Speaker 1: I'm Stacy Marie Ishmael, Managing editor of Crypto for Bloomberg News,
Speaker 1: and this is Bloomberg Crypto at Daily Bloomberg I Heart Podcast.
Speaker 1: It's Thursday, June nine. In March, two hackers stole about
Speaker 1: six million dollars from a crypto network. It was one
Speaker 1: of the biggest exploits of this asset class to date
Speaker 1: and left many investors shaken. Canada centralized financial system like
Speaker 1: crypto work if investors get spooked whenever significant assets are lost. Today,
Speaker 1: I'm joined by Bloomberg reporta Olga Karif and Bloomberg Opinion
Speaker 1: columnist Parmi Olsen for a look at the scope and
Speaker 1: effect that these attacks are having on the decentralized financial
Speaker 1: market place. Olga Harmy, great to have you here, Thank
Speaker 1: you both for joining, Thank you, thank you. So we're
Speaker 1: going to start with just some basic principles or you know,
Speaker 1: frankly crypto. I'm not sure anything ever is really basic,
Speaker 1: but algo, we're going to talk about defy hacks. But
Speaker 1: I want to start with when we say defy or
Speaker 1: decentralized finance, especially as it relates to these hacks and
Speaker 1: these exploits, what are we actually talking about. We all
Speaker 1: know how we can use a bank or a broker
Speaker 1: to make a trade or to take out a loan,
Speaker 1: And what Defy is aiming to do is to do
Speaker 1: the same thing, but without this intermediary such as a bank.
Speaker 1: So Defy uses computer code to essentially allow you to
Speaker 1: do all of the same things. Um, and this computer
Speaker 1: code can get pretty complicated, so I would be I mean,
Speaker 1: are you saying I'm borrowing money from a robot? No,
Speaker 1: you are borrowing money from another person using the same
Speaker 1: Defy app. Got it. So what this computer code is
Speaker 1: doing is matching borrowers and lenders without there being like
Speaker 1: a city bank or a Bank of America or somebody
Speaker 1: like that in between. Exactly exactly, And what makes these
Speaker 1: prone to the kinds of hacks that we've seen. We're talking,
Speaker 1: you know, six million dollars, five hundred million dollars. Why
Speaker 1: are these things happening and who are some of the
Speaker 1: folks being affected by them? Exactly? The numbers have been
Speaker 1: staggering and the users are affected. So it's very often
Speaker 1: who's affected is just the user for trying to do
Speaker 1: lending or borrowing or trading directly with each other, and
Speaker 1: the reason this hacks happen is that to avoid using
Speaker 1: an intermediary, essentially the computer code governing this apps has
Speaker 1: to get pretty complicated and it's very hard to audited
Speaker 1: and to make sure there are no bugs, that it's
Speaker 1: functioning properly. Uh In Plus the various defy apps that
Speaker 1: are out there, they're intertwined with each other and they're
Speaker 1: governed by communities of users very often, and there are
Speaker 1: so many different sort of new ways for hackers to
Speaker 1: try and steal steal funds. And you know, when you
Speaker 1: say the sums are being very large, I think in
Speaker 1: your reporting you mentioned that something like two point three
Speaker 1: billion dollars was stolen from these de five platforms, in
Speaker 1: which is a more than one thousand percent increase in
Speaker 1: the year before. And we're in two and we're probably
Speaker 1: already at that and we're only in you know, the
Speaker 1: middle of the year. Absolutely so so, just so far
Speaker 1: this year, just two hacks of ronan Bridge and wormhole Bridge,
Speaker 1: they have added up to almost a billion dollars. And
Speaker 1: you know, PARTI I would love to get your perspective
Speaker 1: on in any other I guess financial market asset class.
Speaker 1: If people were just you know, losing a billion dollars
Speaker 1: at a time that would worry someone. Oh absolutely, I
Speaker 1: think right now with what's happening to the price of
Speaker 1: bitcoin and other crypto assets, essentially they're falling. It's kind
Speaker 1: of hard to pinpoint whether that is any of that
Speaker 1: can be attributed to concerns about the security of these
Speaker 1: DeFi services, because there's this broader sell off happening in
Speaker 1: tech at the moment. It's affecting a whole lot of
Speaker 1: big text stocks. But I do wonder, you know, I'm
Speaker 1: thinking about the people who are investing in these kinds
Speaker 1: of services and the people who end up losing money,
Speaker 1: And you know, you could argue that this is ultimately
Speaker 1: just the rough path that decentralized financial services UM have
Speaker 1: to go to through to become more secure. I thought
Speaker 1: it was really telling UM with this one hack against
Speaker 1: a bridge service called Wormhole, and the developers from that
Speaker 1: service actually reached out to the hacker that robbed them
Speaker 1: and offered them ten million dollars as bounty in exchange
Speaker 1: for all the funds, of course, but also to figure
Speaker 1: out all the details on how they hacked the system.
