Speaker 1: This is Bloomberg Crypto, a daily Bloomberg I heart podcast
Speaker 1: and I'm Stacy Marie Ishmael, managing editor of Crypto for
Speaker 1: Bloomberg News. It's Monday September. Today will explore a sector
Speaker 1: of the crypto universe that's booming. Companies that specialize in
Speaker 1: finding vulnerabilities in software and code are flourishing. Why? Because
Speaker 1: crypto hacks and frauds are themselves booming, with some estimates
Speaker 1: as high as two billion dollars and losses stemming from
Speaker 1: these kinds of attacks. So the people who know how
Speaker 1: to stop hacks from happening, who have specialist knowledge and
Speaker 1: understanding and expertise, they're really raking in the cash right now.
Speaker 1: Bloomberg reports Olga Karif, somebody is going through the code
Speaker 1: line by line, essentially checking for any bugs, and senior
Speaker 1: editor and Arera so you have then white hackers, which
Speaker 1: are the good guys who are trying to hack Um
Speaker 1: your project and obviously not steal the money, but just
Speaker 1: to prove that there is a problem. Join me now
Speaker 1: for more about these crypto sleuths. It's always such a
Speaker 1: pleasure to do these episodes because I feel, like you know,
Speaker 1: we've got like three different time zones happening at the
Speaker 1: same time, and folks, folks all around the world, which is,
Speaker 1: I think, an appropriate entry point for this episode because
Speaker 1: it covers, or will cover, crypto sleuths who are operating
Speaker 1: from all different corners of of countries and cities to
Speaker 1: try to stop hacks and scams and other bad things
Speaker 1: from happening Algo. What was the origin of this story,
Speaker 1: like how did you kind of come across these folks
Speaker 1: and why are they gaining in Popu larity right now? Actually,
Speaker 1: it was Anna's idea. There we go. Might the question
Speaker 1: for her. I don't know. I love when like editors
Speaker 1: are coming up with stories. So yeah, so thank you, Olga.
Speaker 1: You could have just run with it. I would have
Speaker 1: been fine. So I was actually interviewing. It was like
Speaker 1: maybe my first week here, and I was speaking to
Speaker 1: someone who just raised money for their new defied protocol
Speaker 1: and I asked what they were going to spend the
Speaker 1: money for and he said security, security, it's been so
Speaker 1: expensive and it's one of the people we quote, so
Speaker 1: the founder of Morphol Labs Um who said they spent
Speaker 1: so much money, who told me in a telegram message
Speaker 1: with many ohs. Yeah, that is the actual quoting stories
Speaker 1: like us, Oh, while for emphasis. Yeah, so you know,
Speaker 1: he brought it up and so I thought that's really interesting.
Speaker 1: And he brought up the idea of auditors and I
Speaker 1: just found it was fascinating. You know that, that you
Speaker 1: need to have your code audited, especially so now with
Speaker 1: so many hacks. And he brought up, you know, how
Speaker 1: they're different firms, different levels of quality, but that it
Speaker 1: is important to spend a lot of money, and I
Speaker 1: think he mentioned how much they'd spent in one and
Speaker 1: I thought, well, that's a lot of money to spend,
Speaker 1: especially if you're in a bear market and you might
Speaker 1: have less money. M So Olga. Why does crypto need
Speaker 1: what it is? You know, it's such an interesting Um
Speaker 1: it's such an interesting situation in the crypto market where
Speaker 1: billions are invested into a slew of different APPS, uh,
Speaker 1: and in a lot of cases these APPs are not
Speaker 1: well protected at all. So billions is being lost and that,
Speaker 1: I think, is getting fixed now and that's why all
Speaker 1: of the security firms that Um Anna and I talked
Speaker 1: to are benefiting, because the industry is waking up to
Speaker 1: the need for greater security protections one of the biggest
Speaker 1: crypto high to date. Hacker stole about six hundred million
Speaker 1: dollars from a blockchain system connected to the popular acts
Speaker 1: the Infinity Online game, and it's the Ronan Bridge. Uh,
Speaker 1: the blockchain that supports actually infinity says was hacked. The attack,
Speaker 1: many say, is shown what vulnerability these bridges provide because
Speaker 1: the rife with problems. The Computer Code, for instance, on
Speaker 1: the bridges, is not audited, and that's what security experts
Speaker 1: say creates vulnerabilities. For years, probably since bitcoin was invented,
Speaker 1: there have been people who have been finding exploits and
Speaker 1: code vulnerabilities. What about two has meant that this much
Speaker 1: money is surging into these companies now the size of
Speaker 1: the hacks is becoming just amazingly large. So earlier this year,
Speaker 1: for instance, one of the bridge lost more than six
Speaker 1: hundred million dollars in a hack. And then somebody has
Speaker 1: to put this money back to to to give it
Speaker 1: to users, hopefully. And what we found out as a
Speaker 1: result of a lot of this bridge hacks is that
Speaker 1: there are very sort of serious backers of this bridge.
