Unchained - How Matthew Leising Confronted His Suspects in the DAO Attacks - Ep.191

Episode Date: September 22, 2020

Matthew Leising, a reporter at Bloomberg who began covering crypto in 2015, is out with a new book Out of the Ether: The Amazing Story of Ethereum and the $55 Million Heist that Almost Destroyed It All. In this episode, he discusses: the catalyst that led to him writing his new book, which covers the early history of Ethereum and the DAO attack of 2016 why he thought the story of the DAO hack was compelling enough to make a book, and how he went about reporting it the surprising things he learned about Ethereum’s early days and Vitalik the twists and turns during his quest to discover the identity of the DAO attacker why he thinks separate people were responsible for the two biggest DAO attacks his meeting in Tokyo with one of the prime suspects of a copycat DAO attack why he decided to end his story at the Ethereum hard fork and chose not to write about Ethereum Classic  what he feels the long-term significance of the DAO and the hard fork has been for Ethereum why he thinks the lessons of the DAO are not being heeded today what he thinks the next chapter of Ethereum will be and how it will unfold the differences he’s found as a journalist covering crypto as opposed to covering more traditional finance and how the book is about more than just the DAO   Thank you to our sponsors!  Crypto.com: https://www.crypto.com Gods Unchained: https://playgu.co/unchainedpod   Episode links:  Matthew Leising: https://twitter.com/mattleising Out of the Ether: The Amazing Story of Ethereum and the $55 Million Heist that Almost Destroyed It All: https://www.wiley.com/en-us/Out+of+the+Ether%3A+The+Amazing+Story+of+Ethereum+and+the+%2455+Million+Heist+that+Almost+Destroyed+It+All-p-9781119602934   Matt's original Bloomberg article on the DAO attack, "The Ether Thief": https://www.bloomberg.com/features/2017-the-ether-thief/   Excerpt in Bloomberg: https://www.bloomberg.com/news/articles/2020-09-16/a-trip-down-the-crypto-rabbit-hole-in-search-of-the-dao-hacker   Excerpt in CoinDesk: https://www.coindesk.com/55m-hack-ethereum-down Decrypt's interview with Matt about the book: https://decrypt.co/41952/book-sheds-new-light-on-ethereums-55-million-dao-hack Learn more about your ad choices. Visit megaphone.fm/adchoices

Hi everyone. Welcome to Unchained, your no-hype resource for all things crypto. I'm your host, Laura Shin, a journalist with over two decades of experience. I started covering crypto five years ago and as a senior editor at Forbes was the first mainstream media reporter to cover cryptocurrency full-time. Subscribe to Unchained on YouTube where you can watch the videos of me and my guests. Go to YouTube.com slash C slash Unchained podcast and subscribe today. Crypto.com is waiving the 3.5% credit card fee for all crypto purchases until the end of September. Download the crypto.com app today. This show is sponsored by God's Unchained, the digital card game that offers true ownership to players. It's fun, engaging, competitive, and has more NFTs than any other Ethereum game on the market. You can try the game out at PlaygU.co slash Unchained Pod. Today's guest is Matthew Lysing, reporter at Bloomberg and author of Out of the Ether,

the amazing story of Ethereum and the $55 million heist that almost destroyed it all. Welcome, Matt. Hey, Laura. Thank you very much. Congrats on the publication of your book, Out of the Ether, which comes out the week after this podcast drops. Tell us what it's about. Thank you.

Yeah. So it's an early history of Ethereum, starting with Vitalik and, going on through his life and how he came to invent Ethereum and the co-founders that he gathered around him and the ups and downs of launching the network. It's also a bit of a deep dive into the Dow hack in 2016, where I wrote a magazine story about it a couple years ago in 2017, and I just always, in the back of my mind, wanted to do a little more reporting, and I thought a book would be a great format to try to find out as much as I could about who was behind the hack and just I knew that there was a lot of great stuff that I hadn't used in the magazine story. So that was a big part of it.

And then it's also just about how Main Street and Wall Street are really coming to Ethereum and how it's starting to sort of work its way, not just into finance, but into things like Reddit and all sorts of other parts of the economy. As you mentioned, one of the main catalysts for you to write the book was that earlier article on the Dow attack. How did that article come about? Well, so I remember that Friday in 2016 when the Dow was hacked, I was home sick on my couch and I looked at my phone and I was like, I was aware of the Dow. I had paid a little bit of attention to it. And then I'm like, oh, my God, everything was blowing up and it's like being,

you know, robbed as I was sitting there on my couch. And I thought it was fascinating, but it was, it wasn't the right time at Bloomberg to really be talking about the Dow or Ethereum for that matter. It was still really early in the project. The Dow was kind of like the only thing going, really, at that point. And it didn't have much to do with finance or the Wall Street sort of audience that Bloomberg News, you know, writes to. So I just sort of paid attention, but then forgot about it until later that year, I think it was the end of the year, the editor of the magazine came to me and said, hey, we're doing a heist issue. We do this every year. Do you have any good heist stories? And so the Dow just popped into my mind immediately because I watched what had happened and I knew the

fork was there and all this crazy stuff and Ether Classic. And so, and I, again, And like I said, it really, it's not something you can really capture, I think, in a news story. You need a longer format. And so I thought a magazine story would be great for that. And it turned out to be like the most fun I've ever had. I really enjoyed getting to know everybody that the story is just absolutely bonkers. And so I was just really happy with that and the way it turned out. And so I was able to take that magazine story and use it to write a book proposal.