Speaker 1: So you know, it's it's like they want justice but
Speaker 1: almost more than that, they want to learn how to
Speaker 1: be more secure. So I think this is the kind
Speaker 1: of wild West that UM entrepreneurs are operating in and
Speaker 1: investors are who are going into this. They're you know,
Speaker 1: they're like pioneers of the wild West, and and with
Speaker 1: that adventure is going to come a lot of risk.
Speaker 1: One thing I would note is, you know, the early
Speaker 1: days of banking were also chaotic. You did not necessarily
Speaker 1: have the regulatory framework that you have right now. You know,
Speaker 1: even f D I C insurance, which in the US
Speaker 1: is the idea that if your bank goes under for
Speaker 1: some reason and you have up to two fifty thou
Speaker 1: dollars in it, the government will attempt to make you whole.
Speaker 1: Like that number that two dollars was increased as a
Speaker 1: result of the two thousand and eight Final Crisis, when
Speaker 1: you know, suddenly the reality that major banks could go
Speaker 1: under became a clear and present danger as opposed to
Speaker 1: theoretical one. So we're always kind of dealing with this
Speaker 1: idea of vulnerabilities in the financial system. And although I'm wondering,
Speaker 1: are you seeing anything that is potentially going to make
Speaker 1: defy less vulnerable or are we way way way off
Speaker 1: from that. I feel that we are ways away from that.
Speaker 1: You would think that all of these apps would learn
Speaker 1: from what happened to them and you know, build more
Speaker 1: secure and robust systems. But if you look at a
Speaker 1: lot of the DeFi hacks that have happened, and I'm thinking,
Speaker 1: you know, Cream five, for instance, it got essentially hacked
Speaker 1: in the same way three times last year. Uh you know,
Speaker 1: it's the same people got hacked three time. Yeah, in
Speaker 1: the same way through so called sort of flash loans.
Speaker 1: This is where, uh you the hacker would borrow money
Speaker 1: and return it in sort of the same transaction, if
Speaker 1: you will. And so you know, when you look at
Speaker 1: this sort of things, you start to wonder. But of course,
Speaker 1: the industry is doing a lot to fix this problem.
Speaker 1: So a lot of different startups have sprung up that
Speaker 1: do code auditing of DEFY projects. They try to find
Speaker 1: different bugs and prevent hacks. But some of the projects
Speaker 1: that got hacked last year, they were audited and the
Speaker 1: auditors missed the bugs that eventually led to the hack.
Speaker 1: So nothing, you know, no system is perfect. And I
Speaker 1: think the main issues that if you want to displace intermediaries,
Speaker 1: the computer code has to get very very complex and
Speaker 1: to the point where it's just really hard to find
Speaker 1: all the bugs in it. And I think this is
Speaker 1: sort of the main problem that this industry is grappling with.
Speaker 1: You know, it's just is set up in a way
Speaker 1: that makes it more vulnerable to hackers than a lot
Speaker 1: of other services. Party you wrote in one of your columns,
Speaker 1: you know, I think it may have been in January
Speaker 1: that this exact thing that Olga is describing it seems
Speaker 1: to undermine the idea that Web three, or what we
Speaker 1: like to call Web three, is necessarily an improvement on
Speaker 1: Web two. Can you talk a little bit more about that. Yeah,
Speaker 1: And I actually really want to reiterate the point that
Speaker 1: Olga made about the complexity of the code underpinning a
Speaker 1: lot of these services. And this is what I've also
Speaker 1: heard from entrepreneurs who work on Web three services, which is,
Speaker 1: for example, that the pro one of the very popular
Speaker 1: programming languages used to make these apps UM called what
Speaker 1: is called solidity. It's a very very complex form of programming.
Speaker 1: It's very rigid and brittle, so UM coders, for instance,
Speaker 1: you know, when you're building a Web two app, you
Speaker 1: and write your code and then you can try it.
Speaker 1: You've got lots of different opportunities to let it go
Speaker 1: wrong and see where you went wrong, and then go
Speaker 1: back and do it again. You can't really do that
Speaker 1: as much with Web three services. You don't get multiple
Speaker 1: tries to get something right. You have to plot your
Speaker 1: steps out really carefully. UM and you know, something so
Speaker 1: simple as a typo UH could potentially lead to a
Speaker 1: security vulnerability, not just a glitch, but an actual vulnerability.
