking about like hundred million dollars a year that is drained from customers so uh and look like get excited the Solana drainer will be released soon um yeah so this is from like a forum like a releasing of Angel drainer version 8.2 you can see it's an

ual business um yeah so this is kind of the same showing how it looks like from like black market so someone is looking for a metamask drainer and they specify the uh they want they already have a product manager as we see um so basically they want to something that does this um yeah and and this is the another type of scam which which is like a Mev scam it's still going on we still see this uh people go on YouTube they say oh they can make easy money in crypto now they they're slightly technical they're in the for those of us because we're all

we're all mid curvers at the end of the day but uh to the point of this discussion they're technical enough that they would be like um they would love smart contracts and the whole Tech and everything and Mev and like Arbitrage and whatever um but they're not Savvy enough security wise is to understand that it's a complete like attack Vector um and they'll kind of um they'll run through a guide if you look good on YouTube you know they'll explain and whatever and then they'll like copy paste the code that the YouTube has in the comments but in the code they'll have something like send all the funds to the basically the operator of the MAV scam so they'll deploy a MAV contract uh that does a sophisticated algorithm and

the sophistication is basically taking the funds away uh from the user um okay Pig butchering so Pig butchering is like an umbrella term for fraud which is a bit more I would say elaborated than like drainers so drain all all those frauds that we covered so far most of them they're not interacting with you they're like spamming at large and they hope that people fall for it so you do like a website you start spamming links you take disc you don't actually have um like bidirectional interaction with your user spamming addresses with like uh fake like fake like small amounts in in

poisoning I think is not something which is uh consider bidirectional communication um Pig butchering different thing so what they do here um they basically do psychological manipulation uh they build trust with you they do uh they reach you in like traditional mediums like WhatsApp telegram phone calls um just the other day someone told me that they got approach actually two two times in the past two weeks that's probably a trend um like binance would call you U someone from binance supposedly not the real binance and they'll say you know we found your attack like your contact details and username and password to your account on the internet uh it's

important that you change everything now and remove the funds because if we saw it then attackers can see it and they so the story makes sense um and they just do it to many like binance customer I don't know how they reach the binance customer but they do have ways probably in dark markets that they buy data um and they come after you with a binance registered number and they'll have a lot of things that will build trust and they'll say okay so someone from like support will call you and then some they'll hang up the call someone will call you so it's a very elaborated scheme it's not something which is uh kind of uh yeah you know address poison and it's okay yes I'll never copy from inter scan and they'll stress you they'll say look uh from experience

money can be stol in the next 24 hours so I I recommend we'll start doing they'll become but very kind of AFF affirmative um they'll build trust with you um everything eventually leads to you sending money to them that's the end of it either giving like either sending money to a wallet that they know the SE to or sending money to them that doesn't really matter like all the story but the thing is that it would be a vastly different proposition than the fishing that we saw um so crypto lover scam this is Common from what we see uh in Asia uh so you would basically build kind of a

trust with someone mostly romantic over month um and then they will persuade him to either invest in a fake exchange or send them funds or whatever um but the basically it's a trap and they'll kind of we'll never return the funds um the ml comes in in the regard that this looks just like random transfers but for us at hyper native we are running like real time ML on data and we're able to surface those patterns um us as humans it would be very hard but we're analyzing like the chain you know we are seeing how those things look we built an internal graph representation

of the blockchain uh which is a difficult task because the blockchain is huge um and um we are able to surface interactions which look suspicious and then when we investigate the addresses we suddenly see external corroborations of like you know like Reddit or chain abuse or whatever so we know our method is working and we're able to actually surface clusters of fraud that are pig butchering that are happening to various like we see it it happen like like affecting the same cluster can affect like coinbase users and binance users and okx users and whatever so it's probably the same organization and they just run different schemes we sometimes

see that you know we can have different addresses under the same cluster the cluster is is is an AI cluster so it basically means addresses that have interaction with them in a meaningful way so me depositing into a binance address and Pablo withdrawing from a binance address is not meaningful but me and Pablo exchanging funds all the time is Meaningful uh it probably means that we are connected in a way even if we're not the same person um so we managed to create clusters that we believe in High Fidelity or or scam clusters um and then you find one address from the cluster and then you suddenly end up here uh so we managed to go to these places by searching on you know we scrape and we search and we do a lot of that work and then um yeah so so this guy is basically

