Unchained - How NEAR Intents Identified a Suspect and Got Its Stolen Funds Back

Starting point is 00:00:00 But imagine if you're finding the vulnerability, you are reporting this vulnerability. You're getting a bug bounty. Bug bounties are pretty high. Buck bountry that is enough for you to buy LAMBO. And then you are a keen on the cocktail parties. And then all of the girls are around. And you're saying that you are the guy who discovered this. And by the way, do you want to hope in my LAMB that I got up?

Starting point is 00:00:23 This is much better. Hi, everyone. Welcome to Unchained, your no hype resource for all things crypto. I'm your host, Laura Shin. Thanks for joining this live stream, and first we'll take a quick word from the sponsors who make the show possible. This episode is brought to you by 1 inch Aqua, the shared liquidity layer from 1 inch, back multiple liquidity positions with one wallet balance, and keep your tokens in your wallet until a swap fills. See how it works at 1inch.com slash aqua. Before we get started, I want to ask you for something. We're making a bunch of decisions right now about Unchained. What we make next, when we go live, what we should be doing more of, and I'd rather hear from you before we make them than after. So we put together a survey. It takes just a few minutes.

Starting point is 00:01:12 It's anonymous. And there's a box where you can tell me what we could be doing better. I read all the responses. The link is in the show notes. Or you can snap the QR code on screen. Or go to Unchained Crypto.com slash survey. Thanks. Today's guest is Alex Chavchenko, GM of Near Intense.

Starting point is 00:01:34 Welcome, Alex. Hello, Laura. We're happy to finally be here. Yeah, yeah, nice to connect. So last Thursday, Near Intens had to halt services after someone exploited a bug, causing the protocol to lose $3.8 million. Explain what happened. So this was a complicated bug in between the Omni infrastructure that is

Starting point is 00:01:57 taken care of the bridging of the assets inside of the protocol. Neur-intense is a complicated protocol that spans across multiple networks. That's why we need to coordinate the interaction between these networks. And this infrastructure have been interacting with the NIR side of the protocol and the smart contracts of the NIR. And within this coordination, highly asynchronous coordination, it was a bug. And the attacker has been exploiting it. Extremely complicated bug.

Starting point is 00:02:24 This was audited multiple times. unfortunately our auditing companies were not able to discover this mode of operations and this sequence of the actions that was leading to the exploitation of this bug. And before we keep going, just explain for anyone unfamiliar what NIR Intense is and what relationship it has to NIRProtocol and NIR.com. Yeah, obviously. So NIR Protocol itself is a layer one blockchain. It is scalable with a bunch of interest in characteristics that it has.

Starting point is 00:02:56 advanced account model. There is also a private chart that is available there and lots of additional technologies like chain signatures, which is the MPC network that allows NIR smart contracts to have their own private keys. Now, NIR Intense is one of the applications that is built on top of NIR protocol. And so what NIR Intense does is combines all of the existing blockchains into a single interconnected unified liquidity. The whole idea is to simplify the flow of liquidity in between different chains, as well as the usage of the yield and the different other D5 primitives. You can think of it as like a swift of all of the blockchains, if different blockchains are

Starting point is 00:03:42 countries, or some kind of like a tissue that connects all of these blockchains and specifically financial use cases. The most prominent use case for near-intends is a cross-chain swapping of the assets or trading or spot trading of the assets. So, for example, people are using Neurintense to trade Bitcoin into ETH. NeonDense is available to our business partners and to anyone through a very simple API. And this API is used mainly by the wallets to integrate swapping functionality directly into their front ends.

Starting point is 00:04:15 We are serving ledger, trust wallet, many other wallets. And in general, at the moment, we are the leader of the cross-chain market swapping. and we are serving approximately 50% of the swapping volume. I'm excluding here stable coin bridging or eth movement in between L2s and in between L2s and main net, for example. And nere.com is a front end that is our own front end that implements the different functionality of the near intense protocol. I hope it's now clear what is the gradation in between this sense. So near is Ethereum. Near Intense is uniswore.

