Solving Crypto Hacks with Taylor Monahan

Transcript

foreign ation on the Pod today we have Taylor Monaghan who is the founder of my ether wallet my crypto uh which are two early wallets that have been around in the space since uh since the space has been around and she is now a uh security researcher and is building metamask at consensus on this podcast we talk about Taylor's experience building wallets but also Taylor's experience being a white hat a person who basically investigates hacks and rug pulls and people who have lost their funds in the web ecosystem and I

think the Taylor's just got this really strong character uh storytelling ability but also the ability to to use the blockchain and use forensic tools to figure out people who have gotten hacked how what happened what was the attack vector and sometimes is helpful in in helping remediate the hack and so we talk on this episode a little bit about those horror stories and Taylor's experiences from that but the thing I really wanted to get out of this is that green tell is all about regenerative crypto economics and how crypto can be pro-social good for the world so how do we stop it from being bad for the world if you lost all of your money in a defy hack or your seed phrase got compromised and you lost everything then you're

probably out of the ecosystem and the ecosystem had a profoundly negative impact on your life and if that's happened to you then my heart goes out to you and so before crypto can be good for the world before we can regenerate the world with crypto we have to stop crypto from being bad so we kind of talk a little bit at the metal level about how crypto can stop being bad for the world what's the incentive structure in the technology structure that can lead towards that and uh we also talk about just sort of the object level War Stories That Taylor has has gone through so I just have a profound amount of respect for Taylor uh as a as a good faith ecosystem participant as someone who has has has helped a lot of people in a lot of different places and uh the

security community and and I think that there's a real opportunity to create a public good for the space of of remediating these hacks in a more fundamentally systematically defensible way so with the sovereignty of custody in your own funds comes the responsibility of making sure that people don't hack them and so how do we teach people how to survive and hang in this world in a way that respects their sovereignty and is not paternalistic but also at a systemic level stops the incentive landscape that causes people to want to to want to hack people and and and uh stop and mask the people that are that are that are losing all of their money in in crypto when their seed

phrase gets hacked or there's malware out their computer or something like that so we are talking about solving crypto hacks in this episode with Taylor Monahan that I think it's one of the most interesting episodes that we've done so I think you're gonna enjoy it Athena Dao is addressing the underfunded areas of women's health such as menopause and endometriosis Athena is a Community Driven doubt giving women a say in decision making and funding the scientific breakthroughs that impact their lives with Cutting Edge technology like molecules IP nft framework they invest in research IP that ensures exclusive licensing rights Athena raising awareness to women's health research working alongside existing organizations so join Athena Dao today to help change the landscape of women's health research what's up Taylor how you

doing doing good thanks so much for making the time to chat with us really excited to talk about your experience white hatting and hunting down people who have hacked D5 projects and just generally hacked crypto so maybe we'll see it off with what's the most interesting hacking White Hat story that you can think of right now oh gosh uh there's a lot um I think that I'm always fascinated by the hackbacks I call them backpacks the ones where um like a black hat hacks a thing and then like a security research group or a

white hat group hacks back the funds somehow sometimes it's because the uh the hacker has some janky code that they're able to like get you know their foot in the door um sometimes it like more like a race condition or you know some parameters or whatever but those I think are uh endlessly fascinated and like a whole can of worms in terms of the uh legality like it was hacked who is the good guy who's the bad guy um yeah it opens up all those questions which are you know always blend yeah what's interesting about the space is this this community of of researchers

security researchers and white hats like you know I I put like uh Samsung Simpson and Zach xpt and and view this community that is formed in order to investigate and track down various hackers who have probably ruined people's lives by but by taking this money yeah and uh it's kind of crazy how long we've been doing it's like even Zach who's sort of I guess like the freshest one is he's been like going non-stop for over two years at this point so um it's yeah I don't know how like what the the personality traits or like the nature versus Literature Like shaped us

to like be these people that end up in this position but um it's I don't know it's probably like one of the most satisfying things that I've that I take part in yeah yeah I mean I know that I get a dopamine Rush when I solve a problem but I imagine that when you are using all these blockchain forensic tools and you uh have track down where the funds get uh gone and then maybe squeezes the hacker to return a portion of the funds that's got to be a really satisfying moment for for the community of white hats yeah no it absolutely is and there's there's different ways that things happen and some of them are more like social

pressure I think Zach is a is a good example of like the power of sort of the social structures and just how much um how much like just putting information out there uh can do uh it's incredibly powerful I think we forget that in the space a lot because it's you know a lot of times we focus on the tech and what's possible and it's not and it's like me uh you can also just tweet something and change people's behavior who know yeah um yeah but it's like for me the it's twofold like the satisfaction comes from uh like at the end of the day like helping people who lost money like not lose as much money or at least know like at least have some

