Why the KelpDAO Hack Is a Watershed Moment for DeFi: Uneasy Money

Transcript

Hey everyone, I'm Cain Warwick and welcome to Uneasy Money because what happens on chain never stays on chain. Before we start, nothing you hear on Uneasy Money is financial advice. We're just three builders talking about what's happening on chain and we want you to always do your own research before aping in. You can find all our disclosures at unchainedcrypto.com/uneasymoney. And before we begin, here is a word from the sponsors that make this show possible. >> Multichain Advisors is an emerging technology growth firm that has helped create 50 plus billion dollars in enterprise value for 80 plus clients over the past 4 years. They're the partner to help navigate markets. Build real traction today at multichainadv.com.

>> All right, I'm here with my co-host Taylor Monahan, security expert, Luke Connets, CEO of Pudgy Penguins, and Antarctic enjoyer, so we think. And and we have a very special guest, Odysseus, founder and CEO of Filecoin. So, yeah, thanks for joining us. Odysseus, I think this is going to be a good show for you, for all of us. So, as I'm sure everyone is extremely aware, the the biggest thing of this week has been the Kelp DAO hack, the the bridge heist. So, the the TLDR on this is it is the largest DeFi hack of 2026 so far. Um,

in in one transaction, an attacker drained over 100,000 rseth. We'll get into what rseth is in in a minute. Around about 300 million dollars and and 20% of the circulating supply of this of this wrapped eth asset. So, the the LayerZero bridge is what powered um, this RS 8 uh, kind of asset across all of the different L2s.

Um, and uh, and you know, the the attack vector and Tay, you know, you can you can jump in here because I know you tweeted like great job guys. This is like the second large hack in a row that wasn't just a simple uh, multi-sig takeover or or key management loss. Um, but uh, but yeah, this this was not a smart contract bug um, and uh, was not uh, just a simple key compromise either, right? Um, which is terrifying {slash} exciting depending on on your position. So, yeah, Tay, what's what's your take on like the the root cause here now that we've had a few days

to to let the dust settle. >> Yeah, so basically I think a lot of people, and this was the same for Drift as well, right? They just assumed that like someone got malware or something happened, the keys were stolen. Um, in this case it was it was actually quite a bit more complex. They did get on the infrastructure of of the Layer Zero and basically there were a whole bunch of web two systems, let's call them, right? And these systems all work together with the various blockchains and the various blockchain data in order to uh, assist and process the transactions that go across the chains. Um, and so in this case rather than like compromising the

key that signs the transactions, they actually um, had kind of limited access to the systems in question. They were able to get access to I guess like the what most people are familiar with is like what we call like an RPC endpoint or an RPC node, like a geth instance. Um, and because sort of the core Layer Zero, is called the DVN. It's a layer zero service system that they've built, but like anyone can run it. This is like It's like a big open source thing.

Um because the DVN relies on data from the geth nodes, which rely on data from the blockchain, when the attackers were able to gain access to the one system, they were basically able to spoof transactions. And so then the next step, you can imagine right like data goes in, it gets processed, it gets verified, all this stuff happens. If it's all good, it goes to the next step, and then that system is the one that actually uh like signs the transactions. >> And so instead of like It's worth It's worth pointing out here, right? Cuz I think this is this is an interesting kind of like unspoken, but very well-known thing in like, you know, crypto engineering

security whatever that like what the RPCs say, right? Like the RPC is a computer that's telling you what's happening what like it's translating what's happening on the blockchain. You, you know, you have the blockchain there to like protect you from transactions going wrong, right? Like the blockchain has to validate a transaction, um but the RPC is like this thing that sits in between it that says, "Here's what's happened or here's what's going to happen." And if you have control of that, you can trick people into thinking that the blockchain's doing something that it's not. Is that Is that fair to say?

>> Exactly. And so that's what happened here is that the they basically like spoofed a transaction that didn't actually exist on the origin blockchain. And so the rest of the system uh I think people got upset cuz the postmortem that they released like said the rest of the system acted as intended, but technically >> Classic response to losing uh >> [laughter] >> this is intended guys. This is exactly what >> Technically speaking It it did its job properly. It was not compromised etc. But because it was acting on bad information It signed this transaction that

ultimately went on the ethereum blockchain for a 116,000 rses even though that had not been bridged on the origin chain, right? Because the whole point of this is like if you you in order to get a transaction out here, you have to get it in here, right? And if this doesn't exist, then you shouldn't have the output. But in this case and why this is a hack and the fact is because they were able to basically get in the middle of the flow, trick the system, spoof some transactions Um And steal that money, which was a lot of money, like a lot of money and it actually was almost more money Because Once they stole that money, they then

Uh well, King, you have to explain it because I actually don't understand this part. They have the rlc. If they go to compound, they go to Ave, they go to Kyber, they swap it for Eth or they take out loans as well? >> No, so they so so yeah, I can I can speak to to this part. >> Yeah. >> I'm like probably partially responsible for some of this. I was like >> the money. >> Yeah, they they look there's there's there's a couple of there's a couple of things, right? That they they're like this looping game. We we feel like we've been sidelined from it, right? So so uh The the eth yield ecosystem, right? It's very complex.

There are a bunch of assets that are essentially like tokenized versions of what would in tradfi be a structured product, right? Like we're going to you know, uh make illiquid things more liquid by like wrapping them up and and putting them in places. And the the critical thing here is that RS ETH for reasons of looping, for reasons of like leverage, of letting people leverage their staked ETH positions and then their you know, various derivatives of staked ETH was added to Aave.

And you can use RS ETH. And and this is another kind of dangerous let's call it assumption, right? You can use RS ETH to borrow WETH which is wrapped ETH from Aave to the tune of about 90% LTV, right? So, you know, the the value of this RS ETH was was then you know, the the kind of contagion compounded because you were able to basically take this RS ETH that that you minted out of nowhere and

and essentially use it to borrow real ETH and then take that ETH and go and swap it on ThorChain into Bitcoin or or whatever. So, so personally I woke up cuz I'm in Australia and this had happened at like I want to say about 5:00 a.m. And so it was like 6:00 a.m. and I wake up and I'm in a bunch of group chats and it was just chaos. People were like, "Aave's dead. Aave's >> [laughter] >> dead. It's totally fine. The umbrella's blown up." And like I know Aave really well and I was like, "What the [ __ ] is the umbrella? Like what what are we talking about?" [laughter] Like I didn't know where there were umbrellas involved in this process, but so I had an I had an Ave loan

that is half WETH, half BTC, and I went there and I was like, "Let's see if I can withdraw." And the total liquidity available to withdraw in the core WETH market was 0.05 WETH. So, I was like, "All right, well, let's see how this plays out." >> [laughter] >> Uh that's kind of it for me. So, um so yeah, so Odysseus, what's your what what's your take on this? You have Do you have some hot takes um on any of the >> so far.

>> Yeah, yeah. So far, we're So far, we're at like layer zero bridge DVN uh sign incorrect message sign you know, message that that that was a lie sign um to mint a bunch of uh this derivative version of ETH that is available on Ave for people to use to borrow. I could go straight to Ave um and and not just Ave, Compound and anywhere else where this rETH uh asset was listed. Max borrows everything, um and that's where we are. This is This is now, you know, whatever it was, 6:00 a.m. uh Saturday for me, so like Friday night US time, I guess.