And here we are. I highly recommend that readers check out that article. I remember when it came out because there were so many cool interactive elements as well where you could learn the technology. They were sort of like in these, like in a magazine, we would call them sidebars. I actually didn't look at the physical copy. But on the online, you guys literally did them almost like sidebars. Like they would like pop up on the side. And then you could kind of go down like little mini rapid holes. Right. So like as like we had mentioned a tweet, it would show up on the side. side and you'd see like abs's tweet, you know, about the Dow is being drained. And then what I like to was on the left side, the actual Dow code was like there. And as you scroll down the story, it sort of follows along the code because the famous line in there is line 666. It's where the bug was. And so, you know, truth is stranger than fiction. So we just sort of like had a really fun time playing with that stuff. Before writing that article, how familiar were you with a

Ethereum and crypto and what in general was your history covering the blockchain space? Yeah. So I had gotten into it in 2015, the year before. So my beat for people who don't know is like market structure as a general term. It's how markets work or don't work, how they're like being updated, manipulation. Like I covered Dodd-Frank really closely because that was, you know, a real-time regulation of the swaps market. And so I had heard.

about Bitcoin, but dismissed it because I just didn't get it, to be honest. And I didn't, I didn't believe in the ones and zeros kind of thing of like having value. But that was, you know, me in 2014 or so. Once in 2015, I got sort of, I read something about blockchain and what it could do in terms of like a back end and, and how it might apply to all these financial markets that I covered. So I said to my editor, I'm like, hey, I want to, I want to cover of blockchain. And he's like, great, what's blockchain? So I was one of the first at Bloomberg to sort of start digging into it. We did a story pretty early on when Blythe Masters was appointed to be the CEO of Digital Asset Holdings that made it on the cover of the Markets Magazine. And as I've

heard in the years since, you know, that was sort of a big deal for people on the street that, you know, blockchain was something to take seriously. But that wasn't really a thing. I didn't get into that until the next year early in 2016. I remember going out to see Joe Lubin at consensus in their Bushwick headquarters. And he made the lightball go off over my head, you know, after repeating the phrase world computer enough times. I just like, it just really kind of took it from this sort of abstract thing that I've been writing about and made it a lot more concrete to me.

and after that, you know, we still say it's early days, and this was 2016, and it was really early days. There was really little, very little to point to in terms of like a real project or something you could do besides, you know, buying and selling ether. So that's what, you know, then the Dow happened, and that was obviously a huge deal. I think it was what put in theory on the map. It was wildly ambitious. and it just, you know, ended up going down in flames in front of everyone. And so that's kind of my arc to the Dow. And so since 2015, I've been writing about crypto in all sorts of ways,

but mostly the sweet spot for me is where the two meet in terms of finance and, you know, improving efficiency for corporations and supply chains and stuff like that. And you mentioned that after you had written the ether article, you use, the Ether Thief article, you used some of that to write your book proposal and get this book deal. But at what point did you realize that you wanted to write a book or that this could be a book? I knew once the magazine story was done, I was like, this is a great tale and it's got tension in it. And there's all these like funny mishaps. And it would be, I thought it would just be an amazing device to string throughout a book where you could keep the reader's attention on this.

heist part. And then in other parts of the book, say, this is why this is cool. Here's, here's Ethereum and here's Vitalik and here's Gavin Wood. And so it was really just like when I realized that this is a wonderful storytelling device to try to bait the reader along, you know, like there's this crazy heist going on and I'm going to lead you through it. And I think, you know, especially I was hoping I'd find somebody who was behind it, which is nobody's done that. You know, they're still out there. And so, Once that sort of cemented in my mind, I knew that that was a great structure. And so I put the book proposal together.

The funny thing is I couldn't get an agent to save my life. I tried everybody and I got nothing. And I'd given up. And out of the blue, I think in January of 2018, an agent just got in touch with me and asked if this was still available. And he became my agent. And so it was tough. tough sell, I think, for people because it's a technical issue. So he had heard through the grapevine that you were shopping that book proposal?

Or like, because that doesn't normally happen? No, no. I had sent it to him. And he just didn't respond. You know, I don't think he responded for months. And all the other responses I got were like, this is a pretty cool, but we're not sure we could sell this. You know, that's really what an agent cares about.

So that's, and then so I've gone through that with dozens of agents and this, So anyway, I had given up. I didn't think I could sell it. And then this guy came out of the blue and we were able to whip up the, you know, get the proposal in shape and sell it to Wiley. Yeah. Like I know normally journalists don't do this, but you could have come to me and I would have tried to help you get an agent.

All right. I'll remember that. Literally the woman who connected me with my agent just randomly emailed me right before this podcast recording, which is kind of, I hadn't talked for in a really long time, but I'm like ever so grateful to her. Anyway, so I did see at the end of your book that you thanked your sources and you said that there were more than 70 sources for the book. How did you go about reporting this book? Through the Ethereum or the Ether thief story, I've gotten to know a lot of the guys in the Robin Hood group. Those are the good guy hackers.

I've known Joe Lubin for a long time. I've known Vitalik and interviewed him a couple times over the years. And I think, you know, luckily that story in 2017 was well received. And I think people thought that I did a good job. So I think I had a bit of trust built up among people in the community. So when I started going out and asking if I could talk to people, I got pretty much everyone said yes. I got a lot of access and it was great. So I just interviewed people over and over again over 2018.

I think I'm, no, I'm 2019, I'm sorry, and just, you know, had dozens of notebooks that were filled and a huge file of, you know, research. And like with Vitalik, I think I interviewed him for about 10 hours total over several different times. I tend to just want to get in there and interview somebody for about an hour. You know, I record it on the record because after about an hour, I just kind of lose focus. So then I go back and do it again with them, you know, like a few days later, to follow up on things and just to continue the conversation. And that's sort of how I've been doing it for a long time. It's just the method that works for me. So I know the audience will want to know if you found out who the Dow attacker is.

But before we dive into that whole part of your book, why don't we just discuss the earlier part of Ethereum's history and then we can get to that? So what are some of the things that you learned about Ethereum that you didn't previously know or that you think a lot of people don't know? I knew that the original group of people that Vitalik gathered around him were problematic, I guess you could say. A lot of different personalities. It was very random how that group came together.

there was really no rhyme or reason. It was just the people who reached out to him after he sent his white paper around and said, hey, I want to help. And so, you know, there were people who did that for wanting to help code. There were people who wanted to maybe get in on this and, you know, get rich. There were people who did it for a lot of different reasons. And it made for a very strange group. As you know, within six months, people were fired and there was a reorganization.

and there was a lot of infighting and just clashing of egos, I think, is the way to say it. So I had sort of known that generally. But what I didn't know is that like that first sort of bloodletting in Zougas, I call it, in the book where Charles was fired in Amir, Chet Ritzkerson. Yes, Charles Hoskinson. Yeah, gone on to found Cardano. Correct. After that, it didn't get any better.

The Ethereum Foundation was just a mess sort of from the get-go. And throughout the period of when I'm writing this book, the infighting continued after that through 2016. There was a big part where they brought in a professional board of directors and hired an executive director. That whole process was really kind of loosey-goosey. and there's one of my favorite stories in the book is right as Ming was hired. She was complaining on a text string about the board and how they were already being difficult and she wanted to fire them. She thought she was texting her sister and she was actually texting one of the board members.