Speaker 1: Is there are large financial companies that are now having
Speaker 1: to cough up this funds and they are the ones
Speaker 1: waking up to the need for greater security and they're
Speaker 1: the ones putting the bills for this losses. I think
Speaker 1: that's why the industry is starting to spend this money
Speaker 1: on security. So when you talk about those sorts of,
Speaker 1: you know, well capitalized, well funded, traditional investors, an example
Speaker 1: is when jump crypto had to bail out wormhole, the
Speaker 1: bridge that lost, you know, more than three hundred million dollars.
Speaker 1: I'm sure it was a kind of a good sign
Speaker 1: of confidence to the the overall wormhole ecosystem and really
Speaker 1: said something about jumps willingness to, you know, support their
Speaker 1: their portfolio companies, but a very expensive headache certainly. Why
Speaker 1: has it taken crypto so long, other than the financial
Speaker 1: incentives that you've described, to adopt this kind of philosophy shift?
Speaker 1: The CRYPTO INDUSTRY HAS UM essentially grown up with, you know,
Speaker 1: its its roots are, you know, a bunch of developers
Speaker 1: getting together in chat rooms and throwing some code together,
Speaker 1: seeing how it works. It's a very sort of democratic,
Speaker 1: grassroots structure and it's this structure that essentially Um has impeded, uh,
Speaker 1: the the industry from implementing some of the basic measures
Speaker 1: that any sort of company implements automatically the security measures
Speaker 1: that are being implemented. They can run from something basics
Speaker 1: such as, you know, somebody is going through the code
Speaker 1: line by line, essentially checking for any bugs Um. In
Speaker 1: addition to that, what a lot of the security companies
Speaker 1: are doing, they're also deploying software bots that's essentially monitor
Speaker 1: what's happening in the APP and already in the team
Speaker 1: working on the APP that say they got hacked, because
Speaker 1: what we saw earlier this year was that, you know,
Speaker 1: sometimes they would pass and the APP developers don't even
Speaker 1: know that the APP got hacked. So we're talking about
Speaker 1: some very, very basic steps that are now increasingly being taken.
Speaker 1: You know, one aspect, I think, and it might be
Speaker 1: a skeptical in me, but part of it is also
Speaker 1: made because no one, because it's distributed, who's going to
Speaker 1: get in trouble if something goes wrong. So if no
Speaker 1: one's responsible, like no person, no entity necessarily, then you
Speaker 1: might have less of an incentive because you know, if
Speaker 1: something goes wrong, well sorry. And also initially, you know,
Speaker 1: the sums at risk weren't that big, whereas now, and
Speaker 1: especially because some of these hacks happened during a rally.