>> I don't know. >> Oh, wow. >> Yes. >> All right. So So Luca, I have some questions for you. Um what what is Like, I'm sure you guys um in abstract land um were were kind of scrambling to work out what what if any uh downstream consequences there were for you guys. Um what's the third-order ETH taking derivative ecosystem like on abstract. >> Cuz we it's kind of a little bit of a catch-22. We were so consumer-focused that we didn't work very hard in prioritizing DeFi. It ended up biting us in the butt because like a lot of the liquidity and the provisions just on a

chain like kind of required DeFi. But the beauty about I think some of our ramifications was there really wasn't many because we never had those integrations in place and we didn't really prioritize them until recently. We did shut down and just kind of froze the bridges on the Pangu side cuz there was a lot of liquidity across many different chains on Pangu and so we halted it. Uh and uh and then just internally I think like we're of the guys that dude, you're seeing a hack every day and there has to there has to be some sort of intelligence here that is giving these guys an edge that is like allowing these

things to be easier. Obviously the Mitha scare a couple you know a week ago. And so I think like the whole team over there is just on red alert on like system and processes for like if something were to happen like what are we going to do and like let's not deliberate about it, right? Like if five different code reds the the action is there. Like there shouldn't be a deliberation. There should just be action. So I think we had the we're we're trying to be proactive and just addressing like where the world is going. Uh and tentatively, you know, we just on the on the LayerZero side paused the bridges. I do want to just chime in here because I am a LayerZero maxi and just might give my piece.

>> know. That's why I'm that's why I'm curious here. You're trying to >> Yeah, I'll give I'll give you guys my take. Like I think I think Brian Pellegrino is the good guy. I mean, I've never met a more higher integrity man and anytime I thought I was going to make a mistake, he always guided me in the truest, purest direction that any human could guide another human towards. I have so much respect for him and that entire team, and I know they've gone through hell. I will take a guy that I think has the highest integrity of any man I've ever met. Sar Kian, I love you, but this guy is, you know, >> [laughter] >> bar none there. You know, if he says something happened the way that it did, I'm just going to take the guy at face value, and I'm just going to say like,

look, Layer Zero is arguably one of the most important protocols in this space. They've done nothing but best practice up until this point. Clearly seems like there was some miscommunication in something that transpired, but like if anyone's going to trust an organization or a protocol in crypto, like through and through, down to like the head of the snake and just his moral integrity, like it's those guys, right? And like whatever, you know, whatever needs to be made right, if something needs to be made right, he's going to do everything in his power, and he's going to make it right. And he's going to, you know, do whatever he needs to do to, I think, just, you know, make sure that, I think, people trust the network, and, you know, continue to use it. And, you know, I I I

just I there's no man I can speak highly more highly of, and I I my journey specifically, like I'm not here without this guy. I I would have made a fatal mistake along the way, and just his support, just from the moment I met him, like was just unbelievable, you know, through and through. And so, I'll just speak to that, and I know those guys, when this happened, these dudes did not sleep for days. They were cooped up in that office, you know, they're all in house. Nobody's remote. They they were going through and through with it, and, you know, I'll just take this opportunity, and again, I'm not the most technically savvy guy, so I'm not going to speak on the technicals or what I think is true or what isn't. I can tell you guys, though, at least from like an EQ perspective and a heart perspective, I

know they're going to do everything in their power to make >> This is an interesting point though, right? Because there were there were a lot of debates in in my group chats about how did we get here, right? Particularly when it comes to this like one-on-one DVN setup and and BD role that that, you know, LayerZero has kind of played in in this and, you know, I like I really like Brian as well and and Max and, you know, I I know a few of those guys.

They are like you know, if nothing else, like top absolute top-tier in terms of their kind of ground game and and, you know, how they how they've like rolled things out and, you know, just the support that they give for founders and, you know, all the stuff that they've tried to do. And and I, you know, I saw a lot of takes of like this is one of the reasons why they've been able to get so much traction, you know, is the like ease of deployment and BD and like all of these things, right? That maybe in in the case of like other setups, right? Would have been like more

clunky and, you know, and and harder to to roll out. But yeah, so so, you know, it's a really interesting question around like, you know, LayerZero for me, cuz I'm so old, right? Like came out of nowhere. You know, like they didn't exist and then all of a sudden they were everywhere and it was one of those crypto things of like mass adoption by projects and teams that was that was really surprising. So so, yeah. I know you dropped off at this year. So so >> Yeah, [laughter] it was a coordinated attack.

>> Give us the lowdown on I mean, there's a lot of blame games. Let's avoid the blame games. What what have we learned from this situation? What do people like layer zero but other people who are also doing asset issuance who are also doing bridging, right? How do we make sure this doesn't happen again, please? >> I think I think there's a lot of responsibility from a lot of different parties. Um you know, I'm I'm first of all I'm willing to argue that not a lot of people understand the systemic risk of bridges because you have all these IOU's sprinkled everywhere in the ecosystem.

Everything's like looped and you know, I think part of the problem is that bridges incurring systemic risk, right? Um so it's an extra fragile piece of infrastructure that we need to it's it's hard for people to grok even developers even if they're not familiar with the bridging space. Um you know, users don't have a chance. >> is in the name, right? Like we understand bridges are like pretty important things. You want to make sure they're structurally sound like there's a lot of uh work that goes into making sure bridges don't collapse and kill a bunch of people. Like you know, it's it's not uh it's not like super unclear how important a you know, bridge between two

blockchains feels like a structurally critical piece of infrastructure, right? Like that we should be very afraid of um and and mindful of. Um which we used to be back in the olden times, right? Like we were very worried about bridges when there were like three of them. Um and you know, we had we had wormhole uh you know, the wormhole hack and and you know, some other stuff that like really um highlighted it and then I think we just got so many chains and so many bridges and so many things that you know, at some point at least from my perspective we sort of lost sight of the criticality of bridges and and cross chain messaging.

>> Mhm. >> I mean, at the end of the day I think, you know, bridges like layer zero one because what the users ended up caring about is what's the cheapest, fastest way to transact. Um I don't care about trust assumptions or any of these like weird things. Um you know, layer zero moved amazingly well and super fast. Um you know, STO operators. Um but at the same time I think, you know, having a default config of, you know, uh not this the most secure like a one-on-one, that was definitely I think um I assume at least um that's uh something that resulted from like moving fast and then was never

uh you know, later circled back to actually uh you know, improve it, right? And then you have other the teams that integrate and they don't understand as well and maybe they don't do their due diligence as they should. Um so they, you know, they also uh take on that responsibility. Um and then I think it's interesting now everybody's talking about circuit breakers, which I think, you know, would not solve the problem, but that would solve the systemic problem, right? It would protect the ecosystem from having like a bank run on Ave, which is what we have right now, right?

Why you should be um you know, trapped in Ave in a very safe position where that you had you were when you had nothing to do with that more risky asset. >> Mhm. >> Yeah. >> I have a steel man your statement, Ken, and then I'll actually ask you a question just in terms of like how do you underwrite it as a guy with size who probably like has money in DeFi, but I mean just to like steel man your point, Ken, like I remember those days, but like there's been no reason why, you know, I think moving forward that we don't have um Dude, somebody's playing the piano. I'm I'm sorry. Uh >> We can't hear it. It's all good.

