Who's Really to Blame for the $290M Kelp DAO Hack?

Transcript

Perhaps unsurprisingly, layer zero and KelpDAO are now fighting with each other. Um Layer zero said KelpDAO chose a one-of-one DVN configuration. A hardened setup requires consensus across multiple independent DVNs. KelpDAO countered Layer Zero's own quick start and GitHub defaults point to the one-of-one structure and 40% of Layer Zero protocols use it. Um third-party analysts are to be honest blaming largely more Layer Zero here. So, Zac Rines of Chainlink uh 0xngmi, The Defiant, and Dune Analytics and uh Euler have all said single verifier setups have always been

centralized oracles. So, I'm going to start right here before we get into some of the downstream economic implications of this of what do people make of this specific attack, the sophistication, how the setup was done. Michael, I see you nodding. Do you want to start? Yeah, sure. I mean, this is is clearly a sophisticated attack. There's there's no doubt about that. I mean, uh yeah, changing the binaries, managing to carry out a DDoS at just the right time, and being able to um yeah, then trick the trick the RPC nodes into to essentially providing a false view of the world.

It's all quite sophisticated and clearly uh I think yeah, it looks like a nation-state level. So, I don't know if Lazarus attribution is probably correct. Um Yeah, I think I've I I think there's I think there's all sorts of like uh issues here with the with sort of like risk and I wouldn't lay it all on Layer Zero, although I do agree that uh the the yeah, the the default setup that's kind of uh out of the box for people to use is is probably not great and and I think it's something like 40% of people do tend to use that setup. And so, they're saying it's mainly it's mainly the the the fault of KelpDAO for not sort of uh modifying that and going going further.

But, uh I think there's there's some truth in that. Obviously, the 60% of people including Euler and all these other projects that decided to use more uh DVNs, but uh yeah, certainly certainly there's some uh there's some blame across all parties here, I would say. Chris, you've been in this space for a while. You've both had to invest in projects, evaluate projects, invest like trading setups, like evaluate those. What do you make of this hack? What does this say to you about where DeFi is now? Yeah, I think I think that we have a lot of challenges right now in the space. Um And again, what have we lost like 600 million in this month alone? Um I'm not the type of guy who's going to point

fingers at Layer Zero or KelpDAO. Let's point fingers at the people that really deserve it. And that's the the criminals that perpet that perpetrated this attack. Right? And what have we done? We continue to allow people to operate and attack our protocols without an all-government response. I think it's unacceptable. I've been talking about this forever. But like, why are we blaming the victims again? Yes, could they have been stronger? Absolutely. Yes, it's a very harsh environment. Um but when I'm walking down the street with my wallet and someone steals it from me, you know, those are the persons that need to be held accountable. So, like I think it's I think everyone's going to point fingers, this and that.

But why are we letting these threat actors destroy and impede our protocols? Like I think it's unacceptable. I think we need a whole-government response. I think we need to take action and clarity. It's completely completely unacceptable. We cannot tolerate this. We want We want innovation in this country? Then we need accountability when people are trying to attack it. We need to put them on defense. Um Anyway, that's what I'm trying to say. Sorry, go ahead. Well, look, Mithril is is both an opportunity and a threat. Right? There are Someone's cat is very excited right now. But um But but look, as AI comes into into effect, it's going to provide brand new threat vectors, ones we've never heard of. But we have to be in front of that as well. So,

look, I think um it's going to take a while for confidence to be restored. What do investors care about? Investors will take market risk all day long. What they won't take is operational risk and cyber risk. And so, we got to be very very careful. So, Chris, I'll ask you this as we look at clarity and I know it's a topic that you've had things to think about before. And Ram, Michael, feel free to pile on here. One important part of this is clearly like privateering in your case. That is to say, when these these assets are stolen deputizing people to go after them get them back and return them in a way that is now legal. But secondarily to that, what other fixes do we need in

the ecosystem right now? And you know, one of one of the things I observe is security in spaces like this have been a traditional tragedy of the commons type problem. That is to say, it needs to be done for everybody, but individually many people don't have the incentive to spend on it if their competitors are not also spending on it. How do we get to a point where greatly hardening these systems and responding quickly is also the norm? Let me just add one other thing. The one thing that was pretty good here was that KelpDAO was able to take action within 46 minutes.

Um that's an eternity, actually. But, what we talk about all the time here is latency matters. At least they were they were able to prevent incremental I mean, other incremental hundred to two hundred million dollars of being of being stolen. So, so I think that is a very that's a Everything when you're dealing with security comes down to latency. So, so Ram's point, we need to be much more aggressive with agentic activity, agentic defense. And frankly, um we need to be much more on offense. I've been talking about this from day one. We need to have our private sector supporting the security of our infrastructure. Yeah, let me uh layer on here. We Last week we talked about Mythos AI.