amount of like closure or information about where their funds went um I think it's also satisfying to to think that um like when we uh like when somebody either Returns the funds or there's a recovery made um you know where you you just Blossom on my social media and and their name is now out there um that probably uh acts as like a disincentive for future people who might choose to go down that road and become a thief um and then the other half of it though is like the blockchain like is is the fully public ledger so you can actually go and follow the money

um and obviously people have like a lot of techniques that they use to try to obfuscate where the funds go it's not like uh yeah doc makes it look real easy I probably make it look quite easy as well but uh there's a lot of places you can go wrong um and it's like I don't know I kind of describe like math without the math part of it but it's like there's one answer there's one right answer as to where the funds went um and you can go down like a lot of different roads uh that are that are totally wrong or somewhat wrong um but when you actually figure it out and you put all the pieces together and get that you know that one right answer

then it's like yeah it's like solving a math problem but again which is yeah well um I'm I'm just kind of in awe of of of the work that the security researchers yourself included have done here and um uh I think that I was watching a documentary one time about maybe it was quadrita quadrita x a documentary about the founder they rugged and um and I saw you in the interview on that and I was like I know her that's that's so cool that you're uh that you're whiteheading that um in this episode I wanna I wanna kind of like go back and forth between the tangible sort of like War Stories of of uh White hatting these hacks but I also want to drop this meta question in there

which is how does crypto stop being bad for the world so you know this podcast is all about how do we make crypto that's pro-social Pro environmental and has a positive effect on people's lives and one of the things that I feel actually it kind of makes me cringe because because I am in this idea space people put me on panels called how cryptos is saving the world I like no my my whole thing is how crypto could be good for the world right but we're not doing it yet and I think that for crypto to be good for the world we have to stop letting it be bad for the world so net net how do we make it more expensive to attack and to Rugby's projects than it is to defend and shift the balance such that it's not a common occurrence anymore I think is

like the The Meta thread that I wanna that I want to pull through and then we can go back and forth between the object level and that that sort of meta level question but maybe I'll just tee that back to you how does crypto stop being bad for the world uh at at like a I I just like a fundamental fundamental level how do we stop all these hacks from happening or if they do happen to remediate them uh systematically yeah so I think the uh the biggest problem right now and it's been sort of the biggest problem for a while now is the fact that it is um it's just like it's so directly profitable to uh steal funds in any number of ways like hacking like a D5 protocol or essential ice exchange is

one of those ways but you also have like fishing you've also have like the Twitter reply box that try to trick you in designing a transaction you also have um uh I think the one that's been going around this week is like the fake coinbase support scam call where they like call you and like say that your account like something something something and it just all of these actors are uh this getting really creative and and they'll do whatever they can to try to steal your crypto and I think that that um that in order to make that not the case you have to sort of give people ways to

uh I guess say be financially profitable or or stable or whatever without stealing right because if it's just so freaking easy to um to see people and steal and that kind of stuff then you know a large number of people are equating to that over there um and I think the like over time I've come to realize one of the bigger or or not bigger but one of like the things that crypto just really historically has not spent a lot of time or energy or resources doing is is like when a theft happens or when a hack happens like what are the measures that we take to

um create some sort of risk for for the bad actor um and so if you are considering hacking or stealing or fishing or whatever it is it's sort of like right now in your head you're you're analyzing like okay so I can spend this much energy and make this much money and if the amount of money I make is more than the energy or the resources that I expend then that sounds great let's do that normally they also have this other factor which is like Risk like risk of being caught risk of going to jail risk of having people find out that you're a terrible person and holding you accountable for your actions um and in crypto it's just like

you know there's been like a few incidents where um like the Dow notably it's just like the biggest example of this where the the community the ecosystem has said like no like that's not okay at the same time though the Dow hacker is uh uh the legend dial hacker I guess is is known he's in the space he's always worked in the space he did an Ico um like that's crazy to me and and you know it took a couple years to figure that out but like you know when Laura Shin published that that was based on really solid research and uh I'm not sure that the community like rejected him and that that those are the

sorts of things that blow my mind a lot is like uh there's just like I don't know there's just no risk like there's no downside to hacking at this point like it's obsessive word so it feels like netnet and this might be too reductionist but it has to be there has to be a risk to attack it in the system and draining the funds or attacking a person in a train uh joining funds whether it's legal risk or social risk or Financial Risk and that risk has to the expected value of it has to outweigh the reward that you would get doing it and also people just need other sources of income so the hacking's not an attractive career path um that's that might be too reductionist