>> And okay, amazing. Uh, I I'm going to rectify that soon. Uh, but I think [laughter] I think from from my perspective um, like LayerZero had a ginormous bug bounty and there was no reason not to trust and and you know, even to this day like I don't look at that, you know, everyone's saying like there's so many DVNs that are one-of-ones, but like none of those have any size and most of those don't do anything, right? Like any of the major like LayerZero bridges uh, you know, have the right DVN set up, you know, there are at least more than two signers. Like >> Yeah.

>> to be frank like I I don't think this is like obviously like any situation like this like LayerZero is going to have to have a little bit of a climb, but I think the dynamic shifted a little bit partly in beca- because they've done such a [ __ ] great job for the last couple of you know, since they've basically been around and like they put their money where their mouth is. Like the it's one of the biggest white hat bounties in the world like if I'm not mistaken like they they are challenging you to break this uh, you know, and and and I and you know, again I'm not going to speak to our accountability. I'm on Pellegrino's side, Pellegrino mode, but I I I I would say that's probably why you know, it's it's you know, we we have less of an

onus on what these things you know, at least the risk associated to them because you got a group that you know, you can trust through and through. At least that's my take on it. >> Yeah, I mean the one-of-one DVN thing is is quite interesting, right? Because like you know, there are many things in crypto where it's like hey, let's get people spun up quickly. Um, you know, I mean like if you knew some of the things that went on to like get a smart contract deployed or like what it just like so many things, right? Like how dApps were hosted and we'll get there because also but all hosted on Vercel.

Uh and and so like you know, this idea that uh one-of-one DVN configuration is like, you know, the like proximate cause of all of this, like sure, yes, right? Uh but if you want to stand up a bridge and you're bridging, you know, 10 grand on your like new project and testing it out, you know, if they were like, "Okay, in order for you to stand up a bridge, it's an 11 of 34 >> Yeah.

>> multi-sig with three different like like I'm sorry, but like no three-person team is going to use that technology ever. And a three-person team becomes a 30 becomes a 300-person team, you know, so um >> I think that's a great point, by the way, as a whole. Like I'm going to going to hear me regurgitate that. >> [laughter] >> There's some truth to it. >> No, but it's it's true. It's true because the way that this these sorts of systems are are set up is like um the team is responsible for like their configs and like what they want and like they know their assets, they know their things. And then you have the DVN, which is like the system which is going to be processing this, right? Um and the team can choose to use the Layer

Zero one. They can also choose to use other ones, right? Like Blockdaemon has one. There's There's all these different like DVN providers. Um and then that's where like the one-of-one two-of-two two-of-three whatever you want to do, that's where that configuration comes from. I I don't know what happened exactly here, but I think if you go back through the timeline, I'm going to guess that most of the people that were on one-of-ones were like setting up, were trying to get this going, were trying to figure it out. >> Who like Who the [ __ ] thought KelpDAO?

>> Like and that's >> KelpDAO turns up to you, right? And they're like, "Hey, we want to set up thing." And you're like, "Yeah, sure, bro, like go nuts, right? Like, and and they've got like 50 ETH in there. And then all of a sudden it's like, oh no, actually this >> aware of this Kelp DAO Cane as like a DeFi guy? Is this like a thing? >> I've heard of it. I've I've I've heard of it. I haven't used it myself, but >> heard [laughter] of it. >> Yeah, I've I've heard of it. Like, you know, there's like there's a lot of ETH. And ETH is worth a lot of money now, right? So, it doesn't take that, you know, someone managed to get their hands on like, you know, 10,000 ETH. That's a lot of ETH, right? But it's actually shockingly not hard to get

your hands on 10,000 ETH if you're in this like, you know, ETH derivative ecosystem where there is, you know, so much looping and and, you know, um cross collateralization and like all of these different things. Like, once you get into this space, um it the systemic risk is just like through the entire thing. Um Okay, we lost Luca now. Um >> What is dude? We're >> What's going on? >> They're Lazarus is like solid right now. >> Lazarus, yes. They're firing at you, Tay, and they keep just >> Lazarus is not happy right now.

>> Yeah, it's like shots shots fired. [laughter] Um so, all right, let's let's keep moving. Um so, so, you know, >> You have to go through this part, by the way, Cain. Like, and I don't know how much time we actually realistically want to spend on this, but like So, basically what happened was like because the attacker Basically, the attacker wants ETH in the conversation. The attacker wants ETH. Eventually, they want Bitcoin, but right now they want ETH. And they were in r ETH. >> Yeah. >> So, in order to get ETH, they did this thing which causes the bad debt. And it actually might mean that like the losses are higher, like the losses sort of like realized by by the impact party series actually higher than

what the attacker stole. And I only know what the attacker stole. >> Yeah. >> But you guys have to go through the the the [ __ ] show that has stemmed from this now. >> Well, >> Yeah. >> Well, that's right. Yeah. >> I walked in and the risk doesn't seem there. How are you going about it?

>> Dude, I walked into my office on Monday and I was like, I have never been more scared have money on chain than I am right now. Like >> What's your point? >> Yeah. I've seen some [ __ ] Like, trust me, I've seen some [ __ ] like I've seen some incredibly deliberately incompetent teams do some crazy [ __ ] and I like had my [laughter] money in those protocols cuz I was like, "Ah, whatever. It's fine. Like, I'm I'm farming here." Um Yeah, like I I like genuinely I've never been more concerned have money in DeFi.

Like, there's a bunch of money that I have in DeFi that I can't get out of DeFi, right? Like, you know, I have money in there. >> synthetic >> Yeah, like but, you know, there's there's a there's an old quote from from Larry Cermak from the block, right? It's like, you know, I can't even imagine uh we can we can try and pull it up here, but it it goes something like this. I can't even imagine this from like 2020, early 2020. Uh I can't even imagine the stress that the DeFi teams are under. They have a 24/7 uh gigantic bug bounty hanging over their heads at all times, right? And also we were [ __ ] Like

That was [laughter] The the unspoken part of it is like we had no idea what we were doing, right? So, not only did we have like, you know, hundreds of millions of dollars at risk, we were incredibly incompetent and like scrambling like, you know, just do [ __ ] and like survive, right? Um I it really felt like we had gotten past that and like we had, you know, learned a bunch of lessons, had had, you know, better systems, better practices, or whatever. Um and like to a large extent we have um you know, the the thing that I I say to my team, right? It's like most businesses the world is adversarial. Right? The world is adversarial, but it is not crypto, right? Like, you know, if you run a

large web 2 company, you've got people trying to break into your systems or whatever, um but it's not crypto, right? Like crypto, they can literally kill you and your whole family like in one, you know, in 1 minute and it's over, right? Um it's the equivalent of having like vampires outside or zombies like outside of your house 24/7 like scrabbling at the windows trying to get in. Uh and it's insane, right? Uh but like then some like new zombies showed up that like have [ __ ] superpowers and [ __ ] and they're like smashing through the walls and it's like I didn't sign up for this. Uh I thought we had like

>> Yeah. >> anti-zombie defenses that we've like built up over the years and now the zombies are like mutated [ __ ] superpowers like laser eyeballs or something just like slicing through everything and it's like actually I'm I'm I'm done. >> Look, you you you've heard it from Kane here first. If you want to avoid zombies with samurai swords you know, take your money off DeFi, come park it in some Pudgy Penguin profile pictures. >> [laughter] >> There you go. >> We'll beat 6%. We'll beat 6%. At these prices I'll be I I can tell you these prices will beat 6%. All right, [laughter] just come stake over here.

