State of Web3 Security: Is the Worst Behind us or Ahead?

Transcript

[music] Pablo from OPSE. Over to you, George. Thank you. Thank you very much. So, as I was preparing for this panel, um I thought it would be a very easy question uh in the beginning of last week. Clearly, with the apocalypse of vulnerabilities that's been going on, the worst is yet ahead. And then, uh the Binance hack hit. Um that's certainly I think changed a couple of opinions with that. People say that October has had uh 3% of all critical vulnerabilities ever found in cyber security and of course the largest financial highest in

history. So um is the worst ahead? Is the worst behind us? What does the worst mean to you? And uh maybe you can give a one-word answer and then a few sentences to support it. And uh Julia, we'll start with you. >> Um hi everyone. Yeah, Julia from Zero Shadow. Thanks for having me. Um I guess before Binance happening, when we looked at how many hacks had happened in terms of amount of money stolen, it wasn't necessarily that much more this year compared to last year. similar trends in terms of was the attack vector smart contract exploit versus a human element

operational more element um those numbers are a bit distorted now but I think just in terms of the number of hacks um we're seeing a lot more and and the the amount of engagement where we have to to try to make sure that people are are thinking about their entire work stream and suppliers and and we can get into all that is definitely grown. So that's that's more of where I'm looking at it from. >> Is the worst behind us? >> No. [laughter] Easy answer. But to look more into that, in 2025, we actually saw hacks started to decrease a little bit. We were we were getting to a point where the defenders were almost getting on top and

we were we were working hard. And then AI came along and now we've all seen the hockey stick that hacks are going exponential. Uh we're at a lot of hacks right now. Um not just web three, web two is getting decimated as well. You get Linux kernel CVES, you get TLS certificate providers getting rinsed because they decided four is secure randomness. Um and so what's happening right now is that we're obviously in the exponential, but I do think the code being generated right now is getting more secure. Uh I've been doing this for a long time and it's actually one of the hardest times I've been finding it reviewing code to actually find

vulnerabilities in in the code that's coming us because AI is working well to produce better code and they're also all the developers are using a lot better security tools to check their code before it comes to us. So, I'm I'm hopeful that once we get through the backlog of pain that uh we'll get to a state where we can start recovering in maybe the next six months if we're lucky. >> Okay. Um I guess I'll take the opposite side then. I'll play devil's advocate. So, I'll say like October is called Hacktober for a reason. I think the worst October uh we had was like the last October was by far the worst one and I think that's going to stay as it

is. I think it's it's all flowers from here. The caveat though is like how we define worst really. So like for me worst is a mix of like funds being stolen uh fear being spread um like trust being lost and and so on. Uh I think we have hidden sort of the floor already like you can't go any more lower in terms of trust and so on like it's only uphill from here. So that's my uh contrarian take.

>> Yeah. Uh I agree that uh with Julia uh and Kirk that the the the worst is yet to come, right? I think that there's too much first of all there's too much code still out there that was still written by humans and that's full full of codes. And I think that the only reason why many companies have not been hacked yet is because the threat actor didn't put attention there yet. Today I believe that at least 95 of organization 95% of organizations if a threat actor puts real effort, time and money, they're completely gone. Uh and that's that's a huge issue.

And the also the problem that I see is that I think that even with the things that are happening many companies and many organizations are not waking up yet. Uh they they see security as like the security department how much revenue does it generate? How much? Zero. So no no we are good. We are good. We we are in a good position. We know what you're doing. Yeah. You're sure? Yeah. Yeah. Yeah. We Okay. And they're not. Uh, and I think that this is like in crypto and all around the world, right? The the attack surface is getting too big. AI tools to find vulnerabilities are too fast. And I think I expect, for example, that in the

next two years, we are for sure going to have an internet outage worldwide. Those things are going to happen for sure. And we are not prepared by by far. I think >> one of the things you often say uh publicly I think Pablo is that um 99% of losses actually happen due to OBSAC as opposed to code vulnerabilities and to Kirk's point there's been so many code vulnerabilities out there but is their exploitability in the company really a code issue or a OBSC issue? Is it like an upgradability issue or them keeping up with the patches them just not paying attention? So is it all does it all just come down to OBSAC?