Starting point is 00:04:54 And NIR.com is uniswop.org. That is kind of a very simple analogy there. Perfect. I'm sure most listeners can fully understand that. So to go back to the hack, how did it work? This obviously spanned multiple chains. So what can you tell us about what the exploit was? The attacker has been focusing on one particular chain, which was the B&B chain,

Starting point is 00:05:20 and one particular asset there, which is USDT. So he was trying to send a very specific set of transactions towards this infrastructure. The infrastructure was tricked, believing that he did deposit the assets. So it created the record on the near side in the smart contracts that this user has, these assets, while in fact these assets were not deposited. Omni infrastructure is called Omni because it is not uniform. It heavily depends on the way how the third-party blockchains are working. So for example, Bitcoin infrastructure and Zcash infrastructure are pretty different from the EVM chains,

Starting point is 00:06:00 as well as different EVM chains because they have different security properties. Some other chains were also affected, and that's why the operations of some chains were uninterrupted while others have been stopped and the fixes are incoming into these chains and the only infrastructure there. So this happened just a few days after the BitGat hack. or maybe like roughly a week. And that one was a spoofing attack that used one of their third-party services. From the way you described this hack,

Starting point is 00:06:34 it also sounds like the near intense one was a spoofing attack, or did I read that incorrectly? I would not say that this is a spoofing attack. This is mainly the internal, complicated, asynchronous logic of the protocol and how it works. If we were in the Ethereum world,

Starting point is 00:06:50 we can say that the smart contract is broken. in our more complicated, asynchronous multi-chain setup, it's not just a single smart contract, but the interaction of different components was not work interaction. Oh, okay. So there was literally an exploit in the code, a vulnerability in the code.

Starting point is 00:07:11 Correct, correct. And so actually it reminds me a little bit of some of the DDoS adderics early on in Ethereum in 2016, where again, it was exploits. things in the code itself. Okay. So it also sounds like from the way you're describing this, that this actually took place over time and then it was only at a certain point that you detected the losses, or did they all happen in a short period? They were happening in the short periods. The reaction time was around 40 minutes on this stuff. So we do have quite a lot of monitor.

Starting point is 00:07:44 And through near intense, we usually have approximately 200 million US dollars going through approximately one to three transactions per second every single day. This is sustained load. And that's quite a lot. That's why we understand that it is extremely important to monitor the state and monitor the invariance and the different condition of the protocol in order to be able to quickly react. Because if we're not doing this, we're going to have quite a lot of support cases that

Starting point is 00:08:13 we need to somehow resolve and so on. And we also can lose quite a lot of money because of the bugs and the protocol. That's why we have lots of systems and the bug was, we have seen it internally pretty quick. That's why we were able to react quickly. Get all of the Security Council on the call, pose the contracts and then start acting. Okay. And how did you detect the losses? We have seen that some invariants were broken.

Starting point is 00:08:39 In this case, the invariance of what protocol believes is deposited inside of it versus what is actually inside of the treasury contracts on the respective chains. Okay. So initially when you announced this, you said that you planned to compensate the losses in full. What method were you going to use to do that? Yeah, we're just going to take the money that we have and just put it there. That's very easy. And the reason why we're doing this is because we definitely saw that there is a bug in the protocol,

Starting point is 00:09:10 which means that this is our fault. This is not a fault of the users who have been debaustin performing the trades. So we need to cover for this. And we do have money to cover this loss. It was like a very straightforward. There are no two different opinions on this. If we would not be recovering these funds, we would compensate it from our own pockets. Okay.

Starting point is 00:09:32 And then for the Security Council, how many people are on that? There are pro. As far as I understand, there are like six people. Oh, okay. Okay. So it's taken plus minus one. Yeah. Okay, so quick decision.

Starting point is 00:09:47 All right. So in a moment, we're going to talk about the recovery because the funds were recovered. But first we'll take a quick word from the sponsors who make the show possible. $540 million. That's how much concentrated liquidity sat idle in a given week in the first half of this year. About 30% of the Defi TVL, if you're wondering. That's according to Dune research commissioned by one inch. But there's a solution.

Starting point is 00:10:11 One-inch Aqua is the new shared liquidity platform. It lets LPs back multiple positions with the same token balance and keep their tokens in their wallet till a swap comes. Why does that help? Because LPs don't have to split their tokens across positions. They can cover more market conditions and pairs with their full balance. That means more activity across deeper liquidity. See how it works at 1inch.com slash aqua.