Come stake even the penguin picture. Um so yeah, so so um so let's let's quickly talk about um the Ave situation, right? So um they couldn't sell the RSE. Um well actually that's not fair. They could have sold the RSE, right? Like there was liquidity um you know, in in various places to sell the RSE. Um but there was far more liquidity to borrow because of this LTV, right? So the fact that you could borrow up to 90% of the value of your RSE. Um so the big question that I saw a lot of people ask, you know, straight away is why would we allow Like why why Yeah, the borrowing side, right? Um you

know, a bunch of people said like um and I don't know that I agree with these takes for what it's worth, but like um you know, there were a bunch of people that were like the Ave core instance and a bunch of uh of these markets were like fairly stable, um you know, not super volatile in terms of like back in the old days they used to be really volatile. You'd have like um you know, interest rates spike, people would pull out assets not even to do with hacks, right? There was just like a a more a more volatile market in terms of like the borrow um lend ecosystem. Um but you know, it became billions of dollars and got a lot more stable. Um and so you know, I saw people saying why should you be allowed to borrow $200 million in one

transaction? Right? Um which you know, >> Great ask. Odysseus here knows the answer to this. Is this a thing that we can like like de-risk while not preventing people from like legitimate people >> Yeah, like is that the solution? What what's what what's your take Odysseus on how do we stop this? >> You know, we we're taking so many pages out of TradFi for everything, right? Aave is really a fund, a curator is a fund manager. So, we might as well take the circuit breakers, right? In finance, if you have something very volatile, move very fast, you pause the market to see what's happening. From a financial point of view, right? Uh in crypto, because a hack is like

you know, a physics event. So, I think we just need to have these systems where if you try to move a hundred million, and you're not like one of the trusted market makers that should allow to do that, then we don't allow you. >> When you just you can slow it down, right? Like you don't have to like ban people. I feel like I don't know. I feel like often this conversation is like it's like this like oh, a person's trying to swap a hundred million dollars and they might be bad, so then we ban them or block them. But that's not actually >> No, that's not actually what a breaker is. What you don't get kicked out of the >> Right. We can >> You just slow them down.

>> You just slow them down. >> You slow them down, you can evaluate the situation. Like there's all these >> the the thing is this is the thing, right? Like >> [sighs] >> this is the thing. You're going to be talking about this, right? But like if we do one thing >> Yeah, if you do one thing, then you get stronger. >> Then we have to do >> [laughter] >> all of the things, like >> No, you don't. >> No, you don't. We can't do one thing, Tay. We have [clears throat] to do zero things. It's >> This is this is my my favorite part about the slippery slope arguments.

There's people like we cannot do the things, because then we might do more things. And I'm like, I've been here for a decade, guys. Let me tell you. Nobody in the history of ever is like, those other people back in the day did the thing, so we must do the thing. >> They didn't even remember what we did. They >> They didn't even know >> If I If I come to someone and I'm like, by the way, they're doing a good job. They're like, well, we don't care. Like we're different. This is our competitive advantage. [laughter] And so then I go on to like you know we'll get to the Arbitrum situation. I'm on Twitter with the Arbitrum situation and people are like the slippery slope. And I'm like no no it's not a slippery slope. You guys are so rebellious and independent and like

so dedicated to not to to doing your own way and not learning from history. Like we're not [laughter] >> But so Odysseus right? Circuit breakers. What like what's your hot take here? What is the what is the kind of lowest let's say slippery slope thing that we get what's the thing that keeps us at the top of the slide >> [laughter] >> as long as possible right? Yeah like we want we want the least slippery slope right? The most frictionful slope we can find that allows us to do something like what is it? What should we do here?

>> Like you just add a little bit of friction right? So if you have a very big order you just have to break it over in a multiple transactions blocks you know in a time horizon and you know I don't think there is even a slippery slope here right? Because you're not stopping or banning anyone to do anything. You just tell them well we need some time if you do want to do that. We want some time to make sure that what you're doing you know we shouldn't kill >> Yeah I mean the already right? You could put that into smart contracts right? Like this is not like you know one of the challenges right? That that I I found a bit weird as people are saying like no no no no circuit breakers no things. There is sort of like a presumption of this is

like an off chain article or something that's doing something but like you can like smart contracts can do circuit breakers. Like it's possible. So >> It it is possible to do in a simple way but if you do it in a simple way then you you end up having a lot of for false positives like you know imagine I have it needing to pause every week. So if If want to do something more complicated that understands better the schematics of the system so that it can more you have less false positives, then I think this is where it's starting to get very expensive or even impossible in an you know, the EVM environment was not built with the security in mind, right? So it

doesn't allow you to do things that maybe you wanted to do. >> I I think I'm going to be frank. Like my stance here is like these like super purists like these principled guys that like believe in like how this should be done like the super decentralization maxi. Like we guys really just need to pick their arena and I like cuz this never made any sense to me. Like you need to just like the the bucket and the categories of like what is like consumer and mass adoption and payment rails like needs to be put here and like the like best practice for consumer protections needs to be put in place.

Like this is very obvious to me. >> Yeah. >> And if you want to be in the other arena like unfollow everybody else and go do XMR and Zcash whatever that bucket is and just stay there and like don't go for like >> Yeah. >> This is like like >> And don't touch anything else. That's >> Right. And just don't think about anything else and just stay there like like tribes exist for a reason and like like the idea that anyone's going to give somebody [ __ ] for like freezing 70 million dollars to save people from losing their money. Like the fact that you're even going to like argue that like means you commingled the two experiences. Right? Like you need to uncommingle the experiences and you need

to really pick your principles and based on those principles like like battle in your arena. Like with this idea that like you guys are in Solana trenches and the mean coins and then they're like, oh my god like you you you you you you you got away from first principles and the Cypherpunk ethos. It's like, no, you're just confused, my friend. And like, you're [laughter] not as good as you think you are, right? You're actually like are like pretending to be this like anonymous moral high integrity like guy, but like you actually don't know what you're talking about because like you just need to go play in your arena because that culture, people underestimate the psychology of what transpires when you do that. When >> It's so >> that narrative and that attacking

actually dictates decision-making from the founder and the builder. >> Yeah. >> So much so, you think your little aggressive tweet doesn't do anything. It actually does a lot. And that compounded at scale then makes people less prone to innovation and kind of sticking to what the the people or what they think the people want to do. Obviously like one angry customer is louder than 100 happy ones. So when you have 100 angry customers, it just sounds like hell's coming on you and you just want to please people and make people happy as human nature. just all so commingled and it's frankly a disaster. And so my ask to the users is like, look, I have so much respect for anybody who's principled around the decentralization

ethos and everything that's supposed to represent. I'm a huge believer it's important for humanity. We've had these discussions when it was Solana versus Ethereum. I think they perform two different functions. But if you are that guy, you need to stay in your arena and participate with people that are aligned with that ethos. Like everyone and their mom knows L2s are centralized. Like no one gets whatever, you know, >> Yeah, but it's it's it's interesting that a lot of the L2s, like for for example with the Clarity Act that, you know, the industry is really trying to push forward.

Uh people they had, you know, they have uh policy people, right? And they were making the argument that we should not be regulated. Um >> Mhm. >> as centralized service. We should be regulated as digital commodities like Ethereum and Solana, right? So, they were making these arguments from a technical point of view. Uh But, I think now the next time they make this argument, this Arbitrum event, and that's a great segue, will be used and say, "Well, guys, you did that. So, if you're in the consumer bucket, and that's great." And I think I actually I think Arbitrum will probably see an influx of TVL, right? As a user, I prefer to be there.