So they had a meeting coming up in a few days and it was already just, you know, the knives were out. And so I think what's fascinating is that Ethereum's. survive despite all of this. It's such a good idea. And there were people around who were driving it and knew that the idea here was solid and that the coding, you know, could be done. And they just sort of put their noses down and did the work, you know, even though all this leadership and political stuff was going on the whole time. So that was kind of, that was fascinating. When Metallic started telling me these stories, I just was kind of like my jaw was kind of dropping. And you said that most people spoke to you, but I do remember there were some points in the book where you said so-and-so declined to talk to me or did not respond. So how did you deal with those parts of the story where that person was a central character, but you did not have their perspective?

The one that really applies there is Ming Chan. I tried for months to get her just talk to me, but she just didn't. And, you know, she's a divisive figure in the industry. And a lot of people have, you know, a range of opinions on her. And I told her that. And I, you know, so I really wanted to get her thoughts on it. And unfortunately, I wasn't able to. So that had an effect where I think the book would have been much stronger with her voice in it. But, you know, as a reporter, you can only ask people to talk to you. And people sometimes don't for lots of good reasons.

So there was that. And then the other only one was Jeff Wilkie. he didn't respond. And I guess I should say, Amir Chetret didn't respond to me either. As you probably know, and your reader or your listeners might know, they're sort of out of the theorem and have been for a long time.

So I think there, I just, I think some people just didn't want to revisit the past. And so I would say, though, that, you know, the majority of the book, I had on the record people in the room, almost like 95% of the time, you know. So I was, as a writer, that's what you hope for.

And I was really happy that I did get that access and that people did trust me to tell this story and to get it, you know, hopefully right. And just to clarify for people, Jeff Wilkie was the lead on the Go Ethereum client for a long time. And Amir Chetret was a co-founder who was removed from the project at the same time as Charles Hoskinson, and I think we already said Ming Chan was the executive director of the foundation. So now let's talk about your quest to find the Dow attacker. I could see just from the way the book was written, that that was like a real driving force for you. So how did you go about

doing that? Well, yeah, it was. It always bugged me that, you know, people just sort of got away with that. And I know it's a twisty and turny story and then the money was returned and all of that. Wait, what do you mean the money was returned? Not from the hacker. The stolen ether was returned to people for, you know, everybody got their money back who had money in the Dow. And then the hacker, you know, made some money with the ether classic. Oh, right, right, right. Right.

So, but the big hall there was the ether that was stolen from the Dow in the first place. and it was, you know, put, it was put back by the hard fork. Right. So, you know, I don't know. It just, it was such a compelling story on the good guy hacker's side, like what Absa and Griff Green and, you know, Left Terrace and Jordi Bailena, all those guys were doing. It was so fascinating. I really wanted to match that up with, like, who is this attacker?

Because the hack is brilliant. It's really, it's a beautiful piece of code. It's actually longer. than the Dow itself, like the contract to attack. It's a two-step thing. And so I just really as a storyteller, I just wanted to try to find that side of the story. And I knew I heard a name, or not a name, but I'd heard of people in Switzerland who were rumored to be involved. And I thought if I had a book, you know, in front of me. And a lot of times, as you know, as a reporter, or people will open up to you about a book in ways that they might not if you're going to

have a story out in a day based on what they said. And that did turn out to be true. People, because previously in 2017, I'd only heard, oh, there's these people in Switzerland and nobody would tell me a name because it was pretty much a rumor. There wasn't a lot of hard proof. So I started there and I got names and I started doing some work. And I found somebody who was very good at forensics on the blockchain. chain and just started really digging in and asking, asking for help and doing, you know,

homework and talking to people. And what was interesting was it turned out that, you know, in 2016, the forensics that was available to a lot of people were not very, you know, sophisticated. In 2019, when I was doing the reporting for the book, it was a lot better. And people, things were integrated more. You could see a lot more. the one big tip I got was that there was this encrypted message sent from one of the attackers to the Robin Hood group. And what I should say here is that there wasn't just one Dow attack.

There was several. There was the big one on Friday when $55 million was stolen over the course of that day. I think everybody knows that. The second biggest one was on Tuesday, four days later. And that was the second largest. It was about three and a half million worth of ether. And that's actually the attack that made the Robin Hood group push the button and like drain the Dow themselves. They had been set up to do that, but we're worried about, you know, is this illegal?

Are we going to go to jail? Is everybody going to believe us that we're going to give it back? And so they were sort of on the fence. Then the second attack happens on Tuesday. And they said, okay, we got to go because otherwise everything's going to get stolen because there was still, you know, a lot of ether left in the doubt. So once they did that, the attacker on Tuesday, who I believe is a different person than the Friday attack, they sent an encrypted message to the Robin Hood group. They also sent the same message to the child Dow, the Friday attacker. And so somebody sent me the unencrypted form of that.

And it was this really weird message about the Dow Wars are a waste of time and don't do this. don't you want to give the money back? And if you do, I'll give my money back. And so it was, you know, as a writer, you're like, wow, an encrypted message on the blockchain. That's awesome. And now I knew an address that was linked to that account. And I could see that that address that sent the message had also launched the attack contract

on Tuesday. And so now I started sharing that with people who are helping me on the forensic side. And that attack, there was only a few short hops from that funding of that attack back to ShapeShift. And then the real breakthrough I had was a source had helped me by naming the person who had the Poloniacs account where the withdrawals of Bitcoin were made that were sent to ShapeShift that then went over a few hops and jumps to that attack address. And so now, because I had this source who was inside and, you know, exchanges are one of the only places that really know people's identities. And then, of course, some crypto exchanges don't. But this one was Poloniacs. They knew identities.

And so the source is able to link that withdrawal to shape shift. And then I knew that it went to this attack address. And so now I had a chain. And I had a person. And so I got in touch with him. and went to Tokyo to interview him. So before we get to that, I know everybody wants to know it up and then, but I just need to ask because exchanges are pretty well known for wanting to keep their customers private information

secure and not disclose that. And because obviously employees can get in trouble for revealing that. How did you find somebody at Poloniacs to reveal customer identifying information to you? I was asking around and I knew somebody, I knew names of people who were good at this and who had been involved with it from the beginning from the 2016 hack. And so, you know, sources have lots of different reasons for talking to reporters. I think this person who helped me wanted to, I think they felt like this was a malicious thing that happened and the fact that I was willing to go talk to these people. I think was something that made this source want to help me because, you know, these people who know this information are not going to do that.