>> Well, I think that there's a there's a connection and a mix there. Like as we have seen from the the last 10 biggest hacks, nine out of 10 started with a laptop being compromised, right? They start there. It's not that from that laptop then they moved all the funds. But the initial access is through a developer's laptop infected and from there maybe they say, "Okay, this company is using Slack. we found the zero day vulnerability in Slack and they start moving from there right so it's soldier engineering infections and then exploiting code maybe right we we don't know for example for the Binance case and and connected to that something that it makes me crazy is that as we as we

have said nine out of 10 attacks start with a developer's laptop infected and you ask any company in this ecosystem hey guys are you using edrs no because it's A it's a privacy issue. My team doesn't want to use CDRs. No, the developers do not want to use CDRs. The developers know what they are doing. They they are very good. They have they have been born with the internet. They are not going to click on efficient link. They are not going to download malware. They are not going to be infected. And and we are all we are all here, right? >> Eventually, we are going all of us, we are going to get infected. We are going to click on a fishing link. We are going to have a device, an account, a private key, a server, a laptop, something is

going to be compromised or it's already compromised right? But we think that that's kind of a meme or something that we say to sell, but it's not. It's it's real. >> If I can jump in here, um, if we look at where the resources are going, right, how many application smart contract core node security companies are there in web 3? Hundreds. And maybe our last Pablo, how many operational security companies are there? >> Not so many. >> Maybe maybe two. One, >> three, four.

>> There I I'll give a little shout out here and you've probably a lot of you have heard about it, but the SEAL frameworks that came out this year, there is a lot of demand that we're seeing from that side. Zero shadow is one of the auditors for seal frameworks. There's 14 of us that do that. So there are a lot more services that are trying to to think about operational security, but they're maybe in the thinking stage where they should be much further along. >> Well, uh I guess to Mood's contrarian point in the beginning, if we all know these issues, we all know we suck at all these things. Um, could this event, this $6 billion hack, be the wakeup call that finally for the 10th time, the teenth

time, wakes us up to actually start applying these things? And could it be that now this is indeed behind us and we will apply better processes. We'll have much better incident response and we'll be able to maybe even revert or stop and deter attackers from uh well from actually running away with all that money. Is is does that does that track to you at all or you think the companies haven't learned it? >> I think we are getting there. It it's always a slow journey. Um like a hack happens and not on the next day everyone has like patched their systems for it and so on. But it happens few more times and then people finally uh like get their fixed. Like you would argue

that Binance would have changed their systems after seeing what happened to Bybit, but they didn't I guess. Um but now that it has happened to Bybit, it has happened to Binance, it has happened to a couple more exchanges, uh smaller amounts. Now uh I'm more hopeful that people will change their ways and at the end of the day like it's very obvious the number of hacks, the number of vulnerabilities is going to go up. Like there's no question about it. But that doesn't mean um that the worst has to be ahead of us. Like what what we need to focus on is just minimizing the impact of an hack. Like social engineering for example like no matter what we do if someone wants to get you they will get

you. If by nothing else buy a $5 wrench attack. So like you are going to get compromised. Obviously you should try to minimize that. But you should start working in the mindset that okay you are compromised already. what can happen now. So you need to introduce rate limits, you need to introduce access controls. Like even if the hot wallet of Binance was compromised, $6 billion should not be immediately taken away. Like one, you should have fewer funds in your hot wallet. Two, you should have rate limits there. You could use smart wallets and just add uh like blockchain enforced rate limits there and bunch of other things. So it it's all about containing the compromise from here on.

If we are able to contain the impact of hacks, then I think we'll be in a much better shape. The worst is already gone. If we don't learn our lessons, then obviously there's no sky is the limit on this though. As as you said, it's learning lessons. We're being reactionary. We're we're not proactive and trying to stop these hacks before they can happen. We are waiting for hacks to occur and be like, "Oh, that was dumb. We shouldn't do that anymore." Unfortunately, that's the truth. The thing is we like engineers, security engineers imagine and think about these attacks and have built protections against these like years ago. It's not a new paradigm to not store funds in a hot

wallet or to have rate limits and so on. This existed for multiple years. There have been talks that like I have given I'm sure bunch of other people have given on this exact same attack vectors and the methodology. But the reality is that people don't care about it until like some waking call happens as we're talking about. And I think now is that waking up moment. All of the AI boom, Binance hack, FBI being involved. Finally, North Korea officially saying it's not them. So it's it's it's getting hot both from a technical perspective, but also the regulatory perspective.

Like when the amounts were smaller, it was still palatable. But like $6 billion is like 30 40% of GDP of North Korea. Now the government start waking up and they will by force or by regulations whatever will hopefully bring change for the better. So uh sir just one moment >> how do you as a leader in polygon are able to maybe push this agenda a little bit f forward in a large organization like yesterday I don't know if maybe some of you have caught it uh Joselyn had a really great talk at DSS about leadership and security starts from leadership how do you how how can you enable that in your companies and your

organizations >> yeah for sure so one thing so Pablo mentioned that like security companies see uh like companies see security department as just a department. They're looking at P&L, it's making a loss, they don't invest in it. I would say that's not the case at least in this industry. Um I like the more people I talk to, the more I realize the founders and and even the finance teams, they they understand the impact of security. They are willing to spend funds on it. They want to stay safe. Um that's why we'll see like auditors being paid $40,000 per engineering week or along those lines.