Right? >> Mhm. >> But, probably the regulators in the future, when they try to make the same argument, they will say, "Oh, actually, you guys have some power, so you should be regulated as like other services." While Ethereum >> And and sorry, I didn't mean to cut >> But, but they should, right? Like that thing the thing about regulation is saying like it's basically putting standards and putting a bar in place for the things that you can do and thus should do, right? It's it's it's an impact on the incentives, right? Because otherwise people would just never do them, right? That's why you have regulations, that's why you have government, that's why you have laws, right? Because otherwise people would just do whatever the hell they wanted. Um and so the thing is like if you do have more control, uh I don't

know. Yeah, that's that's your choice. You chose that. And yes, that comes with more responsibility. And in my argument is that, and I made this argument with regards to Circle and others, is that the stupidest thing you can do is beg the government to write those rules for you, right? In my opinion, that's the stupidest thing you you can do. If nobody is getting hurt, if everyone here is doing the right thing and making the right decisions, and the risk is being properly addressed, the government and the regulators aren't going to come in and do anything, right? The problem at hand is that people are not making the right decisions, they're pretending to be decentralized when they're not, then they get hacked because they have a

single key, a whole bunch of users get [ __ ] right? Billions of dollars gets wiped out, right? And then the government, because it's their job, it has to come in and be like, "Okay, how do we prevent this from happening again? Because clearly you guys aren't doing it, even though you can and you should." That's how we ended up here. >> Yeah. Yeah. All right, let's go let's go to an ad break and and come back and discuss this cuz I I have some I have some takes, right, on on the regulatory side of this and and the potential, you know, trade-off space here. So So let's go to let's go to a quick commercial break and then we'll come back and try and solve all of it.

>> Multichain Advisors is an emerging technology growth firm that has helped create over $50 billion in enterprise value for more than 80 clients like Piff, MoonPay Commerce, and Wormhole. They've worked with some of the largest and most impactful companies in the space. They're the partner you want when you're navigating markets and trying to break out from the noise. They help navigate TGEs, go-to-market, BD, and partnerships, capital markets advisory, PR, media placements, KOL activations, and more, driving execution from launch to scale. Their results are measurable.

To learn more and start building real traction today, visit multichainadv.com. >> All right, we're back, guys. So talking about regulations, talking about you know, what what the trade-off space is there, you know, and this this is maybe one of those things that like was true and is no longer true, but but I'll say it anyway. Like I came from a world of FinTechs. I've got a bunch of friends who were doing FinTech stuff. There was a big wave of like FinTech startups in Australia in like the early early 2010s, and almost every single one of them is dead.

Went nowhere. Never innovated, never did anything, um never solved any problems because of the fact that they were unable to do crazy [ __ ] um due to the regs that they were were under, right? Even as FinTechs, even, you know, it was like, "Hey, these are FinTech startups. We got to give them a lot of flexibility to do stuff, right?" And like the reality is that not enough flexibility. And so, most of them failed to innovate and and failed to deliver anything. Um you know, this is the story of like uh a lot of neo banks. You know, they end up just like getting into a regulatory sandbox and and not going anywhere.

Um so, I think the the concern that we had in the early days, right? Um was we wanted to be able to move maximally fast and do um you know, crazy stuff. And there was an assumption that the people who were around, to your point, Luca, we were all the same people. Like we all had a bunch of ETH. We knew the risks. Like, you know, there weren't like grandmothers getting wrecked in Pool 2, right? Like it just wasn't a thing. It was like very PvP, um you know, well understood. Um hacks would happen, it sucked, but like, you know, it was mainly uh participants that were, you know, wasn't it wasn't spread out to the outside

world. Um 8 years later, we live in a different world. Um you know, uh the institutions have arrived. We have an opportunity to take something like Aave out to a much wider audience. Um and like there is a strong argument that the do-nothing slippery slope cypherpunk like, you know, ethos um has hit a scalability ceiling. And and, you know, the good work that we did in the early days of being able to do whatever the [ __ ] we wanted and figure it out and [ __ ] around and like whatever has been done.

Like we've actually done that part of the curve, right? And we don't need to keep [ __ ] around and finding out. We actually know, we've like learned a bunch of stuff and the next part of this thing is like make it actually useful for normal people. >> Okay, so how do we do that? >> How do we do that? I think like for what it's worth, this Arbitrum thing is like maybe the first crack in this, right?

Like like this feels to me like a uh uh uh uh you know, one of those events we'll look back on and be like, holy [ __ ] this is when the approach changed, right? And and you know, like the fear previously from Arbitrum, fairly, right? Was if Arbitrum had started as a fintech startup, they would be dead now. The things that they did, the nonsense that went on, right? Across the L2s where pretending to like if if we had turned up to the government and said, "Hey, we're going to build this like crazy scheme and we're going to have total control over it and pretend like we don't and not do anything ever and when people lose money, we're going to

like look the other way." Like that would not have been an acceptable state of the world, right? To to propose. Um so we did it in a much uh less obvious way, didn't say the quiet part out loud, but we're now at a point where we need to actually start doing things because we're out of the existential kind of growth, you know, risk phase of like you could die. Like Arbitrum's fine. Um they're not going to die. They're big enough. They've They've got enough traction that the next question is like how do you make Arbitrum useful to everyone and they can also this like trade-off space of doing things, right? And you know, if a regulator turns up and says, "Hey, well,

you can do things, so now you're regulated." But like fine. Arbitrum can handle it. >> it's still very complex cuz and let me just tell you, if you if you if there's anyone in the space that thinks that like I did I've been awake for like the last 5 days or however long it's been, okay? I did not think that this was going to I did not think that it was going to happen. As it was happening, I still was like and we knew we're up against time. We knew that's the biggest thing, right? If we if it was a different hacker, it's interesting. If it was a different hacker, I don't think it would have been done either though. I think that this was a very unique situation. But the the time by bit started wandering that night, literally 12 hours later, and they did

not stop. For whatever reason, we got that not only the Monday, but we got a few extra hours on Tuesday, which allowed the signatures. Um and I keep saying we. I don't know why I'm saying we. I'm I'm like over the freak over here like hearing rumors, right? I'm not actually involved in this. I was like pushing and bitching on Twitter. Um >> [laughter] >> Of the nine signers, because there's 12 total signers, right? >> Yeah.