complaining that uh you know he was fooled by this lady which is probably not a lady um but uh yeah so that's the thing and this is another example um yeah so she's saying she's a jewelry specialist from London the stories are kind of the same all the time um yes okay sorry for interupting uh be exact sorry yeah yeah sorry uh actually well if anyone else has uh any other question uh regarding how AI can be applied to Smart contract review security or fraud prevention and even detection then uh

feel free to drop your question here uh on the chat and we'll ask it right away but then in in the meantime not that you ask that machine learning models find meaningful you know patterns and connections between address exchanges right so if for example um you I and Ani are exchanging you know crypto then that's going to be detected but how how would it work when a black hat a hacker now uses tornado cash does it break uh you know like this graph model yeah yeah so tornado cach is is um yeah so the thing with so it depends on

what you're trying to detect right so if you're looking to hack a smart contract so tornado C is a popular option I would say it's like on the probably more than half the hacks are originated from tornado cach uh however tornado is a lot of legitimate use cases right like legitimate in a sense just provide you privacy it doesn't have to uh like lead like lead to a hack um the the AI we haven't try to I would say de anonymize um yet because it was not on our um it was not yet something that we were interested in trying um but I know that you know working in in um um part of seals so we're doing a lot of like emergency work and stuff so I'm seeing people who do that for a living like de

anonymizing or trying to understand um like who is behind a withdraw from tornado cach I think Zak xbt is more famous to it like on a Twitter level right and he's doing like an amazing job and um so you can see that there is a pattern here right like there are things that you can do basically at the end of the day it's mostly about amounts and timings and matching them so I'm not sure if this like an AI thing but I think it's a data challenge because like technically for bybit for example tornado cach is meaningless you cannot lunder like a billion dollars through tornado cach if the entire protocol is I don't know a few hundreds of millions or like one billion so it would be very obvious right like if you're putting A1

billion dollar in a hundred million doll pool and you're extracting like a billion dollars from there so 900 million is certainly yours um yeah so I think AI there be I'm not sure if that's like where we applied I think it's very very nicely fits in detecting fraud and fishing and the drainers and everything like we detect drainers and fishing and scams and fraud like we're running real time AI model graph models uh bite code models and and and it's working like we are seeing it working with great accuracy um and coverage so I think it's very promising uh and we already have people like I would say benefiting from it uh it's always sad to talk about it this way but yeah so yeah very quickly since we have like

one minute left uh how do you implement prevention when dealing with suspicious addresses do you pre filter these transactions before execution or do you preemptively block these highly suspicious wallets yeah so it depends on the customer so if we're talking about hacks and exploits so we have and I'll try and maybe also answer a few other questions that were similar we basically have an integration in the platform that you can issue a transaction Upon A hper netive detection which is High Fidelity and an imminent threat to a Smart contract so you can basically in like one minute just set it up there is an EA that is managed in the platform and you can basically say that EA you granted the pause roll in your protocol and you just pause the protocol automatically you can be asleep it doesn't really

matter um if you're an asset manager where you're working on an unwind position so you can like unwind and swap whatever so that can also be triggered the important part is when to trigger that's what we actually specialize in for wallets um when we integrate with consumer wallets so at the end of the day cons non-custodial consumer wallets can make you like cannot make you not sign a transaction you can sign at the end of the day if you want however we work with Enterprise customers consumer wallets and basically like all type of WS that you can think about to give them either like make us as part of a like a guardian like a like we are signing so we can actually sign with you uh of course you can kick us out and say we

don't want it but uh we're that's an option that we do and then if we don't sign that cannot go through uh so we can block or that we present you very very evident like don't do that right and at the end of the day we just hope that you would listen uh so that's how we do a a prevention side currently we have future plans but that's for now um because at the end of the day the most important is prevention from our from our perspective all we do eventually comes down to like it has to prevent otherwise it's less interesting well thank you thank you really very much for your answer and everyone in also for tuning and being here with us this is more than a one hour topic to be discussing and talking about so I'm very sure that this

conversation is gonna keep on going in one way or the other in the meantime keep an eye out for the def security Summit Twitter for when the next webinar is going to happen and do register for November don't forget about that and again thank you very much Hy and Dan for coming and sharing all that information with us everyone have a great day thank you bye Pablo by