but that's kind of the thing that I heard there like there's going to be infinite number of channels that uh that will open up from like SMS injectspra sorry SMS like in the phone call phishing attacks and um like faking being a D5 app like there'll be infinite channels that'll open up unless we solve for those core things is that true reductionist is that fair no I think that that that's good because it's a it's a huge idea and I actually died at all the SD reactions I think that like there's a lot of like Trails out from it but not at the point well that's what we need to do it feels like oh geez I mean this spirals really quickly for me into income inequality being a root cause of people wanting to hack like if they

could make if they had Ubi they would have no reason why they had to hack in order to meet subsistence level I mean maybe some people would do it for the thrill or the financial outcomes of it but you get quickly into an issue where uh crypto being being bad for the world or these hacks happening spirals out into societal issues really quick and societal inequality and to do the politics pretty quick yeah no 100 and um another interesting thing that we see a lot is like you know a lot of the attackers not all of them but a lot of them are um from nation states with high levels of corruption at like the nation's they level um and also nation states where uh quality of life like there just

aren't a lot of options and it's sort of you know become um it's maybe not like like good to steal but it's definitely not bad to steal sort of like you know we're all trying to make it in our lives and life is hard um and if you can find a way to you know provide for your family then that's that's what you should do and that kind of dominates over the you know in the west um yeah it's it's still not okay to steal generally even if it's to provide for your family I remember being in a country which I I won't say which country it is but I

remember that there was a history of uh Western imperialism in that country and it was kind of socially okay to steal from westerners and especially white dudes like me because it was easy to just justify in the uh you know their culture has been dominating ours for hundreds of years what's the big deal if I if I Rob them or something like that and um yeah I just think it that maybe this is an example of that like so there's not strong legal and social Protections in these jurisdictions that create risk for the hackers yeah exactly and it's um I think the other thing to keep in mind is like there's actually very few like I I don't know of one I'm sure they

exist but like there's very few hackers that are like true like uh like purely bad people if that makes sense like Psychopaths or like sociopaths like they're they're not usually like that um there's a lot of justification that happens um the amount of justification or you know sometimes it's just like avoidance or whatever you know but generally speaking as humans we like to consider ourselves as like good people um and that's the same for hackers like if you you know have an honest conversation with them they will usually um well I'll say if you you open up a conversation and don't judge them they'll usually tell you you

know their thoughts and it'll be full of justification it is quite hard to have those conversations because it's um infuriating like just straight infuriating but um you know if you if you listen to them yeah there's a lot of justifications as to you know why why this is okay like why they had to do this there's a lot in the D5 stuff especially there's a lot of times where it's too uh like they didn't feel listened to by the team that they hacked like they tried to warn that it was or something um and the team didn't yeah that is a problem I've seen is that you know there'll be a a bounty for someone to report if you report it like

a billion dollar exploit you get like ten thousand dollars or something like that and I can that incentive structure of offering the white hats peanuts while the black hats can get uh you know can get like beachfront real estate without amount of money I think that that incentive system is is maybe part of that but it sounds like it's also a social thing like it's like a respect thing like I want them to see me kind of thing yeah exactly and that's what you know one thing that um you know over the years I've learned is like um like people feeling heard is probably like one of the most critical things that you can do in life in general like it it it's if you make your team feel heard if you make your callings feel harder if you

make your peers feel hard um generally speaking they are like life is better less bad things happen um I think a lot of times especially with like crypto because it's so International and so much of the communication is tax base that a lot of people like just they don't feel heard and if you if you untangle it enough though it's not that right uh it's not usually like bad intentions like the team it wasn't usually like trying to be easier and not listening you know but you know from the Hacker's perspective or frankly anyone's perspective it does feel like yeah why wouldn't they listen to me okay let me do this and let me

prove my let me prove it you know now they'll listen to me that kind of attitude yeah so it feels like you always spend a lot of time in this space thinking about programming our values into our money and programming crypto economic systems My ultimate example of this is how in 2017 billions of capital was raised by people who thought that if you just take a human and you put a token into it it'll you get out in action like rational crypto economic actors uh but it feels like there's a lot of like emotional intelligence and cultural building and psychological safety and acceptance that you can get all like if you have that complimentary skill set to your to your programming skill set then there's there's a lot that you can get out of uh social engineering and and working not only with your team but but with the

attackers to get the funds back yeah 100 and it um yeah again it goes back to the this idea that like you know we're humans and we think we're good and we you know if you um whether it's before a hack or after hack if you sort of make it easier for the person to be good than bad um especially after hack if you make it easy for them you sort of take the the path that you want and you also um like you don't again it's like you don't judge them for it you don't you don't force them to like confront their Badness or their failures or whatever it may be