So um like people want to pay. It's it's not a money issue. Like obviously there are some companies that don't want to pay but in general it's not a money issue. It's a more awareness issue. Like >> the founders just don't know what else they need to do. They paid the top dollar to the best audit firms. They got 10 audits done. They feel they are safe and then the hack happens. So it it's not just the smart contracts and that that message has not gone across. I've been trying to convince more and more folks and honestly at least the top protocols and top companies are on similar page now. My approach just has been that um like I've tried to educate founders about the risks and so on but it's it's a fool's er it's too much like

but when I tell them hey like just get an actual security engineer sort of a V says so or someone as an adviser who can then look into your systems a few hours a week and then exactly tell you what you need what your weak points are uh what you should spend your resources on and that has helped a lot of companies like once the founders engaged in that sort of service um it opened up their mind because like like in a 5 minutes talk you can't convince anyone but if you spend a few hours make a threat model of the system show them where the vulnerabilities can be what they can be securing I found like 90% of the founders and the teams are willing to spend funds on it similar story happened with polygon I joined in 2020 December

or 21 December but basically for the job description and that point was to secure smart contracts like Polygon Bridge. That that was my goal. I came in uh day zero. I realized like that's the last thing I need to focus on and I I spend literally like 99% of my time for at least the next 3 months on other things. Um obviously I was keeping the rest of leadership uh up to speed and it really opened up their mind as well. Like it's not that they didn't want to keep things secure. They brought me in because they cared about security. they just didn't know there are so many ways in and so many things you need to patch up.

>> Is this something that lack of awareness something that you see a lot in your um engagements and just across your work Julia? >> Um in terms of outside of the onchain security. >> Yes, absolutely. Yeah. >> Uh yeah, definitely. And and that speaks a little bit to um something I want to bring up that's maybe a little a little contrarian is I actually think a lot of the um push that we're seeing for a more holistic security. It's not coming from the fear of the hacks or the lessons learned from the hacks. It's not coming from maybe the fear of the regulation.

It's coming from the want and the chase for the institutional trady money and the the banks and these larger trading firms. they just don't have tolerance for the level of you had an audit and that's all you're going to do. They're looking for really holistic risk. They're looking at how your wallets are secured. They're looking at if you have endpoint detection. They're looking at um upgradability and and they're really demanding they're asking these questions of these founders demanding these answers if they can't find it in the documentation. And so there's a lot more awareness that we're seeing on the protocol side too that if they want to

to gain some of this wealth that they should be thinking about these these larger actions and we see a lot more um stuff like not just setting up basic monitoring but doing a lot more of a holistic approach. I think uh one of the things you mentioned there with institutionals um and you know financial and large companies a lot of them care about it not just from a riskmanagement perspective for the sake of it but it's the bottom line right it's the money and I was talking to somebody earlier today and they mentioned um often times for example any one account can only have up to like x million because that's all it's insured for and then they just cap it at that then you have to move to another account and another account so I

guess insurance is a big topic in a lot of these things and a lot of these incident Is that something that you think as far as like incident response goes, is that what's driving the needle as far as like security standards, operational security? Do you kind of see insurers becoming these standard setters in the space? >> Yeah, it's it's been a really interesting topic this year. I don't know that it's fully fleshed out yet, but we're seeing a lot more insurance companies coming into the room and asking a lot more questions. Um, kind of in a similar vein like you're talking about. And, uh, I think previously insurers were not ever paying out and they said if it's not a private key leak that it doesn't qualify. And I'm seeing

a lot more conversation about what types of exploits can happen. We want to cover more. where we want to understand what the risks are that are associated with that in that similar vein to the financial institutions. Um and and that does seem to be driving part of the equation. I don't think that it's fully adopted yet. Um but but there's definitely an interest on the insurance side and that could really mitigate a lot of the risk too for for everyone because not only is it possibly paying out in the event of an incident, but it's forcing everyone to have this conversation.

>> Do you think the insurance companies are actually able to price in the probability of a cyber hack considering we're doing this right now? >> No, but I think that they're making people think about it, which is better than it was. You know, that's a good point because just yesterday I saw a tweet that a bunch of cyber insurance firms that's already that that are already under the water. Like the insurance policies they sold 2 years ago have been redeemed at a pace where like they just didn't imagine and they're just they're just bankrupt now. So that that's always a risk with insurance. The other thing is so first of all like I think insurance is is a good product.

