WEBVTT - It's Sleuths vs Hacks, With Billions on the Line 0:00:02.520 --> 0:00:05.840 This is Bloomberg Crypto, a daily Bloomberg I heart podcast 0:00:06.280 --> 0:00:09.440 and I'm Stacy Marie Ishmael, managing editor of Crypto for 0:00:09.480 --> 0:00:27.800 Bloomberg News. It's Monday September. Today will explore a sector 0:00:27.840 --> 0:00:32.680 of the crypto universe that's booming. Companies that specialize in 0:00:32.760 --> 0:00:40.000 finding vulnerabilities in software and code are flourishing. Why? Because 0:00:40.000 --> 0:00:43.920 crypto hacks and frauds are themselves booming, with some estimates 0:00:43.960 --> 0:00:46.920 as high as two billion dollars and losses stemming from 0:00:46.920 --> 0:00:50.240 these kinds of attacks. So the people who know how 0:00:50.280 --> 0:00:54.040 to stop hacks from happening, who have specialist knowledge and 0:00:54.120 --> 0:00:57.639 understanding and expertise, they're really raking in the cash right now. 0:00:58.280 --> 0:01:01.640 Bloomberg reports Olga Karif, somebody is going through the code 0:01:01.640 --> 0:01:06.360 line by line, essentially checking for any bugs, and senior 0:01:06.440 --> 0:01:09.080 editor and Arera so you have then white hackers, which 0:01:09.080 --> 0:01:11.640 are the good guys who are trying to hack Um 0:01:11.800 --> 0:01:13.960 your project and obviously not steal the money, but just 0:01:14.040 --> 0:01:16.520 to prove that there is a problem. Join me now 0:01:16.640 --> 0:01:27.200 for more about these crypto sleuths. It's always such a 0:01:27.200 --> 0:01:29.160 pleasure to do these episodes because I feel, like you know, 0:01:29.200 --> 0:01:31.240 we've got like three different time zones happening at the 0:01:31.240 --> 0:01:34.480 same time, and folks, folks all around the world, which is, 0:01:34.520 --> 0:01:38.600 I think, an appropriate entry point for this episode because 0:01:38.680 --> 0:01:43.040 it covers, or will cover, crypto sleuths who are operating 0:01:43.120 --> 0:01:47.080 from all different corners of of countries and cities to 0:01:47.280 --> 0:01:51.160 try to stop hacks and scams and other bad things 0:01:51.200 --> 0:01:55.160 from happening Algo. What was the origin of this story, 0:01:55.240 --> 0:01:58.000 like how did you kind of come across these folks 0:01:58.080 --> 0:02:02.320 and why are they gaining in Popu larity right now? Actually, 0:02:02.760 --> 0:02:06.720 it was Anna's idea. There we go. Might the question 0:02:06.840 --> 0:02:09.239 for her. I don't know. I love when like editors 0:02:09.240 --> 0:02:13.480 are coming up with stories. So yeah, so thank you, Olga. 0:02:13.800 --> 0:02:16.240 You could have just run with it. I would have 0:02:16.240 --> 0:02:20.200 been fine. So I was actually interviewing. It was like 0:02:20.240 --> 0:02:22.240 maybe my first week here, and I was speaking to 0:02:22.320 --> 0:02:25.440 someone who just raised money for their new defied protocol 0:02:25.600 --> 0:02:26.960 and I asked what they were going to spend the 0:02:26.960 --> 0:02:30.360 money for and he said security, security, it's been so 0:02:30.400 --> 0:02:32.399 expensive and it's one of the people we quote, so 0:02:32.800 --> 0:02:35.799 the founder of Morphol Labs Um who said they spent 0:02:35.960 --> 0:02:39.200 so much money, who told me in a telegram message 0:02:39.200 --> 0:02:41.320 with many ohs. Yeah, that is the actual quoting stories 0:02:41.360 --> 0:02:47.880 like us, Oh, while for emphasis. Yeah, so you know, 0:02:48.280 --> 0:02:50.440 he brought it up and so I thought that's really interesting. 