um usually they'll take that path I think most people would right it's like if you can you can take the easy path and you don't have to acknowledge that you're bad you don't have to confront it like all right full I'm good let's keep it there I think the trend of the recent hackers I think it was Euler finding attack recently that uh they returned 90 of the funds and they got to keep 10 as like a security Bounty or something like that I thought that was a really heartening outcome I'm not sure the exact numbers there so don't quote me but do you see that as an increasing way that this we reach an equilibrium is that most of the funds are returned in exchange for not pursuing the hacker anymore I think that it's incredibly exciting I think that ideally

we have systems in place where like you have less hacks in general um and more structures that like either prevent the hacks or have some like I don't know some automated way to you know if a person wants to hack it but they don't actually hack it you know they don't actually take the funds the funds go somewhere else or something like that I think that would be better than like a you know everyone get in a war room and figure out how to coach you with the hacker and um yeah that that was a sizable one I think it was like I think the roughly the amount stolen was like 190 million so the fact that um like yeah over 90 of the funds were returned was was absolutely epic

um I think it's a testament to like just how um like you you shouldn't you shouldn't have really any like assumptions about who your hacker is or what their intentions were or what they may or may not do if you leave the door open and you you know kind of assume that like hey there might be a good person in their deep soul and they might return the funds like you might get surprised by the outcome yeah I'm wondering if if you had a magic wand and and you could do one thing to systemically re-architect any part of the ecosystem in order to favor The Defenders instead

of the attackers what what would it be if you had a magic wand what are the highest leverage points that you think could could fundament and fundamentally make the ecosystem more resistant to let's call it anti-social Behavior maladaptive behavior for the ecosystem so the one thing that it's always tricky and this is the reason why this ecosystem historically has not like you know jumped to uh like taking drastic measures to to recover funds um is that you don't like the whole point of crypto is is to put the power in people's hands and to give people control and also to prevent like a single group or authority or state or whatever from having control over

another person and so it makes it really hard to have to especially about like oh well if a hacker hacks something and then a group decides to like take those funds back then that's that's a person or a group having authority over another person and then right in the like Library slope arguments Etc et cetera et cetera I think that like uh we should acknowledge that the the fact that like the person hacked this thing and stole These funds that's also very much a situation where this one person uh has has forcibly taken control and taken the power from a huge group of people and I think when you start to uh

you know consider that like like in my opinion like the property rights things like the ideas around property rights that are like the OG Bitcoin ideas and then allowing theft to happen like they're not compatible ideas like if a person steals your property that's like that's a violation of your property rights um it's actually not a wiley shoe to take the funds back like that's like the story the property rate like that's restoring a person's rights and their their their property to consult like it's just you know what I mean but yes oh sorry I was just that's like the idea that like always bugged me in the yeah

so I just had uh Glenn Weil from radical markets uh and radical exchange on along with Danielle Allen who is a a researcher and they just wrote a paper about web3 ethics and they actually highlighted this exact thing um the question is do we want to architect our legal system our digital web scale legal system uh to be oriented around just one form of domination which is can I take this property or not from someone or do we want to wait or which is like the Bitcoin argument of like you know not your keys not your coins if you have your keys then you set yourself Sovereign or do we want to think about all different types of domination and the domination of oh I hacked you is it is is another type of domination that

can't be easily encoded into the property rights system of a smart contract and then there's also kind of like systemic corruption or systemic biases and all all these other different types of domination and so I think a big difference in in the two like schools of thought here is do we want to just have a narrow view of what domination is is and or do we want to look at all different types of domination and then you get into it's more complicated but it's more comprehensive yeah and I'm I'm uh like when I sort of look at crept Illinois I feel like a lot of times we operate in these very like black and white areas um which are like at opposing ends of the spectrum and we just like almost forget that like full area in the Middle where

yeah it's not clean it's not simple it's not black and white but there's like a lot of different avenues that um can be utilized to you know adjust the incentives or adjust the outcomes or you know make it more likely that recovery is possible or you know whatever it may be and I think that like especially in a you know a growing emerging ecosystem like we should be playing in those gray areas a lot more I think the slippery slope arguments have been like so dominant that it restricts our ability to like think creatively and creatively problem solved I think that that is like probably like that that that act is like

probably one of the most depressing things because you know as systems get more mature um they're harder to uh it's harder to play in this great area right right early days are you know should be full of experimentation because that's where you know the magic can happen one systems are um yeah once systems are built out uh and matured it's it's yeah you don't get that freedom anymore and so I wish we did more of that um I also think there are probably some things with like system design in general that could enable any number of things but we just don't

even again we just we don't think about them we don't consider that a thing we don't make it into the system design from the get-go um but yeah I feel like we code anything so there should be a one coded thing um where you know if a hack happens XYZ also happens or it triggers this or whatever it may be yeah um this is an interesting point about how help when systems ossify over time and there's more precedence set there's kind of a constrained constrained space where actors connect from like a complex systems perspective and um it feels like we've kind of followed the Bitcoin style design of

