Why a Nation State Will Always Beat the Security of a DeFi Team

Transcript

Starting today though, I think we need to talk about Drift and North Korea. So, what happened is that there was an exploit which was the biggest DeFi hack of 2026 so far, where 285 million was drained from Drift protocol on April 1st. Approximately in 12 minutes, most of which was subsequently bridged to Ethereum via Circle's CCTP. This was the second biggest Solana hack ever behind only Wormhole, uh 326 million in 2022.

And the attacks were quite complex. There was a 6-month operation where the attackers posed as a quant trading firm, met contributors at major conferences across multiple countries, deposited over 1 million, built a functioning ecosystem vault, and then struck Drift. Attack vectors were a VS Code cursor zero-day that silently executes code on file, no click, no warning. Um, and a malicious TestFlight app. By the time the exploited happened, the group's Telegram chats and malicious software had been fully scrubbed.

The attribution, um, was the DPRK, uh, their Apple JeA group. Mandiant was engaged. The on-chain fund flows traced also to the Radiant Capital hack attributed to the same group. Basically, medium to high, growing on very high now, confidence per through third-party intermediaries for face-to-face work. Equally interesting, there was some backlash around Circle.

ZackXBT said Circle could have moved faster to blacklist wallets, claiming inaction enabled laundering of 232 million USDC across its own cross-chain bridge. Um, Circle's position, as reported by CoinDesk, is that they freeze only when legally required, which is highlighting a core tension between on-chain speed and legal norms here. So, Chris, you've been in this space for a while. You yourself deal with a liquid token fund. I wanted to start by asking you, what do you make of this whole situation? What does it say about the ecosystem in DeFi right now?

Yeah, this was a really scary attack, um, because it's it was highly sophisticated. Look, when a nation-state attacks a startup, the nation-state's going to win every single time. And here you had a nation-state that put significant resources, and the one thing that we've seen time and time again is their sophistication around social engineering. What made this so scary was that through proxies, they developed in-person trust at conferences.

This is the first I've heard about. This is taking hacks to the next level, right? And no, North Korean folks didn't infiltrate whatever, uh, conference they attended. These were people that they hired to be the front, um, and it ended up being a very, very sophisticated attack. You know, you talked about TestFlight, uh, we were talking about that today. Do you stay away from TestFlight now cuz it hasn't gone through the full iterations on the App Store? Very scary stuff. Um, and then of course, on the stablecoin, we've talked about this time and time again.

When there's a hack, latency is everything. And so you have to ask yourself these real difficult problems, you know, due process versus latency, right? If you just start moving really quick and freezing and seizing everything, you lose confidence in the underlying stablecoin, that doesn't work. Not to mention the fact that you can have issues, legal issues, where if you go through the time of, uh, due process, which is the law, oftentimes it doesn't reconcile. So this really is this is something that crypto's going to have to come to grips with. And if we want to become the crypto capital of the planet, security needs to be addressed immediately. Uh, it's a known gap. It's getting even scarier. Austin, we talk

about it all the time. Treasury thinks we've got $3 trillion in stablecoins coming online. I've said over and over again, I think that's too small. It's going to be much bigger. We have $127 trillion in equities that are that are tokenizing, right? How do we address the security issue? Well, I think a few things. Number one, when was the last time we tolerated a nation-state attacking one of our other industries? Is that acceptable? It's absolutely unacceptable. That's a non-kinetic attack on our on our sovereignty and our startups. So we need a a much more robust government response.

And then the one thing that I've been talking about over and over again on the show and to anyone who will listen to me, you know it's coming, we need privateers, right? Now, these are totally different subjects, but let's talk about it. W- when we lost the pilot, we're going to talk about that F-15, uh, weapon system officer, you know, we went and we recovered those assets and in those pokes. We need a recovery program in this country, a recovery program based on private citizens who are licensed, who can go out and address that latency issue. These are what I call neo-privateers, right? Where private citizens, regulated activity, there's a hack. Guys like Zack's, uh, XBT see it immediately, right? We need these people to spring

into action and uh, and to see if they can recover those assets. Um, and and we need a little bit of policy things to get through. I'm hearing in DC, Clarity Act is making very good progress. They're keeping some things under the radar right now because there's actually a roadmap. I would love to see us get more recovery policy capabilities slipped into the bill because like we need it more than ever. It's all I'll hop in on the Circle point then and say, Chris, I think post-genius, especially after the rules are written, this is going to become significantly more clear.

And what I'll say on that is that I don't think we're going to have much of a problem and Circle will not have legal liability for freezing funds temporarily in these cases. Right? If you look at how traditional financial entities operate within the BSA, it is totally acceptable and in fact required for banks to deal with these situations by actually taking actions to verify what's going on. So if you've ever tried to send a large wire, or you've had a large ACH hit, you get that text from your bank like, "Hey, was this you?" That is essentially totally permitted. And by the way, I will remind everybody, they have frozen your funds in that moment.