>> How did three say no? Did three sign no? >> no. Three said no. >> No. Well, did they? They just didn't >> not sign. Did three say no? >> No, they >> Yeah, and nine didn't miss to me. That's like >> Nine didn't miss to me is Dude, dude. >> You just No, it's a nine of 12. It's just like when DPRK hacks multi-sigs, right? Like you >> Dude, it would have been 12 of 12 any other time Like this is what I'm saying. Like this is like a watershed moment, right? Like go back 6 months ago, I think it's 12 of 12. Like something has changed in the like the like zeitgeist, right? Of like our you know we there was a moment I think where we thought we were winning. We were like we're getting better. Like taxes are going down. It's going to be fine. We

don't need to do things. We can do things before the bad things happen etc. etc. etc. And then we've just been like run over by a bus. >> And this is why okay. By the way, I don't know if anyone like okay. So I tweeted on Saturday or Sunday after the hack because I'm sitting there on Saturday dealing with the [ __ ] right? And we we have attributed it at this point we attributed it to trader trader which is like the big boys, the big DPRK guys. Who we haven't seen in a while. We knew what was coming. And so we're sitting there ours on the phone at like 2:00 a.m. with like a whole bunch of investigators and we're sitting there how the [ __ ] are we going to stop any of this money, right? Like any of it

because the second they start moving it's gone and we've got like 24-48 hours and then it's gone. And when I say gone like it's gone. Right now, it's gone. Like they've they've started laundering Tuesday afternoon, it's gone now right now. Right? We might get another million, 2 million like in little freezes that maybe will be recovered in 2 years. It's gone guys. Like they laundered that money successfully. It's gone. So when you're up against that and we're sitting there, the reason I tweeted was like I wanted D5 D5 because by the way, every single freaking bridge that gets hacked has told us in the past they can't do anything. And then Lazarus comes in and is like turns out it's a one-on-one and it's all on AWS.

[laughter] Okay. So I was fed up when I tweeted that, right? Like I was just I was perfectly I was just completely fed up. Like stop telling me that you can't do anything. Let's get like do anything, right? The most surprising thing about that was uh I then did you look at Twitter at all because I was like, ready for the mob to come at me. And then I started seeing notifications come in and I start seeing the hate and I was like, okay, whatever.

And then someone told me like, oh, your tweet's getting like like some positive vibes on it. And I was like, what? And so I go look closer. >> [laughter] >> My tweet. >> like And so I go and I look closer. It was funny cuz I was on a couple of threads that Lopp was also tagged in. So all the hate that I was seeing was actually like separate bit Bitcoiners hating on Lopp and I was just like CC'd. And then I'm looking at my thread and I was like, wait, people I was like, hold on, what is happening right now? I was like, >> It's shifted.

It's shifted. Like >> It's the opposite of there. >> is not Cypherpunk, right? The populace is actually aligned with consumer protections and Cypherpunk is always going to be contrary. >> It's doing the right thing and it's it's saying like, the money's right there. We see it. It was stolen from people. It's now had this huge impact across the ecosystem. It's sitting right there. Like, let's like screw this. We Lopp has been screwing us for so long. >> So let's let's actually dig into this cuz this is it's not just that funds were frozen, right? This was actually something different to the point where like group in my groups,

people were like, no, that's not right. Like that didn't happen. Like genuinely they were like, no, no, no, no, no, no. Like and then someone's like, I like I watched this in real time. Someone's like, but it's in a different address. >> It's wild. >> address. >> And by the way, it's it's not >> Like it's not in a different address. >> It's also it was it's people keep saying like, oh, just nine of 12 people signed a signature. No, no, no, no, no. That those are those are just the signers, guys. >> Yeah. >> Uh none of those signers write any code.

>> Yeah. >> Right? Let alone elegant, perfect, secure, like audited, like come up with the solution. The number I have no idea how many people like work together to make this happen. And that's why I say like even as it was happening, I didn't think it was going to happen. And I like genuinely because the number of things that had to come together for this singular event to happen is like I would say like at least like 100 people. >> So So let's let's dig in and >> Why?

>> This is like >> them for making the right decision. Let's give them flowers for flowers is correct. That was 100% the right decision. Anyone who's got their eyes I think is like >> totally lost. >> Yeah. First like And and you know, I think this is one of those things where it's it's $70 million, right? To your point, hey, there's a ticking clock. You need to deal with it, right? And the reason why most of the time like inaction is much easier, right? Than action. Like, oh, we can't you know, there were were I'm like to your point, there're probably 10 points in this chain where 6 months ago or 9 months ago or 2 years ago someone would have said, and we know like we've been in these chains, right? Where like something bad's happened and it's like we can't do

this in this amount of time. Well, we couldn't do this or the it's too hard to coordinate this and it would have just felt felt hard, right? Like the the whole thing that the chain of events that needed to happen for this to happen requires everyone believing this is the right thing and we just didn't have that consensus before. Right? Now we have rough consensus that actually no, we are going to rug the DPRK if they steal money. So So let's go into it. So Arbitrum has a security council. >> Yeah. >> Um they have a a single sequencer and and um they are reliant on Ethereum uh security, right? [clears throat] For for the economic security of their own

network. Uh but they also have a lot of control. Right. Um to the point where like Arbitrum could just shut the entire thing down. Now, if they were to shut the entire thing down, and this is this is the interesting thing here, right? Um the whole point of an L2 is that Arbitrum disappears, you can go to the L1, >> Mhm. >> and you can be like "No, no, no, I want my money back." And the L1 will be like, "Here you go.

>> [snorts] >> You're fine. We have We have all of the state that's happened over here on this other network. We can replay it. Um we've made sure that the state every single change was fair, right? Um we've got, you know, these fraud proofs. We've got all these systems to make sure that economic security of Ethereum is there, right? So, if something happens on an Arbitrum address, you send funds to the wrong place or whatever, um you can and have been able to rely on this economic security to ensure that your funds are yours.

Right? >> Yeah. >> This somewhat changes that, right? Um because >> Well, it makes it more complex. I think a lot of people and there were like when I was first asking questions, people were getting a lot of things confused because they did they do have one sequencer, right? But the underlying There's a lot of checks and balances that they have in the underlying chain. So, just because they have one sequencer doesn't actually mean that the sequencer can do anything. >> Because of the cryptography. Exactly. >> So, the sequencer cannot because of the cryptography, the underlying cryptography, right, is there. So, the sequencer itself cannot just like move money. The sequencer also cannot um it can like censor you, meaning that it

can like choose to be blind to you, which is like colloquially we'll say the sequencer freezing your funds because it's basically saying like I'm not going to include you, but but you can force inclusion. Right? So, you go back to L1 and you force inclusion from the L1. >> And that's your take on that's your take on it like they can't rug me because of >> Exactly. >> back to L1. >> And so, even though you can theoretically like get the sequencer, the guys that run the sequencer, you can force them to do things or convince them to do things, right? It doesn't like the extent of what they can do is limited because they built in these the whole the whole thing is

uh meant to be censorship resistant in that form. And that's the reason why for this situation, like that was that's not an option. Right? Like that's just not anything. >> And so, so yeah, what they what they did and like Odysseus, feel free to to >> Odysseus, do you know how do you have a good understanding of what the update was? >> Yeah, so basically the the sequencer, right? Listens to events um about what transactions should be forced included.

Um so, basically they upgraded the the the L1 contract, um the inbox as they say, and they forced included a transaction which spoofed um the address of from, right? So, they sent a transaction as if the hiker was sending a transaction which moved the funds to uh to the rescue address, right? And then they upgraded back the L1 contract to the original implementation, right? So, uh Uh, at the end of the day it's, you know, a 9 out of 12 12.

>> From the perspective of the L1, right? Um, this was a valid state transition. And so, you know, >> Yes. >> there there there's a chain of economic security that requires the L1 to be able to say, "This was an invalid state transition. The sequencers cheated, right?" Um, but there's a bridge >> Yeah. >> Yeah. >> is on L1 that is the real thing that really decides what actually happened, and they upgraded the bridge, which they can because they it's a multi-sig, right? And so, they upgraded the bridge to say, "Actually, up is down for this one >> For this little >> Yeah, for this one block, right? Um, and and so, they spoofed the transaction

and said, "This was not an invalid state transition. This was a valid state transition." Um, and then they put it back the way the other way, and then the blockchain, both L1 and Arbitrum, sees that for the rest of time as a valid state transition. >> Yep. And And by the way, my understanding about why like this route was chosen, and I give them massive props for this, is that there because there's a lot of things you can do, right? When when we're once we're in the realm of like, "What can we do to stop the $70 million?"