But it's my job to go talk to them and ask, what's your side of the story? And once I started doing that, you know, first I went to Switzerland and talked to some people there. And then that was a dead end. You know, I think just the, my willingness to kind of like do the work. to try to figure this out, I think helps them want to help me, if that makes sense. And one other thing I was curious about, and maybe this is more of like a writer question, but why did you even reveal that like it was somebody at Polo who helped you? Do you know what I mean?

Like, why would you say, oh, this information that I got for my book came from this place? Well, I want to be as transparent as possible. So I want to always have as many details to back up the story and to tell people to, you know, give you a sense of this is, this is why I think this is worth reporting. So I thought that, you know, using the name of the exchange wasn't going to give anyone away, in my opinion. And it lent more weight to what I was saying and reporting. So, you know, there's always a balance when you're using unnamed sources. you want to give as much information to the reader as possible so that it seems credible while still protecting the person's identity who's helping you.

And it sounds like that source kind of had already made up his or her mind to help you, but I wondered, you know, did it take any convincing? Because I would imagine the threat of them losing their job would be a deterrent. So I just was curious to know if you, like, had an argument that you used or if this person, you know, if it wasn't necessary. I think the other thing that happened was, you know, I got put on this wrong trail and went to Zurich to talk to somebody who didn't have anything to do with the attack. And that was because I got, you know, bad information from the source. And that happens from time to time.

So, and that was a strange conversation I had with the person in Switzerland. And it's all recounted in the book. It ended up being kind of lucky for me, I think, in a way that this person, I think, they felt bad because they, sent me on to the wrong person and and but then they also saw that I was willing to you know travel to Europe and do do the work to go try to figure this out and then on top of that like I said before they there was more information to work with in 2019 and when I knew that address that sent the encrypted message I sent that to the person and said hey can you help me trace this and and it was a lot easier to trace that back to the source than anything having to do with the Friday attacker that's one

big reason I think they're different. The Friday hack where 55 million was stolen, those tracks were covered really, really well. It's pretty much impossible from the blockchain evidence to piece that, to say where it came from. They used mixers, some that don't even exist anymore, hops all over the place. And if you see the stuff that I have on that, on that transaction, it's crazy. It's like one of those things where they've got the boards and the strings and things are going all over the place. And it's like, if I'm not the FBI, forget it. Right. Then on the Tuesday attack, they were a lot less careful.

And it was, I mean, I figured it out. I back traced it. And, you know, I was able to do it just looking at ether scan. And so, you know, sorry, that that's not very good, in my opinion. And so that, you know, we're talking about two different things here. So let's, I just want your readers like, I don't know who did the Big Friday hack. I'm not sure anybody will know that unless it's the Europol or the FBI or somebody like that. This Tuesday attack was a lot less sloppy, excuse me, was more sloppy and easier to track.

Yeah, so we're going to talk a little bit more about these two people that potentially fingered as Dow attackers. But first, a quick word from the sponsors who make this show possible. This episode is sponsored by God's Unchained, the digital card game that offers, true ownership to players. Cards are minted on Ethereum, meaning users can trade, sell, and program their assets however they like. A new expansion set has just released, with limited edition cards and ERC 20 chests available for sale. If you miss out, you can hunt these down or previously sold out chests on third-party sites like Uniswap. This game is the real deal, helmed by experienced TCG legend Chris Clay of Magic the Gathering, Arena fame. It's fun,

engaging, competitive, and has more NFTs than any other Ethereum game on the market. You can try out the game at PlayGU.co slash Unchained Pod. For the Defy heads out there looking for a new opportunity, why not go grab some chests? How much in fees are you paying for your crypto purchases? Crypto.com is waiving the 3.5% credit card fee for all crypto purchases, which means you can buy crypto with a 0% fee. Apart from your crypto purchases, you can also get a great deal on food and grocery shopping too. Get up to 10% back on Uber Eats, McDonald's, Domino's Pizza, Walmart, and many more when you pay with your MCO Visa card. No card? On the crypto.com app, buy gift cards and get up to 20% back from merchants like Whole Foods, Safeway, Burger King, Papa Johns, and Dominoes.

Download the crypto.com app today and enjoy these offers till the end of September. here with trusted stats and real-time sports news. Yeah, hey, who should I take in the Boston game? Well, statistically speaking. Nah, no more statistically speaking. I want hot takes. I want knee-jerk reactions. That's not really what I do. Is that because you don't have any knees?

Or... The score bet. Trusted sports content, seamless sports betting. Download today. 19 plus, Ontario only. If you have questions or concerns about your gambling or the gambling of someone close to you, please go to Conixonterio.ca.

With Amex Platinum, Almost every purchase made with your card can be covered with points, including new tastes, new fits, and virtually everything in between. That's the powerful backing of Amex. Conditions apply. Back to my conversation with Matt Lysing. So one thing that I noticed back in the winter was that you had tweeted that you'd met the Dow attacker above a foot locker in Zurich. And I remember this tweet because I forwarded it to. somebody and said, oh, Matt, found the Dow attacker. This means I should be able to. But I went back

to search for it, and you've since deleted it. So I'm going to give a spoiler, which is that that person that you seem to have tweeted about, you know, you've mentioned here in the show that you didn't, they were not the Dow attacker. So then why did you end up include, why did you end up including that person in your book? I wanted to tell this part of the story chronologically. And so as I went through it, I'm reported on it. I thought that person was, that's who I thought it was. And I had the best information I had at that time. So that's why I went to Zurich and spoke to him. Then it turned out that it was wrong. And so then I go through that in the story as well. It's like, that was a real hard thing for me to hear. I was off there, but now it made me sort of like

rethink what I had and what I knew to be true. And that was this attack address. And so I started digging into that to try to figure out what can I know about this from like ether scan records. And that's where I realize that, oh, I can trace how these accounts were made. And that led to the breakthrough of this person in Tokyo. So, you know, I would say it at the end of the book. I have qualms about using a term like the ether thief because I don't know that these people actually did it. I do believe this person I interviewed in Japan is associated with it. But I don't have a smoking gun.