Cody's law and your property rights to your property rights to its logical conclusion and now the booking program our values into our money what are the ways in which we could build uh more anti-fragile systems against hacks where there's there's ways of remediating that or or preventing preventing that and I feel like we're still exploring that design space a little bit as the ecosystem matures but it's also existent it's like a Race Against Time because if there's another bull market and there's 5x more capital in the space that's 5x more incentive for hackers to come a hacking and um so yeah I mean I hope to be able to highlight more people that are that are working on creating anti-fragility and reactivity against hacks um but not giving up on the principles of

decentralization and Injustice that I think that we've gotten also and that's the line we have to thread yeah exactly and that's like the um you know when I consider the the different Avenues and and things that you know can be utilized I I always kind of go back to the this fundamental premise that um AFV and you or is not in control of their funds if the end user is not able to you know take actions that they want without anyone else's permission then that's then that's not crypto in my opinion right so um anything that we do has to sort of like that's sort of like the Line in the

Sand the second you start to take um Power away from people the second you start to like um uh it turns out like paternalism really quickly as well so like oh let me let me take his action on behalf of these or let me prevent these if they're automatically from taking this action yeah but we know better than the user and like no no no no we can't go there like that's that's where it gets in in my opinion that's where it gets really dangerous because um you know at the end of the day the user I won't I won't say if the user always know who's best but these are should know what's up and like if they're informed right then um they do know what's best for them and you don't and and you shouldn't ever uh

you should not ever delude yourself into thinking that you know better than than someone else you know yeah it feels like we've all grown up in this sort of like journalistic nanny state where we've had our sort of sovereignty clipped a little bit but it's kept us safe and there's almost a certain amount of unlearning that that you need in order to become sovereign and and and responsible for yourself and I think that that's part of the that needs to be part of the crypto onboarding journey is is like hey you don't have the training wheels are kind of off a little bit and in that sense I think education is anti-fragility but also people have to learn for themselves they have to touch the Hostile uh so that they know not to do it again so like one of the ideas I was talking about with my friends is

like you know baby's first rug like put somebody into a smart contract like five dollars and watch it get taken away from you so that way that makes you more preventative against losing your life savings or something like that yeah Dan and aronette menopause had a similar one where uh they wanted to allow anyone to make like a planzy coin like anyone just press one button point and like the the like the rationale behind this right was that like if you realize that you have the power to create a Ponzi out of thin air like that then you are less likely to get taken by a plant like they'll just like it'll make ponzi's like just worthless

um but yeah there's like I don't know there's there's like that's the thing about this face is like it's so empowering like once you realize what crypto is doing then um that is the most empowering thing and then in turn you um you understand like one you'll understand like why there are hackers and people chasing you down but you'll also like have a deeper appreciation and understanding of the responsibility that you have over your own uh digital assets or you know faster your identity or whatever it may be um and I think that right now and like I've I've done this for years but I think we try to educate them about like how to

protect themselves from scams or protect themselves from hacks um but if if you don't have that underlying understanding and appreciation for like what the sovereignty actually is and what that means and how that relates to your wallet and your keys and your coins then we're just like kind of like like brute forcing like these lessons um and then the second that the attacker like changes one and one little aspect you know then the education's like yeah like people that map it in their heads or whatever um where I found like for myself the most yeah the most successful thing to do is like just be incredibly sort of

skeptical and and a bit paranoid like this is yeah mine uh like it if you want it you better uh rub it to me really sell it to me yeah yeah I think there's to me I still think I think education is the ultimate anti-fragility and if there's a stop along the way where the user is installing a wallet backing up their seed phrase getting youth off of coinbase um and like you know maybe their job to be done is to buy safe moon or something like that uh if there's like a little Loop to the side where you get educated about the path here and there then then you sort of increase the sovereignty through education over time and um