0:02:50.440 --> 0:02:52.240 And he brought up the idea of auditors and I 0:02:52.320 --> 0:02:54.280 just found it was fascinating. You know that, that you 0:02:54.320 --> 0:02:58.240 need to have your code audited, especially so now with 0:02:58.320 --> 0:03:01.280 so many hacks. And he brought up, you know, how 0:03:01.320 --> 0:03:04.200 they're different firms, different levels of quality, but that it 0:03:04.360 --> 0:03:06.200 is important to spend a lot of money, and I 0:03:06.200 --> 0:03:08.360 think he mentioned how much they'd spent in one and 0:03:08.400 --> 0:03:10.120 I thought, well, that's a lot of money to spend, 0:03:10.200 --> 0:03:12.799 especially if you're in a bear market and you might 0:03:12.840 --> 0:03:20.360 have less money. M So Olga. Why does crypto need 0:03:21.000 --> 0:03:24.480 what it is? You know, it's such an interesting Um 0:03:24.560 --> 0:03:28.960 it's such an interesting situation in the crypto market where 0:03:29.000 --> 0:03:34.760 billions are invested into a slew of different APPS, uh, 0:03:34.800 --> 0:03:37.960 and in a lot of cases these APPs are not 0:03:38.200 --> 0:03:43.040 well protected at all. So billions is being lost and that, 0:03:43.160 --> 0:03:46.680 I think, is getting fixed now and that's why all 0:03:46.720 --> 0:03:50.480 of the security firms that Um Anna and I talked 0:03:50.480 --> 0:03:53.960 to are benefiting, because the industry is waking up to 0:03:54.040 --> 0:04:00.960 the need for greater security protections one of the biggest 0:04:01.040 --> 0:04:05.200 crypto high to date. Hacker stole about six hundred million 0:04:05.240 --> 0:04:08.760 dollars from a blockchain system connected to the popular acts 0:04:08.800 --> 0:04:12.760 the Infinity Online game, and it's the Ronan Bridge. Uh, 0:04:12.960 --> 0:04:17.080 the blockchain that supports actually infinity says was hacked. The attack, 0:04:17.160 --> 0:04:21.960 many say, is shown what vulnerability these bridges provide because 0:04:22.000 --> 0:04:25.520 the rife with problems. The Computer Code, for instance, on 0:04:25.600 --> 0:04:29.240 the bridges, is not audited, and that's what security experts 0:04:29.240 --> 0:04:33.480 say creates vulnerabilities. For years, probably since bitcoin was invented, 0:04:33.680 --> 0:04:35.640 there have been people who have been finding exploits and 0:04:35.680 --> 0:04:39.320 code vulnerabilities. What about two has meant that this much 0:04:39.320 --> 0:04:42.320 money is surging into these companies now the size of 0:04:42.400 --> 0:04:50.880 the hacks is becoming just amazingly large. So earlier this year, 0:04:50.960 --> 0:04:53.920 for instance, one of the bridge lost more than six 0:04:54.000 --> 0:04:57.480 hundred million dollars in a hack. And then somebody has 0:04:57.560 --> 0:05:00.400 to put this money back to to to give it 0:05:00.480 --> 0:05:04.760 to users, hopefully. And what we found out as a 0:05:04.800 --> 0:05:06.960 result of a lot of this bridge hacks is that 0:05:07.480 --> 0:05:11.400 there are very sort of serious backers of this bridge. 0:05:11.440 --> 0:05:15.239 Is there are large financial companies that are now having 0:05:15.279 --> 0:05:18.120 to cough up this funds and they are the ones 0:05:18.200 --> 0:05:22.919 waking up to the need for greater security and they're 0:05:22.920 --> 0:05:26.480 the ones putting the bills for this losses. I think 0:05:26.560 --> 0:05:30.080 that's why the industry is starting to spend this money 0:05:30.080 --> 0:05:33.720 on security. So when you talk about those sorts of, 0:05:33.800 --> 0:05:37.440 you know, well capitalized, well funded, traditional investors, an example 0:05:37.640 --> 0:05:42.599 is when jump crypto had to bail out wormhole, the 0:05:42.600 --> 0:05:45.360 bridge that lost, you know, more than three hundred million dollars. 