There there's actually like a lot of things. This, in my understanding, this was the like the one that carried the least amount of like technical risk, the least amount of like, "Oopsies, we've accidentally [ __ ] everyone else over" risk. >> Yeah. >> The the most >> rollback. It it It's the most aggressive thing that you can do, but therefore also uh >> very >> It's the safest, right? Like just, you You like it it it lift the veil of we can't do things.

We it actually, you know, it it completely destroyed this illusion that we can't do things to actually we can do anything. We can actually do anything and not only can we in a theoretical sense, we have in a very practical sense done it. It's on the chain. You can see. Like, we know Lazarus didn't send that transaction, which means like someone did, right? Which means it's nine out of, you know, 12 people >> Well, nine out of 12 that that signed the upgrade, right? Again, none of those nine of 12 are like intimately familiar with this stuff and they are actually a lot of them are auditors and security

people. So, I assume that they looked at very carefully of what exactly they were doing. >> Yeah. >> Um but again, like this is not like if you think that you can go convince nine people to do something and it'll get done, let me tell you, you're so freaking wrong. Like, it takes so much more than that because again >> Especially the nine people that would be on that multi-sig. Like, I've been on a lot of DeFi multi-sigs. Like, you couldn't get two of us to agree on something. >> Dude, even for legit upgrades, like >> [laughter] >> they're like chasing me down still to this day. Alinia is like, "Taylor, please sign your [ __ ] [laughter] shit."

>> So, so Griff who uh is a an Ethereum OG, um who's seen some hacks. He's the guy that um famously narrated the DAO hack. Um you can find it on YouTube. Uh >> Yeah, this is the second this is the second big life-changing thing that Griff has done and that was another Look, there's there is there's a lot of conversations on Twitter. I'll say this, if you put Griff on your security council, you didn't put him there to like evaluate the deep technical code is law [ __ ] You put him there because you wanted someone that was going to look at it from a holistic point of view and do

the right thing. >> If you don't if you don't want your security council to be that don't put Griff or by the way or Zach on your freaking security council. >> And so Griff said, "We did not make this decision lightly. All it takes for evil to triumph is for good men to do nothing. So today we decided to do something." And I think that quote will go down as like as I said this watershed moment of like we're not going to take this [ __ ] anymore. We're not going to pretend >> Yes. >> we can't do anything. We're going to do things when those things are good and we're going to use our own judgment and we're going to try and protect users and we will deal with the downstream consequences of that. If that, you know,

and the downstream consequences >> learn from it too because by the way I would much prefer the veil to be lifted in this situation and then them for them to like harden against it and be like wait hold on. Are we sure that this is the right like scope of people or things that have to happen for a situation like this happen or should it be harder? >> how do you optimize it, right? That's the question, right? Like now that it's happened, how do we how do we actually make sure that in the future this is not a mad scramble and and it's done. But I think it's worth there's there's some other quotes, right? That it's worth calling out and Luca you're going to love this one cuz this is like the antithesis of that, right? Um Michael from Curve

who he is one of these guys, like to your point Luca, like one of the Cypherpunk do nothing let the world burn and you know code is law people, right? Said, "Many will probably re-evaluate whether using Arbitrum is safe after this. If they can freeze anyone, hard to argue that some TradFi regulations are not applicable to the chain itself. It is not neutral infrastructure. >> Yeah, so let me just let me just let me just debate that very similarly. And Cain, maybe you could got to like identify like what what actually defines a a cypherpunk? Like because isn't that the guy that like looped a bunch of money and bought like a $30 million house and did the whole thing and like >> it was like a couple houses.

>> Right. I I I like my thing is is like like okay, cypherpunk to me is like you know, integrity and moral compass and like doing these things for the world that are immutable but safe but for the betterment of humanity. It almost reads to me uh a little bit uh I don't know why I'm blanking on the term but what Sam Altman was all about the [ __ ] um >> Effective altruist, yeah. >> Oh, yeah. >> Relatively aligned in that principle but like a little maybe a little more rebellious. So like But then I got literally [laughter] pushed out of the >> the libertarian the libertarian opponent of this, right? Um you know, is

uh is like basically property rights are you know, property rights, right? >> This [laughter] is I'm sorry. This okay. No, someone just stole your property. YOU CAN'T COME BACK AND BE like >> But but like Jamie only like the the the combination of like property rights are the only thing that anyone should care about and it's now the DPRK's property. You could you can find people on Twitter. They're like, "No, the DPRK owns this. How dare we steal it from This is theft." >> Yes. Yeah. And I'm like, "No, no, that's not >> [laughter] >> DPRK we literally you can't use a property rights argument to argue against >> But the I I I mean

that's like if somebody put a gun to my head in the street, took the watch off my wrist, and now it's his watch. Like that's insanity. >> Yeah. >> Right. No, but then you're the criminal for taking your watch back because >> Yeah, I mean, I left California for that exact reason. It's insanity. Like, let's let's be real here, people. Like, that's insane. >> Yeah. No, it's >> the funniest part for me, honestly, of the of the like and again, like this is a genuine take that exists on the timeline of people being like, "No, no, no like the code is law, the chain is the chain, you can't roll back transactions no matter who the person is because if you do, then things will happen, right?"

Meanwhile, the DPRK, they don't believe in property rights. You're like [laughter] you're like you're going to defend the property rights and like the DPRK, they don't care about your property. They're like, "These idiots are What are they doing?" Like they're [clears throat] laughing all the way to the >> They Oh, by the way, they absolutely are cuz they get money unfrozen all the time. They go convince services and by the way, when they go convince services to unlock their money, they sound exactly like the most hardline Bitcoiner that you've met. They go into the service and they literally say things like, "This is my money. You have no right to freeze it. You're violating my property rights, right? What about decentralization?

What about I'm not even kidding." And the service is so scared. >> happens all the time. >> so scared that they literally give DPRK their money back on the regular. And then people it I I can go about this all day. We're not going to do this, but all I'm saying >> take, but you know, frankly, but that doesn't sound very libertarian to me. I mean, that sounds like sounds like anarchy. It sounds like It sounds like anarchy disguised as as as libertarianism, if I'm being frank. And so, like like I I think everyone should be praising this. And somebody who I think has benefited so much off of crypto, I'm sure this Curve guy is great and like obviously Curve gauges and like everything that like they're they're pioneers in the space. Give them credit

where credit is due. But, I mean like I don't think he understands how how much he's dis-servicing the space when you're talking about a centralized L2 that nobody knows better than him how centralized L2s are, and saying that this is compromising trust because he's not understanding the network effects and his voice and the respect that so much capital has for a guy like him. It just seems like >> This is the whole thing, right? Like the lack the the the delusional take on this, right? Um like we said, you know, Odysseus was like This is people are going to want to use Arbitrum more, right? And this guy is still He's like a Japanese soldier in

like 1950 still like fighting [laughter] the Cold War, right? Like he's like he's like many Dude, like three guys, you and three other people are going to re-evaluate whether or not you want to be on Arbitrum. 99.9% of people are going to be like thank [ __ ] god that I didn't lose all my money. Thank Thank like thank these guys for like stealing back the money that I thought I was going to lose. I thought I was going to get like a 10% haircut on my like, you know, ETH savings, and instead I'm going to get most of it back. Like um I I just And again, like I And like I was this guy. Five years ago I was like we can't do anything because if you do things, then slopes and slipperiness and

>> [laughter] >> or like, you know, I but I'm like I I look at it now and and I just think the world has changed. We're in a different phase of whatever this is. >> Odysseus, what is your recommendation for teams in this space who are building things, real things, right? Centralized things, decentralized things, permissionless things. Like what is your recommendation to avoid any of these bad things from happening? >> Um you know, next time you have to prioritize between the road map and security, maybe prioritize security instead of only the road map once every 6 months.