I think the problem is that people just don't really like when I when I'm trying to do something I just click through the dialogue I don't even read the dialog boxes and I have a computer science degree so I'm wondering you know what Joe the Joe the plumber someone without a computer science degree would be doing there and um it's one of those great power great responsibility things I I think like the Spider-Man quote of when you have great power comes great responsibility how can we make people worthy of the power that this technology gives them yeah exactly and by the way like it doesn't matter how smart or how computer science oriented they are like they all click through the dialogues none of them read anything yeah the biggest product challenge with wallets is um is is forcing people to slow down and

and like like break them out of their pattern interrupt all the time and like my favorite example of this is like the the early new dialogue that I threw up there uh in 2017 during the Ico era when the loss was just like overwhelming I used every single like ux product design lesson I had ever learned to like do the opposite deliberately so like there was a modal it interrupted you there was no x button you can't click out of it um uh the the height of the panel was different every time you click through and so the buttons would hop around so you couldn't just tap tap tap tap tap like you had to like click and then like

you'd ring the button it was like I felt like such an evil person like it's no worse yeah it was like every lesson um but I just wanted to them to like I just so desperately wanted them to read it and like consume any of it please slow down and that's we're doing the same thing with Madame mask on the confirmation screens now right like the every single whether it's the permits or the set approval for all or the approve or whatever there's like a 12 of them I think we have like Custom Designs print out every single pattern that we're exploring is around um getting the person to like slow down to understand what they're actually signing so that they can be informed

about the action that they're taking because um yeah not all daps are trustworthy obviously but even trust with the cats sometimes like you know the the action that these are sort of thinks they're taking or assumes that they're taking is not necessarily the action uh it's like it's not just the fishing side it's also the legit ones that aren't super clear sometimes and it's right incredibly difficult it's like it's so hard yeah so for the uninitiated MU stands for my ether wallet Taylor's the was the founder of that that's what it was called before my crypto and in the Ico boom uh you would trap users before they tried to send money to something and say are you are you sure or not let them out I think that's like a funny ux pattern

that you did there yeah it was a it was 10 pages by the way it was 10 like education pages online what this crypto thing was like you're being your own bank uh like fixtures will try to fix you this could be a fake site like it's the whole gamut 10 pages it was absurd we got a lot of hate for that um Twitter constantly would uh get very upset you know because especially people that were using the product every day you know we stop please I I yeah it's no regrets I've also seen your your tweets about

the support inbox and the emails that you get like someone knows get rugged in they're hoping that you can help them and this must also be heartbreaking so it's like damned if you do damned if you don't uh kind of with the product design yeah I still spend time in the square box by the way in the metamouse of the box today is it's very much similar to yeah the new super box in 2017 like it's just a constant stream of people more um like you have lost money they think they lost money like sometimes they haven't sometimes it's just that uh they don't have any they have or they don't have Ethan ethereum they have West on a polygon or on BNB or whatever it's

called now um and those are like the best cases where we just have to like you know cycle through the network so the tokens to find like the match uh most times it's yeah most times it's like yeah they wake up and their phones are gone that's heartbreaking like I I hate those like I hate that because I can imagine what it feels like to like wake up look at your wallet and be like what like your hair should go um the ones that really get me though that aren't really as much known about in the last are they're like sort of the pain butchering uh scams but they are essentially it's it's insane but there's these there's basically scan centers

just oh it's like all it's like a chain of exploitation basically but there's like these scam centers in places like Lao and Cambodia where you have people whose job it is basically uh to sit there and like build relationships with people and these aren't even crypto people these are just normal people so like on WhatsApp or LinkedIn they do this thing where they um they'll like message like send a text message and then if if the person's like oh I think you're the wrong number and then they're like oh I'm so sorry I would be my friend so and so in Boston and then like the the the target is like

oh I'm in Boston like are you in Boston and then like they somehow like developed this huge relationship it's like a month sometimes a year long effort they'll talk like every single day and when ultimately they'll do is sort of introduce money into the conversation uh one lady's story was like just heartbreaking she like she has some sort of injury and so she has like a lot of different pains and you know some days are worse than other tips situation so this scammer every day would like ask her how her pain was and then would be like man it would be so nice if you had a little bit more money so that like on those days you didn't have to go to work like for months this guy did this to us

to this lady and then eventually they go well you know I got my money from crypto and everyone sort of crypto these days most of these the people that are you know taken taken by this scam um are aware of crypto but they've like always sounded too scary or too overwhelming or or you know whatever it is but now that they have this trusted person telling them like oh it's not that hard you get on crypto.com they'll walk them through setup account then they'll walk them through setting up their men and mouse they literally get the person to go from like zero to one in terms of crypto they literally on board right insane and then they push them on to a faked app which is like a