They are not moving. The requirement though is that those not be particularly onerous or long-lasting without significantly more substantive, call it, weight behind that. That could be a judicial order. That could be a notice from regulators. That could be certain sort of national security concern. So they can't hold your funds indefinitely, but they can definitely hold them temporarily. I would suggest that when our regulators have finished writing the rules for genius, it should not be surprising to anybody if US dollar stablecoin issuers have legal requirements to monitor the ecosystem, and then take action in cases like this where they're going to be asked to freeze things.

The other thing that I think is a little bit unexplored territory, but I expect Drift will be where the rubber finally meets the road, is does Circle have liability here for not acting? I will remind everybody, even ignoring the pending license with the OCC, Circle has money transmission licenses in most US states. Money transmitters have to take some degree of care with user funds. They can't just give your stuff away. Like if I show up at MoneyGram claiming to be Ram with no ID and they give me $12,000 that was meant for him, MoneyGram has a problem in addition to me and Rob. And so, I think it's going to be very interesting to see how it plays out in court if somebody goes after Circle for this. And

the reason I think it's so interesting is that in this one it was very obviously some sort of hacker exploit that circulated on social media very quickly. And then there was about a 6-hour period where funds were moving through CCTP. So I think it's going to be hard for Circle to argue they didn't have adequate time. Whereas, Chris, to your point, latency-wise, if this was like a sandwich attack within a single block, then I think your standard of what's feasible and what's functional is very different. So I'll I'll go to Ram on this one saying, Ram, you have a lot of experience with wealth management banks. How would you think about the argument I just made?

Well, it reminds me of the conversation we had last week about what happens when the legal system, the regulatory framework, interacts with, uh, nominally decentralized, trustless system. You have a conflict here. Is this fintech or is this crypto 3.0? The the big innovation after Satoshi Nakamoto's white paper was DeFi. We also talked about it before. At least my view is that DeFi is a civilizational advance when you don't need to rely on a trusted intermediary to stand in between two parties. You can have a trustless exchange, which is truly extraordinary innovation. There has been much focus around DeFi.

Uh, it's an embarrassment for the industry. You know, this had protocol audits. It shows that protocol audits are not enough. Social engineering still matters. Uh, the VCs spent too much money investing in L1s and L2s instead of and trying to get the quick flip as opposed to core infrastructure that's required to build trust and safety. Institutions are going to look at this and say, "This system is immature. This is 2026." DeFi's been out since like 2020. It's 6 years later. And it's it's disappointing, um, from that perspective. I think they'll continue to focus on their own systems where they have controls, you know.

In the TradFi world, there are concepts of reversibility. People that have spent an American Express undisputed transaction with a merchant understand what that means, get their funds back, go through a dispute resolution process. They feel secure, they feel safe. There's some escrowed money somewhere. Similar things happen in institutional transactions. So, there's a lot more work to be done. Uh on the espionage side, like China's been flagrantly committing espionage on American companies for a long time. I've not seen much in the way of consequences for China. I don't think that's going to stop. This isn't going to stop, either.

These crypto protocols are honeypots for for North Korea, and they continue to have wins. What do you think about the 2 of 5 multi-sig Austin? Oh man. I think this goes back to something I've talked about in the past, which is if you have truly decentralized systems, like say Bitcoin, I do think there's at least a colorable argument, in fact, like one that I believe, to be clear, that it is decentralized, an individual person should not have liability or be regulated for the conduct on there. You know, obviously, like sanctions violations and all, but I'm saying if you lose your Bitcoin in a hack like this or something social engineering-wise, there was no

centralized intermediary that could have stepped in to save you. If you tell me it's a 2 of 5 multi-sig, I have a lot of questions about whether a protocol like that is actually, in fact, an unlicensed money transmitter. Because distinguishing this from call it immutable smart contracts, where you drop the contract, it can't be modified, you burn the private keys, like everything is gone, versus one where if you had a 2 of 5 smart like contract setup, where you have the private keys, you could have upgraded that and taken control at any time.