Speaker 1: Everything gets multiplied by like like it's fifty higher. So
Speaker 1: you know, a hack now might be a lot less
Speaker 1: lost than it would have been six months ago. So
Speaker 1: I think it's like, as the industry matures and more
Speaker 1: mature players step in, you have some of the requirements,
Speaker 1: or at least you know the investors that are coming
Speaker 1: in will expect some of the same standards they're used
Speaker 1: to in other sectors. Because, for example, you mentioned banks,
Speaker 1: right like if a bank gets hacked, even if it's
Speaker 1: they're just their website or something's down for three seconds,
Speaker 1: you know, imagine you are you aren't able to access
Speaker 1: your bank account for five minutes. That's a huge deal
Speaker 1: and regulators will step in, or at least they'll want
Speaker 1: to know what's going on. They'll be like politicians talking
Speaker 1: about it like because obviously you expect to be able
Speaker 1: to access your money, whereas here I think the threshold
Speaker 1: and the standards have been lower. But slowly people are
Speaker 1: realizing that, you know, I need to be able to
Speaker 1: access it's my money and having low standard for it
Speaker 1: doesn't it's not okay. Is there something cultural about this
Speaker 1: attitude of well, we're only going to take this seriously
Speaker 1: when you know billions of dollars or at play and
Speaker 1: we're going to have to hire in outside people, rather
Speaker 1: than this being something we can sort of solve as
Speaker 1: a community? I think crypto is also a bit individualistic
Speaker 1: in my experience. I don't know if maybe I'm doing
Speaker 1: it a disservice, but I feel like there's a lot
Speaker 1: over the years with all the crashes that I've sort
Speaker 1: of covered, there's a lot of like well, they lost
Speaker 1: their money whatever, like nobody ever seems to be sad
Speaker 1: for people who have lost the money. It's like you
Speaker 1: weren't smart enough because you kept it on an exchange.
Speaker 1: You weren't smart enough because you should have known. Like
Speaker 1: there's very much this sense of like, you know, it's
Speaker 1: like the wild west, still in the mentality you know,
Speaker 1: you should protect yourself, like very much a pioneer mentality,
Speaker 1: like if you lose your money, then it's your like
Speaker 1: it's your fault. So I think maybe there's more thinking
Speaker 1: about sort of the collective right now, like of an
Speaker 1: actual community, whereas before it's like it's been sort of well,
Speaker 1: he lost like two million whatever. He should have known
Speaker 1: to keep it under his bed up. Next more from
Speaker 1: Bloomberg reports to Olga Karif and from Bloomberg senior editor
Speaker 1: Anna Arera on the growth of crypto security companies. We'll
Speaker 1: be right back. There is a degree of seriousness associated
Speaker 1: with I'm locked out of my money. It's not like
Speaker 1: twitters down disaster, a bunch of journalist are freaking out
Speaker 1: about it. It's like you suddenly do not have access
Speaker 1: to your money, and I've always been struck by the
Speaker 1: not just the individuality that you describe on it, but
Speaker 1: also like the casualness right where people will be like, well,
Speaker 1: you know stuff and Crypto is not gonna work. Sometimes
Speaker 1: it's gonna go down. Buy orb aware that kind of thing.
Speaker 1: But as the sums involved have gotten bigger and bigger,
Speaker 1: that's not something that an individual, whether dealing with a
Speaker 1: few hundred dollars worth of tokens or several thousand or more,
Speaker 1: depending on their individual wealth, like. That's not an argument
Speaker 1: that they're impressed by. I'm thinking about, you know, like
Speaker 1: the voyager and the Celsius withdrawal freezes and how, initially
Speaker 1: a lot of the response to that was well, like well,
Speaker 1: people should have known better than to put their money
Speaker 1: in Crypto like what? What can you expect? You should
Speaker 1: accept this risk, and there's this kind of like cavaliernus
Speaker 1: about it as well, to your point about, you know,
Speaker 1: the pioneer. So what I wonder for Y'all is, when
Speaker 1: you talk to these security experts, when you talk to
Speaker 1: these folks that are being brought in to a culture
Speaker 1: that has not necessarily been welcoming of them before, how
Speaker 1: are they finding it right? Are they finding that people
Speaker 1: are going to listen to them, or they're taking their
Speaker 1: code reviews seriously? Are they taking their device seriously, or
Speaker 1: is it more of an uphill battle? I think just
Speaker 1: the amount that they're getting paid, like they also had
Speaker 1: an example of bug bounties right like, which is a
Speaker 1: bit different, is when a project says we'll pay uh too.
Speaker 1: I don't remember. I think it was like six million
Speaker 1: or something less or higher than that they were going
Speaker 1: to pay to someone who would find a bug like openly.