We'll continue seeing more and more of it. But it is double-edged sword. only helps a little bit and in specific scenarios it can also cause harm in others because especially in traditional finance um insurance can introduce limitations in your system in the sense that uh sorry uh >> you can take it it's okay this okay so um yeah the way some of the insurance work is like they would sell you insurance per hot wallet. Like I'm selling you it for $10 million per wallet. Doesn't matter how much you store there and and so on, but it's it's

per wallet because from the insurance insurers's perspective, I'm securing one key or whatever. Um, now what this leads to is the uh operator consolidating all of their funds in this one wallet, which makes the situation more worse. like it's it's more likely to get compromised now than if the funds were in like 100 different wallets at a at a smaller scale. So it is there are multiple ways where there are other ways as well where insurance hurts. Um just like it increases the probability of you getting compromised. Um and that's uh that that's something people need to weigh as well. Especially earlier in the conversation we're talking about being

compromised and now we're talking about pricing and insurance. considering you are compromised and I think Baba I saw your tweet earlier uh yesterday where you're talking about how well maybe you can you can share a little bit about that but essentially it's over we're all compromised was that the gist of your uh of your post >> yeah something that I like I have a friend like when I was 15 years old I had a very big hacking website 27 years ago uh and I was hacked right with social engineering a guy contacted me and told me hey you have a cross-ite scripting Here, here you have the code to fix it. I didn't even check the code.

I uploaded it. It had a shell code. And months later, few months later, the website was defaced, right? Was hacked. This guy is one of one of my best friends. He works at Expo. And what he always tells me is you realize that you have been hacked the day that the the attacker wants to cash out for I am 90% sure that the Binance infection did not start two weeks ago or 3 weeks ago. Maybe they were like six months inside there >> because you need to have the initial access and then you need to start moving inside and and doing privilege escalation moving laterally. It's a lot

of work, right? So the thing is we have to assume again for real for real is not a meme not a joke that one of our computers one of our phones email accounts private keys servers whatever is compromised so if you already know that one of if you're really convinced and you assume something is is already compromised I have the attacker inside how do I have to work and you work in a totally different way for example I have four laptops so this is for the day-to-day Do they work? This is for owner accounts, right? The the owner of your Google workspace, the owner of your GitHub, of your register, those accounts, where do you have them in your main laptop? No, it's crazy to do that.

You have in a separate device. Where do you sign in a separate device? What phone do you use for your Apple ID? This phone number in this mobile phone number. It's not your public phone number. So, we start to do it's a lot of work, I know. And it does. The problem is that it does not scale. you we cannot ask people to have four devices right but at least if we work in this we have to do it and again we have to start thinking okay one of these things is compromised if any of them is compromised what can the thread actor do and we have to try to contain that damage right so okay I have passwords here passwords in a password manager but where do I have to in a UB key here okay perfect so they have access to this but

not this how do I protect the my cookies my this my It's it's like really complicated if if if we don't start thinking like that. I think that thinking that we are not going to be again compromised or clicking a fishing link or whatever in the next year is thinking that we are smarter than we are. And even if you're super smart, how many apps do we have in our MacBooks at least? If you don't have many things, 10 apps, 12 apps, how many dependencies do they have? Each one of them.

So in total, how many libraries and things are you running your device? Infinite amount of stuff. The probability of one of them being infected in the next year is super high. Super high. It's maybe it's nearly 100%. H So that is going to happen. So >> it's super scary at the same time because the the solution for the day-to-day user it's a bit complicated but we have to think from that point of view. I think >> to your point you mentioned something essentially about multitude of apps and any one of them can compromise and cause a catastrophe something that as a security service provider in web 3 and I think Kirk you can relate to that we

focused a lot over the last many years maybe not the last couple years but before on smart contract security right audits this fuzzing that formal verification uh and you know I think for the most part we've done a really good good job with that >> um is the target completely off now like do we just have to entirely switch our what we what we teach about you know what we talk about what we audit you know we had a lot of standards sometimes informal for smart contract security do we need to revisit standards for ops maybe supply chain how do you guys uh look at that in sigma prime >> yeah absolutely uh we've been focusing a lot on our recent audits at pushing at a

higher abstract layer where we we think about what is the whole risk to your protocol. Yes, we are just looking at the smart contracts in scope, but we want to think about what is happening like this is one key here that's controlled by that. Is that going to be secure? We'll have discussions. Okay, this key has the ability to update your price oracle. What are you doing to protect that key? Is that enough? yada yada yada. Um, and we're encouraging more pen testings and deployments and and migration skips. But I think what we we need as well is just more OPSSEAC as well. We need people to come in and do the opsex reviews on top of us doing our sort of point in time um more than just a smart contract but even just a whole protocol pen test essentially. Uh but we

still need to do the opsec as well and then once we get to that point I'll I'll start to be pretty happy. I'll sleep a little bit better at night. That's good. >> Yeah. And one more thing that we have to start thinking is that for example many people will think oh okay but thinking that your device is compromises too much this guy is >> like too paranoid. But I will say like for example who was expecting that what happened with the ledger implants could happen. >> Yeah. >> Was some did someone think that that could even happen? No. I I never thought about that that scenario for example.