0:05:45.400 --> 0:05:47.000 I'm sure it was a kind of a good sign 0:05:47.040 --> 0:05:50.640 of confidence to the the overall wormhole ecosystem and really 0:05:50.680 --> 0:05:54.400 said something about jumps willingness to, you know, support their 0:05:54.480 --> 0:05:59.280 their portfolio companies, but a very expensive headache certainly. Why 0:05:59.320 --> 0:06:02.400 has it taken crypto so long, other than the financial 0:06:02.400 --> 0:06:05.880 incentives that you've described, to adopt this kind of philosophy shift? 0:06:07.160 --> 0:06:13.200 The CRYPTO INDUSTRY HAS UM essentially grown up with, you know, 0:06:13.560 --> 0:06:16.680 its its roots are, you know, a bunch of developers 0:06:16.720 --> 0:06:20.000 getting together in chat rooms and throwing some code together, 0:06:20.240 --> 0:06:23.880 seeing how it works. It's a very sort of democratic, 0:06:24.000 --> 0:06:32.559 grassroots structure and it's this structure that essentially Um has impeded, uh, 0:06:32.920 --> 0:06:36.760 the the industry from implementing some of the basic measures 0:06:36.760 --> 0:06:44.799 that any sort of company implements automatically the security measures 0:06:44.800 --> 0:06:49.440 that are being implemented. They can run from something basics 0:06:49.480 --> 0:06:51.920 such as, you know, somebody is going through the code 0:06:51.920 --> 0:06:57.320 line by line, essentially checking for any bugs Um. In 0:06:57.360 --> 0:07:01.440 addition to that, what a lot of the security companies 0:07:01.480 --> 0:07:06.960 are doing, they're also deploying software bots that's essentially monitor 0:07:07.480 --> 0:07:11.320 what's happening in the APP and already in the team 0:07:11.320 --> 0:07:14.840 working on the APP that say they got hacked, because 0:07:14.880 --> 0:07:17.520 what we saw earlier this year was that, you know, 0:07:17.600 --> 0:07:22.040 sometimes they would pass and the APP developers don't even 0:07:22.040 --> 0:07:25.239 know that the APP got hacked. So we're talking about 0:07:25.280 --> 0:07:29.960 some very, very basic steps that are now increasingly being taken. 0:07:32.680 --> 0:07:35.080 You know, one aspect, I think, and it might be 0:07:35.120 --> 0:07:37.880 a skeptical in me, but part of it is also 0:07:37.920 --> 0:07:40.760 made because no one, because it's distributed, who's going to 0:07:40.880 --> 0:07:43.880 get in trouble if something goes wrong. So if no 0:07:43.920 --> 0:07:48.680 one's responsible, like no person, no entity necessarily, then you 0:07:48.840 --> 0:07:51.960 might have less of an incentive because you know, if 0:07:51.960 --> 0:07:54.880 something goes wrong, well sorry. And also initially, you know, 0:07:54.920 --> 0:07:58.520 the sums at risk weren't that big, whereas now, and 0:07:58.640 --> 0:08:00.960 especially because some of these hacks happened during a rally. 0:08:01.000 --> 0:08:05.400 Everything gets multiplied by like like it's fifty higher. So 0:08:05.520 --> 0:08:08.320 you know, a hack now might be a lot less 0:08:08.360 --> 0:08:11.280 lost than it would have been six months ago. So 0:08:11.360 --> 0:08:14.120 I think it's like, as the industry matures and more 0:08:14.160 --> 0:08:17.480 mature players step in, you have some of the requirements, 0:08:18.120 --> 0:08:20.480 or at least you know the investors that are coming 0:08:20.480 --> 0:08:22.920 in will expect some of the same standards they're used 0:08:22.960 --> 0:08:26.440 to in other sectors. Because, for example, you mentioned banks, 0:08:26.560 --> 0:08:28.960 right like if a bank gets hacked, even if it's 