Starting point is 00:10:35 Remember that providing liquidity carries risk and fees aren't guaranteed. We've got a listener survey open. It takes just a few minutes. It's anonymous, and it changes what we make next. Use the QR code on screen or go to unchained crypto.com slash survey. The link is in the show notes. Back to my conversation with Alex. You announced that you had reported the incident to law enforcement

Starting point is 00:11:01 and we're working with security and blockchain analytics partners to trace the funds. Which jurisdiction or jurisdictions did you reach out to? Or how did you know which ones to reach out to? Like, did you have some awareness from the start of the geographic location of the hacker? We didn't have back then the awareness about the location of the hacker. And that's why obviously when such an event happens, we contacted our legal department, and they started to reach out to the law enforcement in the jurisdictions for the different entities that are incorporated for the protocol. And that is kind of like a natural decision there.

Starting point is 00:11:41 and they started to go through the process. This is not like, you know, push a button and then everything is done. They need more information. So they started to gather this information. But our motion was to start this process and tell to everybody that we are moving forward with this process, though it was not up until to the point when this is already done. There is a case and all the stuff. We were in the process of getting all of the information.

Starting point is 00:12:08 Okay. Well, then 12 hours after. you announced the hack, you tweeted, quote, we have identified you, sir, please return the funds to the following addresses. And then you listed, I guess, it's probably four different addresses on Bitcoin, B&B, Ethereum, and Solana. And then you said, you know better than most how responsible disclosure works. This is the last window to use it. After 48 hours, that window closes. So how did you so quickly identify this hacker? And the Security Council is also the investigation council, which means that we have been looking into all of the logs, into all of the

Starting point is 00:12:48 pieces of information that we are able to gather from the publicly available information, which is both Web 2 and Web 3, and also internal logs of the system. We were able to find the very hard and very convincing evidences that are linking the exploitation accounts with a particular or person or potentially with a group of people that are extremely close to this person. At the moment when our confidence was very high, this message was constructed. This message is constructed in a very specific way to let these people that we suspect were performing the attack to let them understand that we know who they are. besides that i have sent the person a separate message privately and i said that hey we have

Starting point is 00:13:44 these evidences of connection i'm not accusing you of anything i'm asking for help so you're building something and we believe that there are not more than 30 people that are using this thing around and please help us save the logs share it with us and by the way there is this public message that is available and maybe we are able to resolve this then please share this with maybe you know some people. So our approach here is what was happening behind the scenes here and things that are not visible. And our approach here is very, very simple. I don't want to put people in, I'm not police. I'm not here to put people in jail. I'm not their dads to teach them how to live. I'm a simple guy. I just would like the money of our users to be returned. And that's my primary goal.

Starting point is 00:14:30 And that's why we are executing it in a way that the person is able to escape this situation. there is public communication, there is this plausible deniability of this particular person being involved in this. I can say that this is not the first attack on your ecosystem. This is actually the second one that is public. Before that, there was one additional. This is like a third recovery process. But the previous one, the first one that was public, it happened in April this year. Approximately 20 million US dollars were stolen from RIA protocol.

Starting point is 00:15:04 and a very similar set of actions were conducted back then. Security Council, the brightest minds of the ecosystem gathered together. We were scrapping all of the logs and all of the information that we were able to find. We had a very convincing set of evidences of connection to a particular person. We reached out to him. We put public messages and in the end, all of the money were returned back the same way how here. This doesn't mean that these people are guilty or like they are the hackers. because there might be the situation when the hackers just got scared.

Starting point is 00:15:38 I do not believe that it is a proper thing to share the identities of these people. I do believe that the goal of the recovery operations achieved. And we got there and this is exactly the outcome that we have been looking for and everything else now remains history. I didn't follow when you said that you weren't fully sure that this person that you had identified was actually the hacker. And then you said something about. they might have gotten scared, but I didn't know what that meant.