Chris, that feels to me like we both worked at banks, pretty bank-like, right? If I have the ability to just unilaterally seize control in that manner. And so, I think it's driving us to that discussion we had last week of what is actual decentralization? Right? And it's also going to drive home Ram's point of what is security. And you know, I've jokingly said before, crypto is speed-running the history of finance. Well, the thing they're speed-running here is why financial regulation exists. Because if you think about the framework now, nobody individually has the incentive to spend money on security, because that just detracts from like building products, marketing, partnerships. But if everybody has that cost imposed upon

them, and then all of them need to do it. And yeah. That matters. That was uh that was even more acute in the last cycle, when all these protocols were spending their money on lawyers to figure out if they were going to jail or not because of their security or not. That was a huge problem. But But like at the same time, the answer is not to blame the victim. The answer is to is to call it how it is. We had a state in, you know, attack startups. Not That's no bueno, right? And And so, that's one thing. Ram, I'm glad you're back to trustless, permissionless. I thought I lost you last week, you know, when you're talking about how everything has to be trusting and everything else. So, thank you for coming back.

Um you made a great point on reversibility. Uh we still have that on blockchain when it comes to real-world assets that use transfer agents. So, you can have a permissionless chain with a with a transfer agent that who that tracks who owns what. So, that's not the problem. And even with like stablecoins, we may not have reversibility, but damn it, we have freeze and seize. And to me, it all goes back to latency and then recovery. So, I don't think we're too far off, you know, your your TradFi standard, as you spoke about, and I totally get it. I'll also tell you that I was at a certain bank um where they made a wire that was a very, very big, and it was erroneous, and the

hedge funds who got it said, "Sorry, guys, it's mine." Uh and there was no reversibility. I think that ended up getting worked out through a settlement. So, it's not that clean in TradFi, either. I think we can expect more of this of the ecosystem, though. Microsoft's not getting these hacks. You're We're talking about moving hundreds of billions of dollars, trillions in stablecoins. Like, the standards and expectations need to be sovereign immune and institutional grade. In fact, the ethos around digital assets is sovereign immunity. So, the industry, I do think, is accountable here. And people should expect more. It's been too long.

I I'll say I agree with Ram on that one and would raise a couple of points that this has brought up, which is one, if you've got teams who are not actually decentralized and not taking security seriously, I am actually okay with them experiencing consequences for these things. If you want to [ __ ] around and find out with other people's money, you should be prepared for the consequences there. It's very different than building your own software. Two, to Chris's point, which I think is totally correct, part of the damage of the wasted opportunity from 2020 to 2024 by US regulators was not laying down standards and expectations, so that we could be interdicting this stuff already. Like, we're doing rulemaking now, we should have been doing this in

2021, and it was a dereliction of duty not to do that. Because if we'd already made clear that, guys, we count upgradeable smart contracts, where you have control of the keys, as control, the drift thing might not have happened. Just to be totally blunt, like that could have been off the table. And then three, we're going to need multiply redundant choke points, cuz Chris, you were correct. You started this by saying it is a nation-state attacking a startup. And it is not a reasonable expectation for any small to medium, maybe even large company to be able to withstand that amount of force. We are going to need an ecosystem with multiple points where we can interdict these things, because any one person will get compromised. It's much harder to

compromise like three in a row. It's a tough situation. >> Right? Se- security and centralization are often paired together, because you have those gate points, toll gates, some actor that can supervise transactions, edit the ledger. But the issue then is you give up the principles of decentralization and permissionless, trustless systems, which are more porous to attacks. And regulation and compliance will have a tendency to go towards centralization and more security breaches. So, that's like, "Well, hey, what have we built here if it's like it's you're trying to straddle two different objectives." That's that's just been the tension that keeps building over the last 5, 6 years.

I think part of that, right, to take some advice from another domain, is we really need to reduce the attack surface in crypto. If you'll notice, a lot of the hacks that have occurred are relatively complex, like smart contract-based protocols here. Right? Or it's like literal wrench attacks. Those are kind of your two vectors here. The Bitcoin chain itself has not been successfully compromised or hacked. Right? If you have a relatively small attack surface in terms of what you're capable of versus the decentralization, you've actually been winning in many ways. And I wonder if part of the lesson here is that if we're going to start building incredibly complex stuff in a decentralized form, we need

to have way better security standards before we do that, or essentially, the techno-barbarians will win. If you like this segment, please like, subscribe, and tune in every Monday at 4:30 p.m. Eastern time. I'm Austin Campbell, the host of Bips and Bips, along with my friends Ram Ahluwalia and Chris Perkins and our slate of exceptional guests. Every week, we're going to discuss macro, crypto, and the collision of worlds, covering topics that move markets and shape the financial landscape. >> Bitcoin changed how money works. Cetera changes how Bitcoin scales. With a trust-minimized BTC and a native stablecoin CTUSD, >> [music] >> Cetera enables Bitcoin capital markets with lending, privacy, Bitcoin yield,

and more. Get started at cetera.xyz/unchained. >> Etherfi is giving Unchained listeners 15% cash back on food and else. Your bank is charging you to use your own money. I switched. Go to ether.fi/unchained to claim your discount.