Speaker 1: So you have then white hackers, which are the good
Speaker 1: guys who are trying to hack Um your project and
Speaker 1: obviously not steal the money, but just to prove that
Speaker 1: there is a problem. So I think the fact that
Speaker 1: they're getting paid that much means that, you know, they
Speaker 1: are serious about it and more serious about it than before.
Speaker 1: There was a recent example, just in August, of a
Speaker 1: company that provides advice to an Ft. you know, folks
Speaker 1: do making N F T projects about how they should
Speaker 1: structure their mints. Um, they're called rug pull finder and they,
Speaker 1: you know, they look at they look at different kinds
Speaker 1: of frauds and they didn't mint and got exploited and
Speaker 1: like no time flats there there was a technical exploit
Speaker 1: in the code and folks were like, uh, how did
Speaker 1: this happen? You'll are supposed to be experts, and they
Speaker 1: conceded that they did not in fact audit the code
Speaker 1: themselves or use a third party. Now, first of all,
Speaker 1: dramatic irony. Second of all, it does seem like even
Speaker 1: people who are preaching, you know, the benefits of like
Speaker 1: take more steps, be more thoughtful or not themselves always
Speaker 1: following this advice. What is it really going to take
Speaker 1: for these kinds of services to be one, you know,
Speaker 1: kind of brought in house, but to just like listened to,
Speaker 1: whether they're in house or Third Party Craig lators? I
Speaker 1: think it's a standard answer, like, you know, the only
Speaker 1: one of the few things I remember from my many
Speaker 1: years to get a lot of degree is that no
Speaker 1: one does anything unless there's you're they're forced to by enforcement,
Speaker 1: you know, or like you get punished for doing it.
Speaker 1: Like you're not going to do something that's not in
Speaker 1: your best economic interest unless you know you have to,
Speaker 1: because it's not something you'll do out of the goodness
Speaker 1: of your heart. Again, maybe that's a skeptic in me,
Speaker 1: but but I feel like once regulators will be like, okay,
Speaker 1: so you big fund want to put money in this project.
Speaker 1: What is its security? What are the like? What's happening
Speaker 1: with the custody? Where the keys? where? What's you know,
Speaker 1: who's audited, the code and all that. Until that happens,
Speaker 1: then you know you can sort of make it secure
Speaker 1: because you care about it, but maybe they'll still be
Speaker 1: shortcuts you might take at one point or another. Thank you, Olga,
Speaker 1: and thank you Anna. You can find more of Ogan
Speaker 1: and Anna's reporting on the Bloomberg terminal on Bloomberg Dot
Speaker 1: Com or follow them on twitter. Olga is at Olga
Speaker 1: Karif that's O L G A K H A R
Speaker 1: I F and Anna is at Anna Arera. That's a
Speaker 1: N N A I R R B R a on
Speaker 1: the next episode of Bloomberg Crypto. CRYPTO minors who set
Speaker 1: up shop in Sweden and Norway are finding that they
Speaker 1: are needing to move even further nor into the Arctic.
Speaker 1: Soaring power prices in Europe as a result of drought,
Speaker 1: political considerations like Russia's invasion of Ukraine and generally rising
Speaker 1: inflation have meant that that combination of abundant energy that's
Speaker 1: also low cost is getting harder and harder to find.
Speaker 1: This is Bloomberg Crypto, a daily podcast from Bloomberg and
Speaker 1: I heart radio. For more shows from I heart radio,
Speaker 1: visit the I heart radio APP, apple podcasts or wherever
Speaker 1: you get your podcasts. Send US your comments, questions or
Speaker 1: suggestions for the show to Crypto at Bloomberg Dot net
Speaker 1: or find us on twitter. We're at CRYPTO. The supervising
Speaker 1: producer of Bloomberg Crypto is Vicky Verglina. Our senior producer
Speaker 1: is Janet Babin. Our producer is Mohammed Farouk. Associate producer
Speaker 1: is Moses on them Desta wonder at is our engineer.
Speaker 1: Original Music by Leo Sidron. I'm Stacy Maria Schmal. We'll
Speaker 1: be back tomorrow. The stout that at the