And I lay it out for the reader as straight as I can with a lot of quotes directly from our conversation. And I want to leave it up to readers to make the determination for themselves. Again, it was kind of a narrative device on my part. And at that time, I was excited about that part. of the book. I don't think I knew at that moment that it was wrong. And so I think once I realized it was wrong, I went back and deleted that tweet. And so, but it's all, it's just a string. It's a string of the, it's like my journey in trying to find the hacker. And so that I, and in a book format, it's, it's really nice to be able to do that because this was over about

a year's worth of work. So it was an arc. Now I got it. Okay. So, so, When you tweeted that, at that time, you thought that the person was the Tao attacker. Okay. And then you delete it. Oh, now I understand. And then you kept that part of the narrative sort of to make it like the quest part of the book. Right. Okay.

Right. And that's why I don't name the person in Switzerland because there's no need to do that. But I wanted to tell that story. And he was a character in my quest and my journey on that for that part of the story. I see. Okay, so now let's talk about the person that you do name, which I saw you also excerpted this part of the book for Bloomberg online. So I'm sure by the time this comes out, people will be chattering about this person. But this person that you named as a possible copycat Dow attacker is a man named. Why am I doing air quotes? His real name is Tomowaki Sato. And you can feel free to correct that if I pronounce that wrong. Who is he? So he is, he's been involved with Ethereum in Japan for many years. He started, it was called Smart Contract Japan.

He had gone to DevCon 1 in London, I think, in 2015, and had met, you know, all the co-founders there and then went back to Japan. And blockchain wasn't really a big deal there at that point, but it started to grow. and he was like one of the people who would help developers learn how to write smart contracts. And he did consulting for corporations as well who were interested in Ethereum or smart contracts. And then later he started a company called Starbase, which was a way to help startups go through the ICO process to raise funds. So initial coin offerings. And so he also made changes to,

the Go Ether client, according to his GitHub. He helped people recover their Bitcoin passwords. So, you know, these are tough things. Like he has some chops as far as I'm aware. And so my source was able to say, okay, there were two withdrawals from a Poloniac's account, one of Bitcoin, sorry, both of Bitcoin that went to ShapeShift. One was changed into Ether. One was changed into Dow tokens.

both of those withdrawals came from Polo, went to ShapeShift, and landed in the same Ethereum address. I'll just call it for FAAE for short. And that's so that's the main link. And I was told that it was Tomawki's Poloniac's account that those withdrawals were made from. So now I had a link from him at Polonex through Shapeshift to the Ethereum blockchain and the attack contract that was used in the Tuesday half. And so why don't you now describe the conversation that you had with him? And actually, before you do that, I just wanted to ask one thing because you said it so fast, but I was like, what? You said he helped people recover their Bitcoin passwords. Do you mean that he helped them crack their private keys? Like if they'd lost them? Or what does that mean? Yeah, I'm sorry. Yeah, private keys. Oh my gosh. Okay. I think that's, yeah, extremely hard. Which is very, very difficult. Wow. Okay.

I, okay, I didn't, I'm not even sure if I knew that was possible, but, um, all right. So, yeah, so tell me, um, you know, how you, what your conversation was like and, and how you approached it. Like, before you went, kind of, you know, what were you thinking about how you should conduct this interview to extract a confession? Yeah. Yeah, that would, that would have been the best. Um, what I did here is what the same thing I did with the, the man in Zurich. I, I, I talked to a person beforehand While I was still in the United States, I set up a phone call, said, how I'm writing a book about Ethereum. I'd love to talk to you about it.

And so, you know, kind of like get the ball rolling and say, oh, you know, and then I'm going to be in Tokyo. You know, I'd love to meet you. So that's how we met. He didn't know at that point what I wanted to ask about. But I knew that I had to have an in-person meeting with him. Otherwise, you know, you start asking questions like this over the phone and they're going hang up on you. So it's just a way of getting in front of people and showing them what you have

and getting their side of the story. So that's how I did that. And then I, so I arrived in Tokyo and I was nervous. I wasn't as nervous as when I interviewed the man in Zurich because, you know, that was the first time and I didn't know how it was going to go. So I'd kind of been through it already a little bit. And I felt like this time in Tokyo I had better evidence and I was a little more confident. So we sat down and spoke for over an hour on the record. He allowed me to record it. And so I started, you know, going through it. And I said, I want to show you something about the Dow. And so I started with the encrypted message. And I showed it to him. And I said, did you send this? And he looked at it and laughed. And he said, no, I don't think I sent that. And I said, okay.

And I had like ether scan records up on the computer. And I said, I want to show you. what I think happened here. And I showed him, this is where the encrypted message is. And here's how I link this back to ShapeShift. And went through the whole thing with him and said, you know, and I was told that this account at Polonyics belongs to you. And is that true? And he said, you know, he couldn't remember the addresses, which is fine.

You know, who can remember an Ethereum wallet, you know, four years later? It's like, you know, it's just a string of random. characters and numbers. So that didn't surprise me. But so when we got to the Polonix part, you know, he said, eventually I asked him if other people had access to his account. And he said, yes, that they did. And that was because he was acting as a broker for people who weren't able to buy an invest in crypto for themselves. So Tomaaki would do it for them. And he used Poloniacs to do that. And he told me that he had given them access to that Poloniac's account because it was their money. So I, you know, it's like in the book,

I say, if you had a Charles Schwab account and didn't have access to your money, you know, you wouldn't do that. You want to have access. You want to be able to withdraw it, shut it down, do whatever you want. So that made sense to me. And so we went back and forth and I said, well, you know, eventually I said, could somebody else have made these withdrawals and sent the money to ShapeShift? And he said, yeah, that's possible. And I said, said, well, do you think, you know, did you know that they were doing this? And he said, maybe. And we went on and I said, okay, well, so I just want to make really clear here, it's what you're saying to me is it's possible that somebody made these withdrawals from

your Polonics account to ShapeShift without your knowledge. And then they could have taken, you know, transferred that money over on the blockchain and launched this attack. And he said, yeah, it's possible. And I said, well, how can somebody who doesn't even know how to buy crypto launch a Dow attack? It's very complicated, right? It's an obvious question. And he said, well, the person I was brokering for didn't know how to do this, but they had a friend who did. And I said, okay, so it's possible that this friend of the person you were doing this for could have done this. And he said, yeah, it's possible. And then at the very end, he said, you know, this attack, it's actually not that difficult.