I think I mean, you know, the space is new. Everyone is like, you know, fighting for PMF and, you know, people are dying left and right. So, it's like I think very difficult for teams to prioritize security uh because it seems so, you know, it's not going to happen to me right? It happens to other people. Um but I think now the question they need to to ask themselves is, you know, the yield I'm providing, how much better is than the 4% yield that is FDI insured that the customer will have to choose between that and mine?

Right? And I think that answers what will drive all the decisions. >> Mhm. >> Would you take 5%? >> I think it's a fair take. Like, you know, the the the like, the market will become more efficient, right? But part of the efficiency is like, having, you know, not the risk of every 200 days you get zeroed. >> Yeah, right. It's crazy. >> You need very high yield to offset the risk of total loss once every 3 months.

Like, um it's it's yeah, it's it's not um not uh it's not really high. >> It's not viable, I don't think. Like, and I think that it was it was it was a bit different when sort of like DeFi summer era where we were all moving fast, but the yield was insane, but we were also just like, yeah, you didn't park your money anywhere, dude. It was a daily thing. You wake up, you check your [ __ ] Something got hacked. It's okay, though. You have 20 other things, right? But that's not what Aave is. >> No.

>> Yeah. >> Like, like, I you know, I woke up and I was like, holy [ __ ] like, my money is at risk in Aave? Like, this is not what I signed up for. I signed up for, you know, like of course there's some risk, right? Like, you know, this is I'm not even earning yield on Aave. This is like me using it for for like borrow. I'm paying I'm a paying customer of Aave, right? I'm like, I didn't sign up for this [ __ ] Like, come on Sunny. You know, you got to you got to fix this. And and so, yeah, I think I think if we want if we want this intersection of TradFi and DeFi to be viable and scalable, we're going to have to make some changes

to how we do things. But I think the market has sort of forced this, right? Like, you can look at this and say this is like a nine people making a decision to your point say it's not just nine people. There's a lot of like this was a long time coming. It was going to be at this moment, right? Where someone chose to do something and it was going to shift the Overton window of doing things and that's happened now. And and you know, the consequences of that we'll see and there'll be, you know, some bad stuff and some good stuff.

But I just think you can't you can't unwind this now. And but the take that this will somehow cause like a mass exodus from Arbitrum is just giga [ __ ] Like it just is. Like no like >> And it's anti-productive. >> Yeah. >> Yeah. >> Yeah. >> But the second part of the tweet is true. They will be regulated. It will be risky. >> Yeah. They will be regulated. But Arbitrum this is kind of my point at the beginning. Arbitrum can handle being regulated now.

Like, whatever that looks like, they can handle it. They are a large enough organization. It's not going to cause them to not be able to, you know, bootstrap their network or whatever. They will they will adapt. They will adapt and and it will potentially be a better network for it if they have like really clear guidelines about what, you know, your your Lazarus DPRK, you know, these guys are not going to steal your money on Arbitrum is a good guideline. Like We won't let We won't let Lazarus get you.

Like we'll keep you safe from from DPRK is a >> I mean, I don't >> That's a good slogan. >> I think Lazarus will deprioritize I think all hackers will deprioritize Arbitrum. And I think that that's And by the way, when we were when Linea was first getting going, dude, Lazarus would bridge like $2 over there and I'd be like like $2. [laughter] And people were like, "What are you doing, Taylor? Like that's $2." And I'm like, "These [ __ ] need to learn that they do not they do not do not come over here." And they The thing is like you do that a few times, especially early on, and they don't. There's a thousand bridges to choose from. Right? Literally a thousand.

They're not going to choose the one that annoys them. And like I would recommend if you're building DeFi, especially as that we now know DeFi is not decentralized, you're making choices, you're doing things, I strongly recommend to take action before they are like obsessed with you and in love with you and using you every day for hundreds of millions of dollars because um they tend to hack the things that they use the most. Okay? Like they get to know you. They get to know you and then they target you because they know you. This is not They laundered a lot of private funds through Layer Zero.

Okay? >> Yeah. >> I strongly recommend that things Try to keep Lazarus away from them. Okay? If you do it, there's so many options that like it actually doesn't take that much effort to keep them off of you and it derisks not just the regulation of the government because, by the way, when law enforcement sees you, like every fed knows your freaking name, and you don't want that, right? But, it also de-risks the fact that you don't have hackers like who understand your architecture and know what you're doing and follow you on Twitter and read your words and find your weak spots.

>> Tae is like a green beret of like SEAL Team 9/11. Like, are these guys good coders? Like, are you in there and you're like, "Damn, these [ __ ] dudes are savages or are they just like bored and like have a lot of time and there's just a lot of holes in this whole [ __ ] thing." Obviously, it sounds like the Layer Zero thing was pretty impressive, but give me your like green beret like assessment on what's going on here. >> I mean, I don't I haven't done full like workup on the Layer Zero like the the exact technicals, but I will say that like I'm relatively technical.

Uh and I know a lot about the DVN now that I didn't before. Like, I've I've done a huge amount of claw searching to really get into how this thing works, right? I would say that even if I had the same access they did, I would not have figured out how to do this hack, let alone be able to execute it, even with like claw assistance. It's a pretty good one because just conceptually, architecturally, like understanding the flow deeply enough to be able to conceptually like come up with the hack and know that this will get the money out. That's like sort of step one. Step two is then actually executing and like from from what I know

because they had like they had redundant infrastructure, they had things that were being checked and balanced. You can argue that they were perhaps like too reliant on a single RPC or a single agath or whatever, but the reality was like they did have different things um in order to get them to like failover to the the ones that they controlled, they did a DDoS on the other infrastructure. Like, it was a All I'll say, like, it was a This was a pretty good hack. Um generally though, they don't do like they're it's not that impressive, but that's not because they can't be impressive, it's because uh they don't have to.

>> [laughter] >> It's not required. They can just like go like sleep around and poke around in their sleep and grab the keys. That's why I said, by the way, that's why I said earlier that I was proud of this ecosystem for having two Lazarus hacks back-to-back where the keys weren't stolen. It's not because I'm like I am. I'm proud. Guys, for like a decade, that's what we've been doing. They've been stealing our keys, and these two that we they had to do some work, and I'm proud of us for evolving at least that far. We still have more work to do, but like we got to celebrate the wins, right?

>> Yeah, they needed two battalions instead of one to pull it over. >> Yeah, it's true. >> Yeah. >> Guys, baby steps. Baby steps. >> Um thank you very much for joining us, Alintius. Um thanks uh everyone for for watching the episode. Um remember what happens on chain never stays on chain, and we'll be back next week. Until then, do your own research before aping in. >> Later, guys. >> Mhm.