0:08:28.960 --> 0:08:32.320 they're just their website or something's down for three seconds, 0:08:32.600 --> 0:08:34.960 you know, imagine you are you aren't able to access 0:08:34.960 --> 0:08:41.240 your bank account for five minutes. That's a huge deal 0:08:41.480 --> 0:08:44.200 and regulators will step in, or at least they'll want 0:08:44.240 --> 0:08:46.959 to know what's going on. They'll be like politicians talking 0:08:47.000 --> 0:08:49.760 about it like because obviously you expect to be able 0:08:49.800 --> 0:08:52.560 to access your money, whereas here I think the threshold 0:08:52.640 --> 0:08:55.600 and the standards have been lower. But slowly people are 0:08:55.640 --> 0:08:57.920 realizing that, you know, I need to be able to 0:08:57.960 --> 0:09:01.400 access it's my money and having low standard for it 0:09:01.440 --> 0:09:05.480 doesn't it's not okay. Is there something cultural about this 0:09:05.559 --> 0:09:08.600 attitude of well, we're only going to take this seriously 0:09:08.679 --> 0:09:11.360 when you know billions of dollars or at play and 0:09:11.679 --> 0:09:16.080 we're going to have to hire in outside people, rather 0:09:16.120 --> 0:09:17.760 than this being something we can sort of solve as 0:09:17.800 --> 0:09:22.160 a community? I think crypto is also a bit individualistic 0:09:22.400 --> 0:09:24.800 in my experience. I don't know if maybe I'm doing 0:09:24.800 --> 0:09:26.880 it a disservice, but I feel like there's a lot 0:09:27.160 --> 0:09:29.800 over the years with all the crashes that I've sort 0:09:29.840 --> 0:09:32.360 of covered, there's a lot of like well, they lost 0:09:32.360 --> 0:09:34.800 their money whatever, like nobody ever seems to be sad 0:09:34.880 --> 0:09:36.800 for people who have lost the money. It's like you 0:09:36.840 --> 0:09:39.360 weren't smart enough because you kept it on an exchange. 0:09:39.640 --> 0:09:41.560 You weren't smart enough because you should have known. Like 0:09:41.640 --> 0:09:45.240 there's very much this sense of like, you know, it's 0:09:45.280 --> 0:09:48.200 like the wild west, still in the mentality you know, 0:09:48.280 --> 0:09:52.240 you should protect yourself, like very much a pioneer mentality, 0:09:52.280 --> 0:09:53.960 like if you lose your money, then it's your like 0:09:54.080 --> 0:09:56.800 it's your fault. So I think maybe there's more thinking 0:09:56.840 --> 0:10:00.520 about sort of the collective right now, like of an 0:10:00.520 --> 0:10:03.839 actual community, whereas before it's like it's been sort of well, 0:10:04.320 --> 0:10:07.600 he lost like two million whatever. He should have known 0:10:07.679 --> 0:10:11.280 to keep it under his bed up. Next more from 0:10:11.280 --> 0:10:14.440 Bloomberg reports to Olga Karif and from Bloomberg senior editor 0:10:14.480 --> 0:10:18.160 Anna Arera on the growth of crypto security companies. We'll 0:10:18.160 --> 0:10:30.560 be right back. There is a degree of seriousness associated 0:10:30.640 --> 0:10:34.160 with I'm locked out of my money. It's not like 0:10:34.160 --> 0:10:38.200 twitters down disaster, a bunch of journalist are freaking out 0:10:38.200 --> 0:10:40.400 about it. It's like you suddenly do not have access 0:10:40.440 --> 0:10:44.560 to your money, and I've always been struck by the 0:10:45.559 --> 0:10:47.599 not just the individuality that you describe on it, but 0:10:47.640 --> 0:10:50.240 also like the casualness right where people will be like, well, 0:10:50.280 --> 0:10:52.480 you know stuff and Crypto is not gonna work. Sometimes 0:10:52.520 --> 0:10:54.959 it's gonna go down. Buy orb aware that kind of thing. 