Never ever. and and I I am all the time thinking about the scenarios that could happen. So we also have to assume that things that we have no idea about that are totally out of the box are going to happen. My thread model which is totally wrong was you get the ledger from wherever you want to get it. You don't even need to get it from ledger. In fact I always used to get them through some other place not to be in the ledger database right but coming from Ledger in some way. But I I I said okay if you connect it and the firmware says that it's okay it's signed it's okay that's it you don't need to open it and whatever and now what are we going to go do about that now okay we should open hardware wallets right to check them

inside but the but the the the implants are going to get smaller and smaller and you are not going to be able to detect them >> so what uh what do we do I guess I I get this question every conference like do you suggest we exit all DeFi do you suggest we exit all crypto or I was just talking about this today with someone. Assume you are a big big big cryptocurrency exchange and a genie came out of the bottle and told you next week it's it's happening. It's you're going to get tested. What do you do? How do you spend your energy? Do you spend it on prevention? Do you spend it on incident response? Do you just turn off all the servers and revisit your whole infrastructure? Um what do we do?

>> Maybe Julia. >> Easy question. I feel like I'm a little biased, but um I think really focusing on what your containment strategy is is really important because it's not really something we've talked this whole time. You can't really prevent everything. Something's going to happen. What's what are you going to do about it? Do you know who to wake up that do you know that you can be checking everything at all times? And so you get that real time notification. I did a presentation earlier that we see a lot of times first wallets are being emptied within 30 minutes of the the hack. So you have 30 minutes to really get your act together if you haven't done that in advance.

You're going to be freaking out. So it's probably a lot better to do that in advance and then you can just follow a playbook that you've already established. You already know who you're going to contact and really just focus on that containment piece. then even though there might be some type of loss, the amount that's lost, the denominator is going to be so much better. Um, and and that just preparedness can really change the multitude of an incident. >> Yeah. I also think that one part is prevention but the other part that for example s shadow are I think that the best ones doing it is like if if the industry gets really better at tracing funds freezing funds and doing that stuff the return of the investment

starts going down I mean Binance is a lot of money and but instead of getting 6.5 billion they got I don't know half of that right or 2.9 2.5 something like that so I think that that work is also super super important because if you see that okay now it's not so easy to move the money to cash it out or whatever again the Roy goes down and it's less interesting it's still the problem is that crypto is still the best asset to be stolen right by by far but we have to make like we have to do prevention we have to do onchain monitoring and then we have to trace the funds and to freeze the funds and to put an effort there to make it more difficult for them right

>> well actually challen challenge it just slightly. I think there's been a lot of um data hacks lately that we don't even find out about because when data moves, it's not on chain and you just don't know. And namely with AI training and whatnot, data is the new oil, you know, is the is the saying and you get so much data just on being sold across uh training companies so that they get that edge and become that new next AI, you know, godlike machine. So um that's also a little scary >> connected to that. One thing that I think that is also very very important to do is today like most companies for example have I don't know hyper native or

blockade to do onchain monitoring right but nearly no one is doing for example dark web monitoring right so let's say that I download some malware right or I do not download some malware I just go to brew or I update something and there was some library or dependency my machine gets infected with an infos stealer right the infos stealer is a type of malware that will my usernames, passwords, private keys, seed phrases, cookies, everything, right? That will be sent to a command and control server. They will get some stuff from my device, maybe steal money, and then that is sold in the dark web in thread actors groups, right? So, you should be paying for a service that is monitoring those groups.

And when the domain of your company appears, your name, your telephone number, whatever, you get a notification. You say, "Hey, steal from my company was infected." So you block everything, right? Nearly no one in this industry is doing that. In traditional finance, it's kind of I would say standard. Erh there's also an issue there that we are trying to solve because because we are in some way starting to do this and it's that if you want to be the first one in knowing when someone was infected you have to be like for example you you all know how I've been pound right this website where you go you put your email and it shows the leaks everything that

you see there is old stuff if you want to be the first one to know when someone was infected who do you have to get that data from >> from the threat actor, right? So you basically have to buy it from them, right? And in some way you're incentivizing their business, but at the same time when you do that, you are also stopping others from getting more money. There are already companies that have fixed this in the US and they have like the approval to do this. But again, I think that off-chain monitoring, dark web monitoring especially is super important.