Starting point is 00:16:08 What I'm saying is that imagine that this telephone is the telephone that has been used for the heck. Is it me who was pressing the buttons there? Maybe I don't know, my wife was doing something. So it's not quite clear who specifically is there. There are lots of evidences that are focused on this particular person. However, it might be some additional people who are his friends and are operating on the same set of systems. systems and software. So that's why I do not feel right to accuse people. Because I'm not able to accuse them up until the moment in time when we have recorded evidence is that this is the guy who's

Starting point is 00:16:45 pressing the buttons to steal the money. And again, this type of an investigation, you know, to really get to the point when we're 100% sure who is the person, it is not needed. That is not the goal. The goal is to return the funds. And this is what we have been focusing. and this is what we are focusing every time when situations like these are happening. Okay. Well, so maybe I'm reading in between the lines. So you tell me if this interpretation is correct. But that phrasing, you know better than most how responsible disclosure works.

Starting point is 00:17:21 It leads me to believe this person had been involved in some kind of previous hack or like wallets related to them or something. Is that like a good guess? you might be reading this correctly or maybe not okay and is it somebody who was involved in multiple and then like left their jurisdiction and has never been heard from again and is like a very young person i cannot comment on this but i can give you another interesting thing do you know this wonderful US show that is called pen and teller. I do. And then magicians are coming and show into pen and teller different magic tricks.

Starting point is 00:18:07 And then the pen and teller are talking back in code to them in order to say to them that they understand how this was done. Yeah. So we are playing a little bit of a pen and teller with the hacker telling them in code that we kind of know what happened. And the same thing was in the second message when the attacker was sending us and on-chain message that, willing to cooperate, please give your signal to us. And what we did, we provided encrypted message in the next tweet. And this encrypted message was encrypted with the public key of the attacker. And in this encrypted message was a signal group to join. So we knew that this group was created. And then the only person who is able to decrypt it, up until the

Starting point is 00:18:56 moment the quantum computers are in existence, so that the attacker actually decrypted this messages and the only person who was able to join was this attacker. And that's why later on, when he joined the group, we were able to have the private communication channel that is not available to the outer world. Within this communication channel, we had a chat about this situation, again, with lots of room, but even for plausible deniability. And the, you know, the, attacker right away said to us that he's intending to return the funds. However, we incorrectly determined that the funds are still staying on ETH, being B-Chene and Solana, while in fact they have been traded into X-M-R. So one of the reasons why he wanted to contact with us is to figure

Starting point is 00:19:47 out what is our Monero address or what is the Monero address to return the funds. So everything was correctly identified on the Bitcoin blockchain, but the other assets have been traded through some kind of hardly traceable. Maybe these were ODC desks, maybe something else. I do not quite remember or I do not know. However, like the rest of the funds remained in XMR. So he was willing to get the information about XMR address. Okay. So brilliant idea to use the public key. So of course, nobody else can join the Signal Group. That's very smart. I'm going to add. ask of slightly, I don't know. I'm just curious, so I have to ask. But you mentioned B&B, and that chain is widely used in a certain geography. So was that person kind of in that part of the world, like more

Starting point is 00:20:39 like in Asia? I am not going to comment on our suspicion here. Once again, Laura, our goal here and this person was cooperating. And we don't know whether what person that we're suspecting is the same person that have been answering us in the group. That's why everything up until this point is just some kind of correlations, some kind of evidences, but it's not the decision of the court that this person is guilty and so on. I do not want to cause any troubles. I hope that the hacker, or like we were able to influence the hacker wherever this person was, to reconsider what he or they have been doing. And hopefully they will be using the bug bounties in the future instead of hacking.

Starting point is 00:21:30 Bug bounties, they are available for Nier Intense. By the way, since that hack, we did have several bug bounties submissions. And one of these submissions was actually correct ones. Oh, we're going to pay out a bounty there. Yeah, but that's the proper way how to do stuff instead of me thinking together with the financial department thinking, okay, oh my God, how we're going to convert XMR into UD to kind of top things up. Because again, lots of other companies are not very happy about XMR. They're asking for the source of funds and what are we going to say the source of funds.

Starting point is 00:22:06 Oh, they collect funds from your intense exploits. So this whole set of problems connected here have some trouble, but we're going to figure out this in there. Oh, so you haven't figured out. You still have just the XMR. Yes, this part is in process. However, from our own pockets, we were able to replenish the funds inside of the smart contracts already. Okay. So I need to now return money back to the pockets.