0:10:55.280 --> 0:10:57.560 But as the sums involved have gotten bigger and bigger, 0:10:58.040 --> 0:11:00.520 that's not something that an individual, whether dealing with a 0:11:00.520 --> 0:11:04.640 few hundred dollars worth of tokens or several thousand or more, 0:11:04.679 --> 0:11:07.240 depending on their individual wealth, like. That's not an argument 0:11:07.240 --> 0:11:11.280 that they're impressed by. I'm thinking about, you know, like 0:11:11.320 --> 0:11:17.240 the voyager and the Celsius withdrawal freezes and how, initially 0:11:17.400 --> 0:11:19.320 a lot of the response to that was well, like well, 0:11:19.320 --> 0:11:21.320 people should have known better than to put their money 0:11:21.440 --> 0:11:23.880 in Crypto like what? What can you expect? You should 0:11:23.880 --> 0:11:27.840 accept this risk, and there's this kind of like cavaliernus 0:11:27.880 --> 0:11:29.960 about it as well, to your point about, you know, 0:11:30.000 --> 0:11:33.600 the pioneer. So what I wonder for Y'all is, when 0:11:33.600 --> 0:11:36.079 you talk to these security experts, when you talk to 0:11:36.120 --> 0:11:38.960 these folks that are being brought in to a culture 0:11:39.000 --> 0:11:42.400 that has not necessarily been welcoming of them before, how 0:11:42.440 --> 0:11:44.680 are they finding it right? Are they finding that people 0:11:44.679 --> 0:11:46.320 are going to listen to them, or they're taking their 0:11:46.360 --> 0:11:49.400 code reviews seriously? Are they taking their device seriously, or 0:11:49.640 --> 0:11:53.440 is it more of an uphill battle? I think just 0:11:53.640 --> 0:11:56.480 the amount that they're getting paid, like they also had 0:11:56.520 --> 0:11:59.040 an example of bug bounties right like, which is a 0:11:59.040 --> 0:12:03.480 bit different, is when a project says we'll pay uh too. 0:12:03.600 --> 0:12:05.360 I don't remember. I think it was like six million 0:12:05.480 --> 0:12:09.080 or something less or higher than that they were going 0:12:09.080 --> 0:12:11.360 to pay to someone who would find a bug like openly. 0:12:11.679 --> 0:12:13.600 So you have then white hackers, which are the good 0:12:13.600 --> 0:12:16.560 guys who are trying to hack Um your project and 0:12:16.600 --> 0:12:18.640 obviously not steal the money, but just to prove that 0:12:18.720 --> 0:12:20.760 there is a problem. So I think the fact that 0:12:20.800 --> 0:12:23.160 they're getting paid that much means that, you know, they 0:12:23.200 --> 0:12:26.160 are serious about it and more serious about it than before. 0:12:28.200 --> 0:12:32.000 There was a recent example, just in August, of a 0:12:32.160 --> 0:12:38.360 company that provides advice to an Ft. you know, folks 0:12:38.360 --> 0:12:40.319 do making N F T projects about how they should 0:12:40.320 --> 0:12:44.760 structure their mints. Um, they're called rug pull finder and they, 0:12:44.800 --> 0:12:46.760 you know, they look at they look at different kinds 0:12:46.760 --> 0:12:50.079 of frauds and they didn't mint and got exploited and 0:12:50.200 --> 0:12:54.080 like no time flats there there was a technical exploit 0:12:54.200 --> 0:12:56.720 in the code and folks were like, uh, how did 0:12:56.760 --> 0:12:59.360 this happen? You'll are supposed to be experts, and they 0:12:59.400 --> 0:13:02.560 conceded that they did not in fact audit the code 0:13:02.640 --> 0:13:08.040 themselves or use a third party. Now, first of all, 0:13:08.400 --> 0:13:12.080 dramatic irony. Second of all, it does seem like even 0:13:12.120 --> 0:13:16.120 people who are preaching, you know, the benefits of like 0:13:16.160 --> 0:13:19.160 take more steps, be more thoughtful or not themselves always 