>> Correct me if I'm wrong, but every time you urge a threat actor to well act, they um risk exposing themselves a little bit every time and which could maybe help uh well getting some justice so to speak. And speaking of that, and you've mentioned that as well with freezing and being able to get some money back and deterrence, right, deterring these further attacks, there has been, especially with the Binance hack some um much bigger caliber threats, let's say on an international level, even uh kind of discouraging state actors from performing such activity. Could this be one of the reasons why the worst is behind us? Could now the much bigger state actors getting involved in this

because this has crossed a certain threshold perhaps help us so that we are no longer going to see multi-billion dollar hacks and you know sadly we're probably going to see countless small hacks but could the governments and state actors actually help us against [snorts] rogue state actors? >> Yeah, absolutely. Like say for a second we take the morality out of me and I am just an immoral person. I still would probably not hack these protocols out of fear of of getting caught by law enforcement. I would still go to a bug bounty platform and claim my 5% or maybe $1,000 because they don't really care that I could steal $100 million or whatever. Um, but that is what we were lacking for uh especially state actors

like North Korea because there's there's no fear of getting caught. We know Lazarus has done so many hacks and we're like, "Look, it was you. we we point it to them and we trace it to them and then what can we do? Nothing because we we've got no authority over them. So if we can start to get authority over these people then absolutely we'd see way way less hacks because they'd have repercussions for their actions. >> Perfect. >> And they also think I think it was you that we were talking about this in Twitter of the thing of hacking them back. Right. >> Right. >> Why not? And we were talking about this and you said like the FBI should go for that. Yeah.

>> It would be okay. I think that there's something in the US. I don't read newspapers anymore, right? But I think that in the US they were about to approve something that will allow certain companies to hack threat actors or something like that. I think that that would be a great idea, right? Because why not? >> A little scary, but yes, that would be fun. >> Yeah. Yeah. But totally why why why >> in fact something that usually happens is that threat actors are good at stealing stuff, but they do not have good OBSC. Not at all. >> Right. Not at all. So maybe maybe that would be a great idea. Again, it would be like, okay, we are preventing, we are following the money and then we are also hacking you back, right?

>> It got approved. It got passed. You're allowed to do that. >> It did. >> Oh, wow. >> Zach has done a couple of these. So shout out to him if you will see like he has penetrated the circles acted as someone uh like who wants to use the network to launder funds and things like that. It's an interesting piece. Um but like all of these are just like single pieces uh that help but at the end of the day I think what what we need to focus on is adding more of these layers like it's all about layers and security like any one given layer is going to get compromised no matter what. like it gives you 99% security. You put more for resources into making it safer, maybe

you'll get to 99.1%. But you just add another layer which is also 99%, it's additive. Now you have 99.99% security. Uh this is why 2FA is so great. Like um 2FA itself, the PIN code is six digits usually. Imagine if this was just your password, six digits, so unsafe. But because it's a second factor um it it's much more safer. So similarly like data question for example like it it's hard to prevent um data being compromised as we move forward. I think more and more data will get compromised. But where we can help is just adding this layer of making data valueless for others in the sense we

have ZK now like nobody should be putting up their ID documents and signatures online for verification and so on when all of the documents can be verified through ZK most of the documents are avail I won't say most but many countries have their IDs verifiable online including UAE and India and I guess a few others so we we'll keep moving moving in that direction where we are just eliminating what an impact a compromise can have like a compromise even if like companies will keep getting hacked. We just have to find best ways to minimize the impact of the hack and at that point the hackers will just not have an incentive to do it. Um that that's the only way forward in my

opinion. It's very interesting using new and exciting technology to minimize impact and I think we've ironically haven't talked about the big one which is AI. Um Julia has has that been a big kind of game changer in like maybe incident response and things like that uh in in your experience? Has AI really also changed the game there as much as it has in vulnerability findings and you know execution? Yeah, I think we're seeing a lot more people come post incident and they have used AI to try to do an initial triage.

It's not always perfect, but I think it helps at least start to paint the picture, especially I think where it comes to some of the more complex like smart contract related exploits where it could be really hard to figure out exactly how all these systems are intertwined. Um, in terms of the tracing side too, it can it can definitely help to speed some of that up and make sure that at least like where do we need to go next? What are the the key disruption places that that can get to that answer a little bit quicker. I have seen a lot of interesting um ideas for operational security via AI. I don't know that they've really been tested yet. Maybe in a year from now we'll have a a cool conversation about how that turned out. But the idea

that you could have an agent sitting within your systems and actually pointing out, oh, that API key just leaked and you don't you want to make sure you claw that back. That kind of a more like daily system rather than that point of time audit like we've talked about earlier. >> Yeah, I went to a a web 2 AI conference quite recently and there was a lot of people implementing like AI uh detection response systems. Um the only issue they have right now is they're often getting caught by cyber guards because if you just insert into the logs this is a biochemical weapon yada yada yada then detection system gets caught by the cyber guards and [gasps and laughter] then then the attacker can go on with no detection or or response. But yes, they have started implementing these.

>> You prompt inject into the log. It's all perfectly fine. It's a test. It's a red teaming test exercise. Go on. Yeah. Um well unfortunately we're coming up to the close. It seems like the worst may indeed be ahead, but there are a lot of tools that we have ahead of us that may prevent the worst. And uh you know, knock on wood fingers crossed that's the case. Uh maybe you can uh have a little bit of a closing word and u a suggestion to the teams to what can they do so that they prevent the worst from happening. And uh again we can start with you Julia.