uh oh it's like terrible there's like a bunch of them but the concept is always the same you deposit your money into this app and then you can you can see the returns like in the DAP interface it's very simple I mean I'm a compound situation where like you put your money in and then you see your money yeah that's like the number go up but like it's all fake the second that they deposit their funds they like maneuvered lights just send them away or they do like an infinite approval and so every time they uh deposit more ustg or usdc it just gets swapped out to the hackers you don't hear from these people for months like they a lot of times they'll reach out to us because they're talking

to like support upon not site and um that support person like stopped responding or blocked them or something and so then then and only then do they reach out to us because there's a support button in your meta mask and a lot of times everyone realizes scam like a lot of times they're they're trying to like bribe us or help like get us to help them withdraw their money or whatever it may be um it's like yeah it's my employee so yes May right now we're getting tickets from people that were this they were first contacted on LinkedIn or what's up or whatever back in October wow that's um it's heartbreaking I actually

uh yeah I think uh I was a target of one of these Pig butchering attacks and I was asking one of my security friends what they're doing and they they're explaining it all to me I was like well at least my secret is just not having that buddy that much money in crypto so I guess does it happen to only like like I feel like people think that I might have more money in crypto because I'm a founder of a of a project but it's like a public goods project and um does it only happen to like high profile people or is it or is it like your everyday citizen can be picked butchered also yeah so it's there's like a couple different flavors of it but the ones that there's the ones that I've been paying attention to mostly are actually people that like were never in

crypto at all they were just like random people um because those are so those blow my mind because people on board people the crypto to steal their money like they're they're quite literally like using crypto wow um as as this mechanism both probably because it's um they can like get the money and then there's not like a chance of uh the bank like freezing it or whatever but I think it's also there's a whole um like there's this whole like like passive returns Financial Freedom like narrative that they're they're using as part of their scam

um and it kind of again once again like going back to that idea where you can educate people about scams so you educate them about like say like Nigerian print scam uh but then if you just like teams you do the exact same scan but you just change the words so it's no longer Nigeria and a prince it's yeah um it's whatever crypto uh passive income uh whatever it is you know like that that suddenly it bypasses people's you know red flag detector and yeah success for the hacker scammers it kind of reminds me of like evolution in nature uh like the evolution of parasitic organisms that like have to you know if

you're if you're a cancer or a biotics you have to consume your hope like consume as many resources from your host but then you eventually consume your host and you have to move on um and and you know of course there's an adversarial game in nature where their antibodies and there's a defense mechanism and an immune system that evolves and I it feels like we're sort of like speed running that but for finance and and globalization in this space and I'll be curious to feel like to see if there's a decentralized immune system that develops against this in in any sort of way and if so what it looks like but it um no I guess I'm just wondering from your standpoint like one out of ten one one to ten one being we're never gonna solve this in ten we're gonna solve it one day where do

you stand and and what would it take for you to get to attend yeah I think that we're actually we're getting a lot better you know back in I I didn't like follow things like the big cases and the the big scam operations that's closely back in like 2017 2018 but I've heard I've heard stories and like you know a lot of the big hackers including like North Korea and stuff you know they were getting like they were getting 99 90 90 let's say 90 plus of funds that they stole they would be able to to get out into the real world or you used to purchase Goods or cash or whatever it is um and today that number is much lower there's you know it's there's no database right now there's database of

Allah hacks it's on the database of all like the recoveries and freezings and stuff but uh tether is is Heather is in processing me never thought I'd say that but they are sort of like coming up with their they have their own system that's that they've sort of like evolved over time in terms of like how do you have sufficient evidence um or proof or whatever uh to like say like you know for both tether and for sure the victim or investigators or whatever you know to agree that like yes this is definitely definitively stolen funds and then tethering will freeze it

like they will they'll freeze it if if it's if those funds are stolen um they're not unlike um usdc and centers or gold coinbase like they're not um doing it in a in a U.S Central way they're they're very much like like you know accepting that like people are being victimized everywhere around the globe and so therefore the system that they're sort of like you know trying to they've sort of half spun up or in the process of spinning up or whatever you want to call it um is very much like International like right how do you how do you relate there's no like you want to prove law enforcement

like in an international thing like you can't be like okay you upload your uh you know FBI ID yeah police report they have someone prove that they have some Authority and some jurisdiction um Etc et cetera so it's been really interesting to watch but I have hopes in like that's one Avenue I I think that like uh I have some some hi-hats for like the centralized entities in the space who have that power uh you know we'll we'll figure out ways to um yeah come up with ways to to without abusing that power hopefully yeah that's