Speaker 1: UM and I think what again, what makes this different
Speaker 1: to Web two is that these aren't just UM services
Speaker 1: for social networking or games or anything like that, but
Speaker 1: UM people are actually storing large sums of money and
Speaker 1: so if it if there's a security breach, it has
Speaker 1: massive financial repercussions. And one thing, one other point that
Speaker 1: was made to me by an entrepreneur recently, was there's
Speaker 1: a really prevailing move fast and break things culture within
Speaker 1: Web three. Well, yeah, us in Web two by Facebook exactly,
Speaker 1: but more so now in Web three than with then
Speaker 1: with Web two, which has become much more corporate and
Speaker 1: very standardized and very very regulated or not as regulated
Speaker 1: perhaps as it should be, but certainly much more than
Speaker 1: UM blockchain services. UM and that just really um it
Speaker 1: does not reconcile with the fact that there's so much
Speaker 1: at stake financially when these services are breached. Back in
Speaker 1: a moment with more from Olga Karif and Parmi Olson.
Speaker 1: So this web two Web three conflation, before we go
Speaker 1: too far, I want to just talk a little bit
Speaker 1: more about how those things are different, because I also
Speaker 1: think it's related to you know, Olga's point about defy
Speaker 1: and and the point you are also making about complexity.
Speaker 1: When we think about Web two, we're talking about companies
Speaker 1: like you know, Facebook and social networking, or Spotify and music,
Speaker 1: or Amazon and purchases, or Evay and purchases. When we're
Speaker 1: talking about Web three, what are we actually saying. So
Speaker 1: with Web three, we're talking about services that often use
Speaker 1: coins for incentives. For example, we're talking about services that
Speaker 1: typically run on blockchains, which are digital ledgers that support
Speaker 1: those coins, and very often we are talking about just
Speaker 1: a very different organizational structure. So a lot of these
Speaker 1: apps are created by communities of users or supported by
Speaker 1: their communities of users, and so uh, you know, in
Speaker 1: many ways, the idea behind Web three is sort of
Speaker 1: giving power to the people, taking power away from corporations
Speaker 1: and giving it giving more of it to the people.
Speaker 1: But in practice the power is still largely concentrated and
Speaker 1: people who had power before, right, if if I'm understanding
Speaker 1: it correctly, a lot of the folks who are making
Speaker 1: money in Web three are the people who made a
Speaker 1: ton of money in Web two, and as a result,
Speaker 1: are you know, very well positioned to be informing those decisions. Absolutely,
Speaker 1: and basically the people who are emerging as powerhouses and
Speaker 1: Web three are venture capitalists who were also big investors
Speaker 1: in Web two's and very heavily influenced a lot of
Speaker 1: the decisions as well as coin prices Party August talking
Speaker 1: about coin prices, right, I mean, there's a there's sort
Speaker 1: of a phrase that is used both ironically and non
Speaker 1: ironically in crypto about the idea of magic Internet money
Speaker 1: and that none of these valuations really mean anything. Can
Speaker 1: you just give me a little bit of a sense
Speaker 1: of when people say, like this hack is seven hundred
Speaker 1: million dollars or this company is valued at x y z,
Speaker 1: what are they basing these things on? Well, as I
Speaker 1: understand it, they're basing it on the value of a
Speaker 1: particular cryptocurrency in that moment so something like a hundred
Speaker 1: twenty thousand ether or wrapped ether as it was when
Speaker 1: it was being transferred through a bridge, was worth three
Speaker 1: d and twenty million dollars in US dollars um. But
Speaker 1: of course that number can change all the time. And
Speaker 1: somebody who's been covering this for longer than most people,
Speaker 1: let's just say, um, and you you know so many
Speaker 1: of the people in the space, and you've watched the
Speaker 1: rise and fall and rise and fall of various things.
Speaker 1: Is there anything about this year and the hacks that
Speaker 1: we've seen, or the sizes that we've seen, the complexity
Speaker 1: that you've both described, that has surprised you in any way?
Speaker 1: You know? Um, I don't think it's surprising that we
Speaker 1: are seeing more of this hacks. Uh. It just uh
Speaker 1: more people are realizing that crypto, you know, is big,
Speaker 1: and it's going to be probably bigger at some point. Uh.
Speaker 1: And so there are more users and more money moving
Speaker 1: into this space, and of course the hackers are following
Speaker 1: the money, and so that's why we are seeing so much,
Speaker 1: so much activity. It seems like almost every week some
Speaker 1: hack happens. But but I think the bottom line here
Speaker 1: in some ways is that a lot of money, A
Speaker 1: lot of smart people are going into this space, and uh,
Speaker 1: there are a lot of issues, but also with you know,
Speaker 1: so much money and so much bring power going in,
Speaker 1: things will get worked out. That's a lot of the
Speaker 1: people I talked to feel this way. And part me
Speaker 1: just going back to your point about how Web two
Speaker 1: and Web three are the same. One of the big
Speaker 1: ways in which they're different, or at least perceived as difference,
Speaker 1: is that in general and Web two, you knew who
Speaker 1: the people on the other side of a transaction were,
Speaker 1: or you kind of knew who the company was, and
Speaker 1: you you may know who their exacts were. In Web three,
Speaker 1: you might be borrowing or lending on a protocol that's
Speaker 1: written by, you know, surely very smart, but fifty and
Speaker 1: mostly anonymous people who uploaded some stuff to get help
Speaker 1: and and had some get and had some code review.