Um, I think thinking about what your your instant response playbook is, that's going to be my big takeaway for today. Um, at least trying to get a little bit more prepared as this hockey stick is is approaching. Um, there are a lot of good resources out there. Feel free to connect with me too if you want a starting point. Um, start to to really think about what your plan is going to be and you will be a lot better off when the incident does occur. push your application audits, so your smart contracts or or your off-chain protocols or whatever you're doing to more than just the source code. Um, make them more holistic looking at your deployments, your configurations, and everything rather than just the source

code and you'll get a far better result. So, first, if you don't have a security engineer in your team, get one. Uh, once you have one, um, then they should be looking at where they can add additional layers of security. One easy way to tackle this and look at this is just pick every individual in the company and every tool or SAS you're using and just do a scenario where this person is fully compromised like they are kidnapped they will do anything the bad actor says or this SAS or this company is fully compromised it will do whatever um like the hacker wants to do. Um once you start doing this exercise you will just naturally realize where your

dependencies are where you need to add more security more layers. Um and if you get through this exercise by saying like if no matter which single person or tool gets compromised I will be fine then you are already better than 99.99% of the of the people the hackers are going to go for the lowest hanging fruit. You will be fine. >> Yeah. uh practical suggestion would be to get for each employee a work laptop. No more personal stuff in laptops. We see that like more than 20% of companies that we audit people play games in their devices and people that are signers not people from marketing BD or developers

people that are signers right oh no I play L or this or that so work laptops and then get everyone an EDR and two UB keys it's not so expensive an EDR is $150 per year per employee nothing a UB key is $50. So $250 you get two UVs and one EDR and a dedicated laptop. That's something that it's super simple to do. It's not so much money. And the value that it adds, the difference is huge. And then obviously what Mit said like what we see a lot is that nine out of 10 companies don't have someone dedicated to security. It's a responsibility of the CTO or or some

developer that knows security. Get a security engineer. Yep. It's funny you mentioned uh gaming specifically with people on their work laptops and games. I think not a lot of people are actually aware of how close to the hardware a lot of gaming code gets. And there are like instances of u some very popular games banning cheaters on the hardware level and they brick their like GPU so they're not able to play that game ever again. Now they do it for relatively good cause for banning cheaters, but a compromised game could get much closer and could get to a hardware level and steal bites from wherever they want. So um pretty scary when you see people share their work and

personal laptops. Uh perfect. Thank you very much. We have a bunch of questions from the audience. I'll read out a few. I think this one is very similar to what I asked, but a lot more on a personal level. So what's a favorite security practice that you would suggest people take home? Like you know people like you and I on a personal level. >> Security practices for home. >> Yes. >> Well as I said like uh every year you should factory reset your device for sure. At least once a year factory reset your device or if you're not sure what you did in the last year you do a backup of your stuff. Factory reset. You start from scratch. You install as less things as possible. The less apps and things you have, the

better. Password manager for everything. But please no seed phrases in password managers. Again, we see lots of signers from multis putting seat phrases in password managers today. No backup codes, no recovery keys, nothing in say password managers. 2FA only with UB keys. Google authenticator and that stuff is not fishing resistant. So it's a nogo totally. So password managers, EDR, factory resetting the device, UI keys and obviously hardware wallet. It's the same basic stuff, >> right?

>> Than always, right? Uh and then obviously not trusting anything like scams are getting far far better. Soldier engineering is getting really really good. two weeks ago they invited me to a podcast and I thought that 50% I thought that it was real and it was not real >> but as I always do I took the the the the call from a virtual machine right as I always do so because of the fact that I know that they are going to solo engineer me eventually right that's why I always take calls from there just to be sure so we should all have that mindset >> um next one is about AI Do you think as AI becomes more

accessible and affordable to the average user, it will see an increase in hacks or an increase in secure code and less hacks? I guess will defenders or attackers benefit from AI? >> I can go on this. So this is uh one sort of maybe a hot take but I do believe like the frontier labs trying to gatekeep the security models from security researchers caused more harm than good. Um like because a attacker who has uh enough motivation and they have enough motivation is going to bypass your security rules anyway like it's either uh by just smart prompting like even uh clawed models can be bypassed. Um this is why like they don't

have 100% prevention even on the benchmarks. Um and obviously you have open weight models which can be obliterated modified uh to do the job and they are like 99% as good. So the attackers were not stopped by this but the defenders were like they were just completely banned outright rejected and so on. So the defenders just didn't had access. This is why we saw this in massive increase in bugs and hacks and exploit moving forward assuming everyone has access now uh the raw number of bugs being found is going to skyrocket. it's going to go up exponentially. Um, just because AI is great at nitpicking, finding issues and so on and we are writing more code than ever, there is a