And that was almost where we left the conversation, which, you know, as you know, probably this attack is very difficult. It's a very elegant, hard thing to know how to do. At this point, I guess I would say, I think it was a copycat. So the attack contract was out there. Anybody who knew what they were doing could grab it, cut and paste it and launch it again. But, you know, I think it's interesting. that he said that this attack is not that difficult.

So then I left Tokyo and came back to the U.S., and I wasn't really sure what I had. It sort of felt, it felt odd to me that he never denied, you know, being involved. It didn't deny it was his Polonix account. I was, you know, kind of linking him to a pretty major hack, and it never, he never pushed back. He never got angry. And then so when I came back to the States, I emailed and I said, hey, just to back up your story, can you show me, you know, like log in records that like maybe this other person would have a different IP address and your polo account should show that?

And can you show me your withdrawal, you know, history at that time of that, you know, that Sunday and Monday right up before the attack to sort of like, you know, I want to believe you, but just show me, show me what you, you know, can you back it up with some of, other evidence. And he checked and he had closed his polo account in 2018, so he couldn't send anything like that to me. ShapeShift at the time didn't keep records on anybody's identity only to transaction records. So that was a dead end. And, you know, I emailed him many times and said, this is, you know, this is what I'm planning to report and to say, I want to make sure you're aware of it. And, you know, now is your chance to say, you know, I misspoke. No, that's not what

happened. You know, I gave him several opportunities to do that as I always do when I'm doing this kind of thing. And he didn't respond to any of those. So I, as I said, I laid it out as straight as I could in the book. And I really want to leave it up to readers to make up their own mind. I think it's, I'm happy with it that I'm pushing the ball forward here as much as I can. And, you know, it was, it was a fun, exciting thing to do. And I think, I hope people think it makes the book more interesting. Yeah. One thing I realized is maybe important context for people who are newer to the space and less familiar with some of these exchanges is that that sequence of events going from Polo to

ShapeShift and then after that doing the attack, the Shapeshift Stop is a way of doing an exchange of tokens crypto to crypto exchange without having that being attached to your identity because as you mentioned,

Shapeshift didn't take identifying information. And that was a behavior that the original down attacker had also used where they had taken you know, I think it was Bitcoin from an exchange, converted it to ether via shapeshift, and then after that commenced the attack.

Yeah. Yeah. Lots of mixers were used. And yeah, definitely. Very common thing. And one other thing I wanted to say about his comment about how it wasn't that difficult is that because it was a copycat attack, you're right that one way to interpret his comment is that it was known.

I mean, in fact, the vulnerability was known even before the attack. It's just the way that this one was conducted used, like combining basically the vulnerability across two different contracts to exploit it. So that was maybe the tricky part. But regardless, it was something that had been discussed before. And then, you know, by that point, it was known how it was being done. So, I mean, did you think that that was what he was saying? Like, it wasn't that hard because everybody knew how, how. how the attack was, how to create such an attack? No, I took it as, you know, he was saying, like, that I just, I took it at face value that this wasn't that big a deal. And that's, that's how I read it. And that's what I still think to this day. And I think another point is there were a lot of vulnerabilities that had been identified in the Dow, but the actual exact spot where you, you needed to attack it had not been made public by anybody until the Friday hack exploited it. Amon Gonsair and Phil Dian at Cornell, they had found it, but they didn't tell anybody about it.

And then it was too late. So it's also, this didn't get in the book, but I thought, you know, this is really interesting to me. When I was like triple checking list, I had some people help me. And we looked at the attack contract on Friday. and that attack. And it's clean. It's like really well done. It's,

you know, and then we looked at the Tuesday attack and it's like all over the place. It's got all these line breaks and it's like sloppy. And it was, that's another reason why I think, you know, this was a copy cat. And so I just thought that that's really cool that, you know,

that even the code looks different. You know, it's like the person who showed like when I first, we were doing this, they're like, oh, God, look at this. code is terrible.

You know, aesthetically, it was just like really, like it really bothered this person that, you know, the lines are going over and it's just like it looked like if a writer didn't know how to use a tab function and the page was just all over the place. So I thought that, you know, that was just fascinating to me. And it's also just another point that is so fascinating is all of this is still out there. It's all in the public record. And, you know, the things that you can find in the blockchain space, like it never forgets anything. So I find that one of the more amazing parts of this new, this new field.

And did you look into any of Tomawake's business associates to see if there were any people who seemed plausible as the person who he could have been dealing with who had access to the account who could have perpetrated the attack? No, I did a little bit of research, but, you know, it wasn't very fruitful. And the way I understood it from him, it's like this wasn't necessarily a business contact. It was just somebody he was, you know, doing this for. In one point, I think in one of the quotes he gave, you know,

he said to me was that this person who he was brokering for couldn't do it in the, in their local area. And so afterwards, I thought about that. reading between the lines, maybe they were in a part of Asia where crypto was being, you know, suppressed or, you know, total wild speculation. North Korea is a tough place to do crypto, right? So if I'm just making that up, but I think parts of China, you know, there were. Yeah. There are places where, you know, you can't really get online to do that. So I feel like it maybe wasn't necessarily that this person didn't know how to do it. It's that they were

excluded because of where they lived from doing it. And if that's the case, then it could be somebody who's very good at this, but, you know, is hindered because of that issue. Yeah, and that's how I read that part of your book that it was, it had to do with some kind of jurisdictional issue. So one other thing is that at the end of your book, as Ethereum Classic emerges, you write, quote, some of the ETC Ethereum Classic supporters were bad people, but I never planned to write about this part of the story anyway. From the outset, I wanted to stop after the hard fork. Why was that your intended stopping point? I think because that is a whole new era, in my opinion, in Ether, in Ethereum, excuse me. The ICA craze had already started and it obviously got going really in 2017. And so, I knew that I was going to be, you know, picking up the story from the Talek, you know, in 2013. And I went even back further in his life and wrote about his upbringing and his high school.