I did some more homework on it. It is it is really quite remarkable. So, Mythos from Anthropic uh was able to identify security vulnerabilities in BSD Linux, which it then battle-tested out there for decades. And so, a lot of these Fortune 50 companies are using Mythos to identify security vulnerabilities and protect against that. The point is that these nation-state capabilities will be in the hands of corporates and then individuals within 1 to 2 years because of the democratization of AI.

So, it's a significant thing. It's a disappointing setback. DeFi is what? Like 6, 7 years old now. You're still getting these hacks. It's hard to have confidence in the system when that happens. I think people are going to stick in the capital markets world and the ETF world because they value security first. Um I do think you you know, yes, like hold governments accountable. But, what are we going to do in North Korea? They already have sanctions. They're already a pariah of the international system. It's hard to find what the marginal response is.

Yeah, I think uh But, this is this is not North Korea, right? This is not North Korea. It's Lazarus Group. Right? Why are they saying that? It's a criminal organi- Let us say it's a criminal organization. We wouldn't attack as a nation-state. >> directly connected to the DPRK, though? I know. Aren't they essentially an arm of the DPRK? Of course they are. But, I'm saying is DPRK has to have plausible deniability cuz they're a nation-state. We need to We need to shut down Lazarus Group. Bottom line. I think you know Part of this, I'll be real quick. One is fight hack with AI is one. Like, of course. But, we need this technology. We need it yesterday. And it's not surety.

The second is how do you create surety? Can use other technologies and insurance and reserve pools. You know, in insurance market we have reinsurance, for example. There's a Berkshire Hathaway. They would collect a fee for fighting that insurance. How do they underwrite it? They perform their own security assessment. They just like a ratings agency. They'd rate it. They'd assess the protocol. They stand behind it. Collect a fee for that. That's a free market response to this. And that can instill confidence and trust. I don't Michael, we should talk about this. So, you know, in derivatives we have guarantee funds, right? Where we have socialized losses in case of extreme tail risks. Maybe that's the solution. Maybe we should start having these pooled type solutions to your point. It's It's It's a take on

insurance, but it's a market-driven socialized uh risk approach. The the So, if a few points just came back, I mean, I think the uh you know, finding Lazarus is very very difficult. You know, you've got some fantastic people I I've worked with uh law enforcement before. I mean, there there there are people out there really trying. It's just a really tough challenge. And the other thing is that in DeFi, there's nowhere to hide, right? In the the in in the years gone by, it always used to be a smart contract exploit. You know, in my early years in DeFi back in 2020 and sort of up to 2023, it was all smart contracts. You can throw out there public and that's something to be celebrated cuz it means that uh everybody can verify the code exactly exactly what it's doing.

But, it also leaves you with uh very little wiggle room. Uh there's no margin for error. Um people are spending a tremendous amount of money. You know, Euler, we spend millions and millions of dollars on on on security. But, there is really just no room for error whatsoever. Um You You do tend to get One of the arguments I used to make about DeFi was that you would get a kind of uh antifragility emerging from protocols that had uh uh vulnerabilities would be exploited and would kind of fall away. And the ones that remained would get this, you know, so-called Lindy effect. And they'd be the ones that you knew weren't exploitable cuz their code's right there and they they've helped billions of dollars and you know they can't be exploited. I think this um this kind of attack was was quite different and the with the kinds of

attacks that we're seeing now are quite different. A lot of them are kind of key leaks. So, people losing access to their private keys or or sort of like leaking infrastructure. And then this one was more sort of infrastructure level as well. Uh it was a very very I wouldn't say an entirely different class. It's nothing too novel. But, the the way it's being carried out now, it's not all at the smart contract level. Well, I think we're actually seeing quite a hardening of of protocols. Um on on AI, AI is a great tool, but it's it's it's an arms race, right? It's it can be used by the good guys and the bad guys. I do think I think the teams need to be using it much more on auditing end to end absolutely everything using AI and getting their hands on the best possible

tools. I think uh you see a lot of security firms are working to bring these tools out now and then increasingly teams are using this, but it's also in the hands of the bad guys and it's uh they're very very effective operators and it's speeding up their ability to to attack things as well. And then yeah, the last point on the uh on the pools model and the insurance and all the rest of it, one thing I've I sort of said to somebody today on social media was uh a lot of a lot of the mechanisms and a lot of mechanisms we have in DeFi today are kind of legacy from a period where you weren't really allowed to introduce centralizing elements into the systems. So, people have been asking, you know, why are there not uh more monitoring systems and pause

functionality and uh more control effectively. And part of that comes from this uh you know, regulatory stance it from the past where you had to uh be fully decentralized and zero control because any any any amount of control you did have would uh would lead to persecution by the regulators. So, as that stance has sort of softened and changed, I do think we'll start to see quite a big difference in how protocols are built up now and and the level of and the you know, the the the kind of um the kind of systems they have in place to firstly prevent attacks and then once that if an attack has happened, as you said, then how how do you actually go about the process of socializing that?