Speaker 1: And everybody's like that seems great, but you have no
Speaker 1: idea who they are. Does this pervasive anonymity affect any
Speaker 1: of your analyses? Yeah, I think it's really um disconcerting.
Speaker 1: I mean I would be disturbed by that if I
Speaker 1: was an investor or someone who was putting my money
Speaker 1: in these services. And I even just as a journalist,
Speaker 1: like when you are looking at these companies websites or
Speaker 1: their blog posts, and I remember reading one blog post
Speaker 1: from a company that was describing what happened after they
Speaker 1: had a hack and they had this kind of war
Speaker 1: room conference call within an hour, which was pretty impressive
Speaker 1: after the breach had happened, UM, and they were describing
Speaker 1: the different UM types of people. There was like an
Speaker 1: auditor and UM there were these different the validators but
Speaker 1: no names, you know, And it's just kind of weird
Speaker 1: to me that it's kind of these beast faceless organizations
Speaker 1: are handling so much money, and I know that there
Speaker 1: are names put to UM behind the man of some
Speaker 1: of them, particularly the well known ones. UM. But I
Speaker 1: think the anonymity, particularly as this industry matures, is really
Speaker 1: going to have to change and UM, especially when money
Speaker 1: is being lost, people need to be accountable, right, And
Speaker 1: you know that that idea of people being accountable always
Speaker 1: strikes me as so fascinating, which is that when everything
Speaker 1: is going well, anonymity seems to be fine. Right, people
Speaker 1: are like this is great. We don't need to know
Speaker 1: who these people are that would be disrespectful of their
Speaker 1: talents or whatever, and then as soon as anything falls
Speaker 1: over there, like somebody called the police and have someone arrested,
Speaker 1: but like you can't arrest a faceless entity and you
Speaker 1: can't arrest a computer program. So you know, there's definitely
Speaker 1: a disconnect between those competing desires. Yeah, and I mean
Speaker 1: even like I'm still kind of trying to wrap my
Speaker 1: head around how some of these systems work. But for example,
Speaker 1: when you're doing transactions on certain networks, you have these
Speaker 1: validator nodes and the validators or like these computers with
Speaker 1: a human behind them, and UM, after one one big hack,
Speaker 1: one of the companies UM behind it said, oh, we're
Speaker 1: going to increase the number of validators from five to
Speaker 1: twenty one. But again, like we don't know who these
Speaker 1: validators are UM, and so it's very hard again to
Speaker 1: hold people to account. So that's that's probably going to
Speaker 1: be a culture shift that defied companies are going to
Speaker 1: have to go through. Well, word to the wise, do
Speaker 1: your research. Thank you Parmy, and thank you Olga. It
Speaker 1: has been a real pleasure to have you here with
Speaker 1: us today. Thanks for having me. Thank you. You can
Speaker 1: find more of Olga's and parties reporting on the Bloomberg
Speaker 1: terminal on Bloomberg dot com and follow them on Twitter
Speaker 1: at Olga Karif and at Parmi. On the next episode
Speaker 1: of Bloomberg Crypto. In January, the United Kingdom officially withdrew
Speaker 1: from the European Union. The fallout from Brexit, as we
Speaker 1: all came to know it, is still being measured across
Speaker 1: all industries. Some analysts predict it will take years to
Speaker 1: understand the full impact of this event on the UK economy.
Speaker 1: Brexit even affected the crypto market, especially as far as
Speaker 1: regulations are concerned. Bloomberg reporter to Emily Nicole sees cautious
Speaker 1: optimism among investors about the UK's approach to crypto regulation.
Speaker 1: She joins me tomorrow, I'm Stacy Marie Ishmael and this
Speaker 1: is Bloomberg Crypto, a daily podcast from Bloomberg and I
Speaker 1: Heart Radio. For more shows from I Heeart Radio, visit
Speaker 1: the iHeart Radio app, Apple Podcasts, or wherever you get
Speaker 1: your podcasts. Email your comments, questions or suggestions to Crypto
Speaker 1: at Bloomberg dot net. Follow us on Twitter at Crypto.
Speaker 1: The supervising producer and editor of this episode is Vicky
Speaker 1: ver Galina. Our producer is Mohammed faruk Zan Absdiki is
Speaker 1: our associate producer. Des To wonder At is our engineer.
Speaker 1: Original music by Leo Sidron. Bloomberg's head of podcasts is
Speaker 1: Francesca Levy n T. The Stablish It and Its Bad
Speaker 1: in the sid