And, you know, so I knew I was going to have a lot of years to cover. And I wanted to cover them in detail. And so I felt like that was a natural stopping point because I feel like that's the next point where somebody could write a whole new book on that chapter. that started with the Ethereum Classic and then went on to the ICO craze and Bitcoin hitting 20,000 and, you know, ether going to 1,200. And then here we are, you know, with the three years later, like the defy, you know, stuff is a direct, you can draw a direct line from that to now. So I, and I also like getting into the Ethereum Classic and stuff, it's, it's complicated. I like complicated things, but it gets really complicated.

And then you're also, you don't have an ether scan for Ether Classic. You know, you don't have the tools that are there. Like the Ethereum community has created all these amazing tools to keep track of things and to investigate. And so I just knew it would be even harder to do any work, you know, on that chain. And so for those reasons, I felt like that's, that's, where I wanted to stop. And you did also say that you felt that was a whole other story to tell and a whole other book. And you said, you know, you're not going to include that story. But I was curious, do you want to hint as to what happened there with, you know, Ether Classic coming on the scene?

You mean why I said there were bad people involved? Yeah, yeah. I'm, I'm now paraphrasing the rest of that quotation. But you were talking about the early months of Either Classic and you were saying that's like almost a whole other book. Yeah. Well, so many different people who I knew on the dev side are still like seriously traumatized by that, like that period. I think there were like one person I know, like I think, you know, was battling with suicidal thoughts and people were coming after the, so the Robin Hood group, you know, had helped fix

like take care of the Dow issue, that group changed into the White Hat group that went forward and some of the members were different. And the White Hat group was sort of involved with when Ether Classic came on the scene because, you know, they had all, now suddenly they had all this Ether Classic on their hands and they didn't know what to do with it. And I, you know, I think there were threats being made. I think that there might have been some major criminal elements involved, throughout the world.

And, you know, when I talk to some of the guys about this, they get really upset. And so it just struck me that, you know, these guys have been doing this for free for months and they were exhausted. And then they had this whole new problem on their hands. And people were like coming after them, coming after their families, legally threatening them and doing other things, you know, that you probably just nobody would want to go through. And so that's what's sort of informing me on that point. And what would you say overall the significance of the Dow and the hard fork has been for Ethereum?

I think a big lesson was that there should have been a cap on the Dow. It shouldn't have been allowed to just, you know, to pull in 150 million and then go to 250 million when Ether went up in price. I think that was a mistake. I think there should have been a sort of emergency break or some sort of. sort of, you know, way of stopping what was going on when this, you know, a problem was, you know, came, came out. They certainly knew that there were a lot of bugs. Many different people had gone through and found different problems with it, but nobody was, you know, willing to say, well, we should, we should not do this. We should take a break. There were calls for

that, but I mean, what I mean is that the community wasn't willing to go along with it. I think that that comes down to everybody had money in the Dow, you know, like everybody. It was the only thing really going at that point for Ethereum. And so I think that those are the lessons. Unfortunately, I don't think they're being heated very well. You could see in a defy moment we're in right now. Projects like Yam are collecting over $100 million in mere hours, and that had no audit, you know, and so it's crazy space.

You know, people are going to do what they want to do. And the thing of the reason why is because that's what Vitalik wanted, you know, his original idea was I want to give people a platform for creating whatever they want to create and on, you know, using this system of distributed global computers. And so when that's the goal of the, you know, and the reason for it, you know, you're going to get everybody on the spectrum from doing really well, audited and, you know, security-wise projects to people just thrown stuff, you know, cutting and pasting, basically, forking uniswap, you know, to all these things.

And so that's just people in this space have to make peace with that because I think that's, that's, that's just what it is. You also talk a little bit in your book about corporate adoption of Ethereum. And here now you've been talking about how Defi is also taking off on Ethereum. In general, where do you expect Ethereum's next chapter to go? And what are you looking for as this plays out? I think if we're following the 2017 script, there's going to be a big boom and bust here with DFI projects.

We've already seen a few. People are going to get hurt. People are going to lose a lot of money. But what's going to come out of that is a whole new sort of Lego piece to this environment that is now going to work. And even though, like, there were bad actors and people, you know, got greedy, it's like, it's going to be, I think the lending and the collateralization part of this ecosystem is going to, is going to be battle tested and be ready to go forward. Kind of like the fundraising piece was battle tested and shown to work in the ICO boom, even though, you know, the vast majority of those projects were scams. But it showed that now for the first time people can raise money directly from their users.

That's an amazing advance in how people can raise capital. Here we're seeing really interesting developments with lending and, you know, earning interest and incentives to, you know, lend people your crypto. Of course, nobody should think that a thousand percent API is ever sustainable. But, you know, for maybe two hours it is. So good luck getting in and out of that. But what I find fascinating is I think that these people are building. And it's kind of a cliche, but people kept building through the long, bare market after the ICO craze.

And here we are. And we have a whole new chapter in ETH. So I feel like it seems like that's how really important pieces of this ecosystem are getting created. for your coverage going forward, do you expect to stay focused on Ethereum in particular, or will you branch out? Because obviously, Ethereum has these scaling issues, although, I mean, it is transitioning to 2.0. So it's unclear how, you know, how dominant it will remain. But do you expect that you'll stay focused on this one blockchain or cover all of crypto generally? Well, I think I think I'll stay focused on Ethereum, but also if there's an ether killer, as people always say, you know, That will get my attention as well. I think it's fair to say that so far there isn't really a competitor. That doesn't mean there won't be.

And, of course, seeing how E2.0 plays out will be really interesting. And whether, you know, that does solve some of the scaling issues. And I think, you know, I'll also be covering like the things like MetaMask going mobile and now having a browser. so people can, you know, start interacting with Web 3.0 stuff is fascinating and I think has the potential to really start driving some crazy disruption and innovation. When all, like, that's another piece of the puzzle here. And something I wrote about for Bloomberg a couple weeks ago was, you know, another promise of Ethereum was that we didn't get into this, but I think it's really important.

It's to help people get their privacy back online and to have. control over their data and to be in charge of what they do and who sees what. That's been completely lost in Web 2.0 and it's pretty much by design because there wasn't a payment method embedded in the web. So data now became the currency and your data about where you're clicking and shopping and all that became really valuable and is why the web experience is so terrible. And so I'm hopeful that a lot of really good youth devs are working on this stuff all the time to make that new sort of web where users have much more choice and privacy becomes a reality. And you gave a few hints about this in your book.