0:13:19.160 --> 0:13:22.040 following this advice. What is it really going to take 0:13:22.480 --> 0:13:25.360 for these kinds of services to be one, you know, 0:13:25.440 --> 0:13:28.080 kind of brought in house, but to just like listened to, 0:13:28.640 --> 0:13:35.360 whether they're in house or Third Party Craig lators? I 0:13:35.400 --> 0:13:38.680 think it's a standard answer, like, you know, the only 0:13:38.840 --> 0:13:41.000 one of the few things I remember from my many 0:13:41.120 --> 0:13:43.080 years to get a lot of degree is that no 0:13:43.120 --> 0:13:48.160 one does anything unless there's you're they're forced to by enforcement, 0:13:48.240 --> 0:13:49.920 you know, or like you get punished for doing it. 0:13:49.960 --> 0:13:52.319 Like you're not going to do something that's not in 0:13:52.360 --> 0:13:56.360 your best economic interest unless you know you have to, 0:13:56.520 --> 0:13:58.920 because it's not something you'll do out of the goodness 0:13:58.920 --> 0:14:01.200 of your heart. Again, maybe that's a skeptic in me, 0:14:01.320 --> 0:14:05.079 but but I feel like once regulators will be like, okay, 0:14:05.120 --> 0:14:07.760 so you big fund want to put money in this project. 0:14:07.920 --> 0:14:11.240 What is its security? What are the like? What's happening 0:14:11.240 --> 0:14:13.679 with the custody? Where the keys? where? What's you know, 0:14:13.960 --> 0:14:16.840 who's audited, the code and all that. Until that happens, 0:14:16.920 --> 0:14:19.960 then you know you can sort of make it secure 0:14:19.960 --> 0:14:23.240 because you care about it, but maybe they'll still be 0:14:23.440 --> 0:14:28.760 shortcuts you might take at one point or another. Thank you, Olga, 0:14:28.880 --> 0:14:31.440 and thank you Anna. You can find more of Ogan 0:14:31.440 --> 0:14:34.080 and Anna's reporting on the Bloomberg terminal on Bloomberg Dot 0:14:34.080 --> 0:14:37.360 Com or follow them on twitter. Olga is at Olga 0:14:37.480 --> 0:14:41.040 Karif that's O L G A K H A R 0:14:41.040 --> 0:14:44.960 I F and Anna is at Anna Arera. That's a 0:14:45.240 --> 0:14:51.880 N N A I R R B R a on 0:14:51.920 --> 0:14:55.360 the next episode of Bloomberg Crypto. CRYPTO minors who set 0:14:55.440 --> 0:14:58.040 up shop in Sweden and Norway are finding that they 0:14:58.120 --> 0:15:01.000 are needing to move even further nor into the Arctic. 0:15:01.680 --> 0:15:04.640 Soaring power prices in Europe as a result of drought, 0:15:05.280 --> 0:15:10.120 political considerations like Russia's invasion of Ukraine and generally rising 0:15:10.120 --> 0:15:13.920 inflation have meant that that combination of abundant energy that's 0:15:13.920 --> 0:15:16.840 also low cost is getting harder and harder to find. 0:15:21.360 --> 0:15:24.520 This is Bloomberg Crypto, a daily podcast from Bloomberg and 0:15:24.560 --> 0:15:27.560 I heart radio. For more shows from I heart radio, 0:15:27.760 --> 0:15:30.880 visit the I heart radio APP, apple podcasts or wherever 0:15:30.960 --> 0:15:34.480 you get your podcasts. Send US your comments, questions or 0:15:34.480 --> 0:15:37.520 suggestions for the show to Crypto at Bloomberg Dot net 0:15:38.080 --> 0:15:42.840 or find us on twitter. We're at CRYPTO. The supervising 0:15:42.840 --> 0:15:46.640 producer of Bloomberg Crypto is Vicky Verglina. Our senior producer 0:15:46.720 --> 0:15:50.880 is Janet Babin. Our producer is Mohammed Farouk. Associate producer 0:15:50.960 --> 0:15:53.920 is Moses on them Desta wonder at is our engineer. 0:15:54.440 --> 0:15:59.400 Original Music by Leo Sidron. I'm Stacy Maria Schmal. We'll 0:15:59.400 --> 0:16:09.840 be back tomorrow. The stout that at the