the that's the next Edge is how do you you know provide this power but also not give it in an authoritarian way how do you bound it by a process and quickly with programmability and immutability someone should be able to design a system that's hopefully fair and just yeah I also think that one interesting thing is that you know tether is not a nation state you don't have to use tether nobody has to use tether nobody has to use binance nobody has to use any of these things so um I think it does give people a bit more freedom um for a certain amount of time just because there are choices that exist right so like um you know at some point it will be the

case where uh you sort of like your life is worse if you can't use tether or you can't use Finance or something but we're not there yet and so while we're not there there's a lot more freedom um in terms of what you can do and then the most important thing to remember as well is that um uh especially like with freezing right you freeze it you know if if it turns out that you're wrong you can unpreviews it as well like that's an important thing to keep in mind is like you have to have piles of recourse on both ends so like uh if you get hacked there has to be a path of recourse but if there's like uh an overstep of power or an investigation

goes this way and a market maker gets you know gets Frozen and set or something like that um you know it should be very very easy for that legitimate person who did not steal the funds to have a paddleberry course as well and these are the yeah the hard messy gray areas that we got it we got it yeah figure out how they work and practice and experiment and honestly like [ __ ] it up a little bit like like actually free some people while those Stakes are low and so that we can build up the you know build up all of the different systems and checks and balances that that need to be in place before um before the damage is too great right well um I think what you're doing is a public good for the space and I

just appreciate you taking the time to educate us um uh I hope that you write a book one day about all the hacks and things that you've seen I feel like it's like it's seriously like post-modern sci-fi uh level stuff um giving the route of time now I guess I'll just ask you one one sort of final open-ended question which is is there anything I didn't didn't ask that you want to say um I think the biggest thing that I just keep going back to is that um like one the the system that we're talking about like it's not just this technology it's like not just like you're one little d by a protocol like the system includes uh your D5 protocol which operates on a specific chain which

interacts with other chains it has users like it has real people they have addresses they have assumptions they have live they have money they have financials civility or not stability um and then you know he interacting with all the other things that are also on the blockchain uh and that includes like some things that are essentialized and some things that aren't and so I think that you know because just figuring out the design of your one little deep eye protocol is so like such a massive undertaking people tend to just like ignore everything else but the reality is is like everything makes up the

system like every single thing um and like there are I'm sure of it there are a million ways to uh yeah to to to change the inside of to change the structure so take advantage of the different you know entities on on like certain blockchains or in certain systems um for example like the Mev Bots up front run the hacks on accident like how do you make your your contrast like more front runnable in a situation of a hack right like cats wouldn't you ask an answer uh I feel like most of the smart contracts

I've built I've been trying to prevent front running but in the case of a hack I guess you want the hacker to be able to be front round yeah it's interesting a lot of talks uh when when there's like the white hat recoveries that are talked about a lot but like a lot of the quieter ones were like all of a sudden like the hacker just like return the fun everyone's out that the hacker that tried to hack it didn't get any money some random dude who runs like a I mean but like oh I have to speak whatever um and then you know very quietly gets in touch with you know a number of people and and the funds like you know get returned but like those those types

of things like that's the thing that I think excites me the most is like that's an example of the system as a whole the system designed on the whole using all these different entities to uh incentivize the behavior that you want to get the outcomes that you want um right now like that's I I think that that was all mostly Indian Burton but like you know if you if you incentivize that right if you incentivize front running of the hackers uh you know you're you're gonna have less loss due to hacks I guess wow uh we are truly living in the future I'm realizing as I'm talking to you this feels very cyberpunk yeah and we'll hopefully not screw it up

because there's a lot going on so I don't think I actually got an answer uh out of the well it's a one to ten where do you think we are now in solving this one to ten uh probably like a three okay zero okay so progress is being made but it's a it's a long journey yeah and to get to a time like I don't know it's uh I think there's not like one answer you have to do all the things and um and it'll say fine it'll say creativity and and it'll take uh humans don't forget the humans please yeah and I think I think where this connects with

my work is that you know we always talk about public goods it's like climate change and open source funding and everything but like people not getting hacked and being completely wiped out of the ecosystem is kind of a public good for the space and so security white hat work I think is public good for the space and uh you know where my mind goes to is like you know consensus is is really great at like sort of subsidizing the security work that that you do and um you know how do we provide the funding and actually the humans who are staff the humans long term who who are working on creating this public good for the spaces where my mind goes but um you know I hope to have you back in a year or two and hopefully if we're at a three three out of ten now we can be at a five

out of ten or seven out of 10 in a couple years um so I really appreciate your contributions to the Space Taylor yeah thank you so much for talking about all in this random stuff yeah it seems easiest [Music] foreign [Music]