bigger attack surface. Um, the amount the percentage of bugs the defenders are catching is also going to go up. If an auditor today catches 90% of the bugs, they're going to catch 99% tomorrow with AI. So, our defense is also going up. But at the same time, the number of bugs is going up faster. like it it has it's going to go up by a thousand times. Um which means that even after 99% bugs you catch there will be more raw hacks happening. Um that's the sad reality. There are just too many bugs. There would be more raw hacks happening uh by the attackers. um the impact of those could arguably be less but I I think there's no denying that there would be

more hacks more raw number of hacks and vulnerabilities um in the future than they are today. >> Great. I think the next two questions can be combined into one. Um first one is what is your perspective on how institutions particularly banks and other financials should approach the evolving web3 security landscape and the next one's kind of similar which is how can we establish future ready security frameworks that protect digital assets and ensure regular compliance for institutionals without disrupting their workflows operational processes uh if anybody's particularly familiar with big financials uh perhaps I imagine that sigma prime or zero shadow you guys do a

lot of work with them. >> Yeah, I'm happy to start. Maybe Julie can finish. Um, [clears throat] what we are seeing is they have a lot better risk management processes. So, we we're seeing that they're pushing better practices onto us and onto the crypto industry as general. So, it's it's actually a net positive. As much as these huge amounts of bureaucracy and red tapes involved in these processes and there's a lot of back and forth before we can ever even get anything done, there are a lot of good practices and there is benefits to the fact that these institutions and banks generally move quite slowly and take their time to do things step by step. Um regular regular requirements are coming along quite well as well. Um banks won't or

institutions won't get involved in this space without regular requirements. They just say it's too immature. we're not touching it. But these regular requirements coming on in most countries, um I know Australia, where I'm from, they've they've pushed well ahead. Um and the banks are happy to start getting involved now. >> Yeah, very similar. I would say we're seeing for institutions um trying to figure out what is their risk framework that they're okay with. So there's going to be some risk from from coming into this space, what levels are comfortable, and thinking about a lot of different things. So the onchain, the offchain, the upgradability, etc. Um, and then and then doing a test of that, thinking about a scenario of

what happens if X protocol is exploited and how do we coordinate and actually try to withdraw our funds um, if that time comes because that's such a new type of risk management and situation that they're not as familiar with. And I think that's made them a lot more comfortable with how they should actually continue to evolve in this space by just understanding that kind of groundwork that applies to so many different protocols. That's actually something related to the next question. Uh I'd be really curious to hear your thoughts on it. Dan from the ENS foundation is asking that we see attackers using lookalike ENS names and fake domains to fish users. What's the one thing protocols and foundations should do

before an attack to speed up a takedown? So, what is it that they could do to kind of prepare for these >> [snorts] >> um yeah, takedowns to speed it all up? Is there something that maybe you learned in teaching institutions and preparing them for that that we can apply in just general in the web 3 space or just across the board? >> Yeah, it's interesting that this came up because we've been seeing a lot more of this too. So um for for those who might not be aware, they're are less familiar uh traders coming in, they think they see an investment opportunity. They have to prove that they have a source of capital. And to do that test, which they think they're sending to another wallet that they control, the scammers say,

"Oh, the way this works is you just add ETH at the end of the transaction and then it will go through." and they don't realize about ENS names and that that's actually going to send to an address that they don't control and that and it's a highly effective vector. Um I think there's a few things here. um on the one hand of course education and trying to spread awareness of this this existing and being more prepared but I think also we're trying to approach this actually from from the more cryptonative side and think about what kind of protections could exist within the wallet or even from ENS itself if possible that could make this a little less um common of a scam. Yeah, I think

that also for that is hiring a company that does brand monitoring, right? >> Like chain patrol. I think that they are the best at this >> and they are monitoring I think that domains, Twitter account, Discord account, Telegram usernames, even if they are impersonating the founder or something. They detect it and they take it down. I think that it's as simple as that. If you want to start doing that yourself or your company, it's a lot of stuff. >> Makes sense. And for the last question, I think I'll combine the two as well. It's the first two. If the freeze button is available to stop the funds from draining, is it truly decentralized? And I guess a follow-up question there is, is CFI or D5 actually safer for users?

Is CDI maybe? Is it a spectrum? I can jump on that. So DI in theory is much more secure. The practical limit for security is much higher there. But the reality of today is that most of the D5 protocols are completely centralized. Uh they're not actually D5. Uh they have more risks than uh like CFI. They have no insurance and so on. So as of today, I would say 99% of D5 protocols are less secure than just putting your money in a uh in a bank in a regulated bank. Um but that is going to change over time. the theoretical limit for D5 security is

much higher and we are going to get there sooner or later. It might be in next 2 years, 10 years, 15 years, I'm not sure, hopefully sooner. Uh but there would be a point where the average D5 protocol will be much safer than the average [music]