And so I just wanted to ask, you know, cryptojournalistic cryptojournalist, but in general, how would you say covering crypto is different from covering other industries? It's very different from Wall Street. It's, you know, I think it's very, it's much more idealistic in a lot of ways, much more naive in some ways. And I think those go together in a lot of cases. I think people in crypto tend to be much nicer and kind of like have a, usually have a more interesting background. than some of the people I've known on Wall Street over the years. There are definitely some great people on Wall Street, who I know and have known, but they're in the minority.

And I would say in crypto, it's the flip side of that. There are a lot of great people, and then there are some terrible people. But, you know, I'd say 80 to 90 percent of the people I've gotten to know in crypto are great people, and they're very helpful. And, you know, especially to a reporter who, you know, I need to ask a lot of dumb questions to try to figure stuff out. You know, it's nice. And they're open.

And you don't have to jump through the hoops of, you know, trying to go, you know, try to go get a quote out of JP Morgan. You know, it's going to take you a week of PR emails and stuff. And so it's, that's very refreshing to me. The pace of it is also just off the charts, as you know. I mean, it puts Wall Street to shame. They have like an annual year about every three weeks. I would agree with that.

So I saw you tweeted, we're also doing a blockchain linked special edition of the book that'll prove the rarity of 1,000 copies with an amazing new startup. Can you tell us about that? Yeah, yeah, this is really cool. So Luxo is the blockchain. It's started by Marjorie Hernandez and Fabium Vulgar Sutter. Fabian was one of the core devs on Ethereum. And they've created a new blockchain that's basically based on Ethereum, smart contract.

And what they are doing is one of their first appeals is to the fashion industry where you want to be able to prove that your Gucci handbag is real and not a fake. So you can register it on a blockchain and you can then point, you know, if you want to sell it or you just want to show somebody that, no, I didn't buy this, you know, on Hudson Street. It's actually a $20,000 handbag. You know, it's, it's, it's that, that's the, that's the problem, you know, and, and sometimes they even, they're using chips, you know, to do that. But the blockchain, you know, is great for that because it has an immutable record. And so what we thought with the book is, you know, I played around with like an NFT kind of idea, but that doesn't seem to really work with a book.

But we're, we're going to be making a special edition. It's going to have a new cover. and then there's going to be a QR code on the back, and that's going to be the public key. And then inside the book, if people who order this, there'll be a note card with your private key so that you can now register your book online or on the, sorry, on the Luxo blockchain. And, you know, it'll probably have a number. And then, you know, it's yours and it's kind of cool. Or, you know, you can go and sell it if you want.

And so we just, I was really, there's so many great things in this industry to, to get involved with and to kind of, you know, prove that this is interesting with a book. So that we messed around with a lot of ideas, but this is where we landed. And so I'm hoping to have that, you know, in a couple of months. So it's going to be, I'm really excited about that. And will you sign that or is the special edition part of it, the key on the back? Yeah. So you're going to sign it with the private key that's in the book itself.

So everyone is, I think they're going to, and we're still working this out. So I apologize if I screw it up. But the QR code is going to have to be the same for every thousand. But that'll take you to the Luxo blockchain. And then you'll have a private key that I'm going to make and add, you know, put into the book for you to then link up and say, okay, now I'm signing, you know, this transaction proving that this is my special edition number of 55 or whatever. Oh, I see.

Yeah. And then if they want to trade it, then they have to physically make. the copy like an eBay type thing? Yeah, I guess so. Yeah. And we're hoping to get some of the co-founders to sign a few of these and auction them off for charity, you know, and do stuff like that. Just have fun with it.

So I'm hoping that's going to be ready in a couple of months, like I said. Cool. I'm filing this away for my book. I'm like, hmm, I should think of something fun, blockchain related. I'll be your guinea pig. Okay. Great. Thank you for.

presenting on. And is there anything I didn't ask you about the book that you wanted to say before we go? Well, I don't want to leave the impression that it's just about the Dow. I think there's way more than that in the book. And one thing that I liked that I did necessarily set out to do, but that I think came across well is I think I got a really nice picture of Vitalik and his life and where he came from. And, you know, I think obviously people know a lot about him, but I think there's a lot that they don't know. And so there's that aspect to it that I was really happy with. And, you know, it's, there's a, like the Dow, if you buy this thinking, it's just about the Dow, you're going to be disappointed. It's, it's in there, but it's definitely not the majority of the book.

And when you say, you know, Vita, his back story, what, how would you say he changes over the course of the book? Well, I think I was, what I liked is that I thought I was able to, or it's, seemed to me that I was able to show him from a lot of different sides. I was able to show him when he was vulnerable, when he was cocky, when he was, you know, being whimsical. You know, he's shared emails with me that he was writing home as he was going on his journeys through Europe in 2013 when he was coming up with the idea for Ethereum. I got it. I got some of, he wrote this amazing thing when he was seven called the Encyclopedia of Bunnies. I've got several entries in there, and they're just hilarious.

And I think enough, that really opened him up to me as a person that you know he's brilliant, but then you see this whimsical funny side to him and that, you know, a seven-year-old is writing this 20-page document all about bunnies and all these different entries on, like, you know, how many men and women bunnies are there? And, you know, there's these jokes. and I don't want to give them away, but, you know, I just found that really great. And, you know, as a writer, you want to try to get people and make them into rounded real people. And I think over the course of the book, I was happy with how that came out.

Yeah, I have to make one comment here because one thing about reading your book for me was like, oh, oh, since Matt revealed all these things now people will think I got them from his book, even though I had them from my book. But it's okay. It's okay, people. It's all right. Sorry. Sorry about that.

All right. Well, where can people learn more about you and out of the ether? I'm on Twitter. It's just at Matt Lysing. I'm on Bloomberg. You know, you can find me on the web. And out of the ether is, you can pre-order it now. It's going to be out, I think, next week or the week after.

and so, you know, Google is your friend. Great. Well, thank you so much for coming on Unchained. Thank you, Laura, for having me. It was really nice talking to you. Thanks so much for joining us today. To learn more about Matt and out of the ether, check out the show notes for this episode.

Don't forget, you can now watch video recordings of the shows on the Unchained YouTube channel. Go to YouTube.com slash C slash Unchained podcast and subscribe today. Unchained is produced by me, Laura Shin, with help from Anthony Yun, Daniel Nuss and the team at CLK transcription. Thanks for listening.