How do you how do you who who organizes that? Who's in charge? I think now it's hopefully going to be easier for teams to actually step up and say, "No, here's the system. Here's how it all here's how it work. We're in charge. We'll do this." I mean >> I think you could have decent I'm going to jump in. I think you could have decentralized socialization of risk. I I honestly do. Um and the way that it would work would be you create a pool. And and I think most of the perp decks they should do this too because I hate this concept of ADL and the winning. It should be at the end. But essentially you you you create a pool. Uh and the pool members benefit from the yield of the protocol or they benefit from uh the revenue of the protocol, however that protocol may

work. A pool's created. You can flex the pool. You can make it bigger with higher yield. You can make it smaller with little yield. And if there are certain, you know, A equals B, if there is a hack, boom, that's the pool that becomes at risk. And if provided that that's fully transparent, I think theoretical theoretically it's very very possible, but we just haven't seen that yet. Really We've seen We've seen nuances about it, but like not really uh anything codified or anything hardened. I mean, one of the things that's interesting here to me is people start speaking about insurance for these protocols as insurance comes along with underwriting and it comes along with restrictions, right? And I'll tell you right in the current day, if you look at what most insurance or reinsurance companies would charge you for DeFi, you're not

going to like the quotes. And I think that is Yeah, I think that is an I mean, there are people who will give them to you, but I've seen the prices and they're an accurate reflection of risk, right? Like how do you feel about a 30% per annum premium, right? Like oh well, why are you even buying something at that point? But the reality is Chris, as an extension of what you were saying, whether it's decentralized or centralized, the nice part about insurance pricing is it's going to be pretty functional and experience rated. There were structural upgrades we need to start making to crypto because we have to start you know, and and I think this feeds into the point that Michael you were

making earlier about working in legacy frameworks. The belief that transactions are call it optimistically correct has to be discarded in this environment. We are clearly getting enough hacks that all large transactions should probably be viewed with some degree of skepticism. And I don't know if that means delays withdrawing from protocols, choke points on bridges, needing significantly larger shares of votes to move assets. Like there are many ways to do that and not all of them are implicated by having one centralized party that controls things, but I would say without a multiply redundant risk framework, I have a lot of doubts that

we can solve that problem. And the reason I say that is as you look at the sophistication of some of these attacks, again, we're talking about like poisoning a bunch of like RPC nodes at the same time we're doing a DDoS attack, at the same time we've compromised like this is not trivial stuff to defend against. If we're saying it's nation-state actors with their tremendous resources against individual protocols, the protocols will lose with certainty. However, you can still flip that security framework on its head if we make it a chain of things that have to fail with a redundant response across the ecosystem cuz the Lazarus Group breaking a single protocol is

relatively easy, but breaking eight protocols simultaneously, all of which work differently, becomes so complex that if they're capable of doing that, essentially the chain is unusable at that point. And so, I would say DeFi, if you're thinking about how to get insurance and how to build things has to stop operating from the framework of we assume transactions are legitimate. That has been my major takeaway of the past few hacks in a row of just like starting all the way back with Bybit and then another partial interdiction, which was the Cedis hack. We just had KelpDAO here. We've had like attack after attack after attack.

And to me it raises the question and I'm curious, you know, for the rest of the group, do we have to change our default like thought model of transactions are legitimate? If you like this segment, please like, subscribe, and tune in every Monday at 4:30 p.m. Eastern Time. I'm Austin Campbell, the host of Bits and Bips, along with my friends Rom Allawalia and Chris Perkins and our slate of exceptional guests. Every week we're going to discuss macro, crypto, and the collision of worlds, covering topics that move markets and shape the financial landscape. If you've been loving Bits and Bips, [music] don't forget that the show is transitioning to its own feeds on X, YouTube, and your favorite [music] podcast player. If you're not already subscribed to Bits

and Bips on its own channels, go there now and hit [music] that subscribe button so you can keep up with our twice-weekly live streams and macro meets crypto breakdowns. Bits and [music] Bips will only be on the Unchained feed for a few more weeks, so subscribe today to be ready for launch. You can get all the links at unchainedcrypto.com/bitsandbips.