Starting point is 00:22:36 Okay. It's very funny that the first time when I touched XMR was exactly during the heck. It's so funny that they say very true about the XMR and what? this coin is used for. Well, I did want to ask, so when you talked to, so you had tweeted what you just told us about how you feel like the better way for people to handle something when they notice that there's a vulnerability is to use bug bounties. But it almost seems like your announcement, your tweet telling people, please use bug bounties

Starting point is 00:23:11 instead of disrupting services. Like, it sounds like you literally saw people actually right after take advantage of that. Is that, like, do you think you're. tweet was spurred that to happen. It's just so interesting that. No, it's like I'm the father of two boys, right? I'm a little bit like when they're wrongdoing. I'm trying to explain to them what is good and what is bad. I'm sad that I'm not trying to be a father of anyone in crypto. Everybody are adults, but at least I'm trying to explain to the world what I think is good and what I think is bad. it was kind of like a message to hackers and to people who are considering this.

Starting point is 00:23:53 And this message is that, hey, guys, like, I do understand that many of these people are young. Many of them do believe that they can do something. They can't be very unique in this sense. But in general, this, like, hacking and stealing is not a very good thing. You're going to end up with black liquidity. There is extremely high chance that you're going to be traced if there is a qualified it's counter party on the other side. You're going to be traced.

Starting point is 00:24:20 If people have a different philosophy of how to handle the situations rather than us, there is a high chance that you're going to be tracked up until the point in time that you're going to go to jail. It doesn't worth it. You even cannot tell this story on the parties on token 2049.

Starting point is 00:24:38 But imagine if you're finding the vulnerability, you are reporting this vulnerability. You're getting a bug bounty, and the bag bounties are pretty high. back bounty that is enough for you to buy LAMBO and then you are a kin on the cocktail parties and then all of the girls are around and you're saying that you are the guy

Starting point is 00:24:57 who discovered this and by the way do you want to hop in my LAMO that I got up with that? This is much better and nobody is disrupted and everything is great. Nobody is thinking now how to convert XMR into USDT much smoother

Starting point is 00:25:14 and a very great story to tell to everybody and say that you are the king, you are the prince, you're white knight on the white horse, and you're here bringing the joy and better security to everybody else. I think that this kind of point of view is priceless. It's much better and this story is much better than every time I'm just looking, is anyone watching my bag and I cannot tell anyone that I hacked and it's very hard for me to use this mind. That's kind of my point of view and that's why, like this cry to people who like doing these things, like hacking things, and I don't say that this is bad. There are many whitehead hackers. So my cry to them is that please, please use

Starting point is 00:25:59 backbounties, do good stuff instead of disrupting the services. This reminds me for my book, people talking about the Dow hackers said stuff like if he had actually, instead of hacking the Dow saved the Dow, then he would be a hero. And his reputation. would be golden forever. He'd be beloved by the Ethereum community. Exactly. Yeah. Instead, things went totally different way.

Starting point is 00:26:25 So these are actually some takeaways from the whole incident, but I do want to ask more about what you learned from that because obviously we're in this kind of extraordinary moment in crypto where we have just seen an incredible number of hacks this year due to the rise of AI. So first of all, do you think this hacker used AI? And second, like, what are you doing behind the scenes? to try to protect near intents from the kind of more vulnerable surface area that you have. Yeah, absolutely.

Starting point is 00:27:00 We as a protocol that settles half of the trading volume of the cross chain, decentralized trading volume, we know everything about hacks. Every single hack is trying to be laundered and move across different chains through us. And that's why we know everything. We knew when the BitGET hack happened in tens of minutes. We knew when the by-bit hack happened. We know everything. That's why, already, for a very, very long period of time,

Starting point is 00:27:27 we're working closely with the investigation agencies, with intelligence agencies, with many biggest centralized parties in space, stable coins, exchanges, and there is an exchange of the information about the hacks in order to try to contain the damage from these hacks. So it's not that we are exposed only to our own hacks and the hacks of the closest projects in the near ecosystem,

Starting point is 00:27:53 but actually we're exposed to every single hacks. There was like an amazing operation that nobody knows about around the drift hack on Solana. Like there was lots of countermeasures just in real time what hackers were attempting to do and how they were attempting to move liquidates. Us shutting the doors on near intense. That's an amazing story.

Starting point is 00:28:13 At some point in time, I'm going to write a book about this stuff too. Now, we have seen that there is an uptick of the AI assisted hacks that started to happen in March this year. So AI systems became smart enough. Attackers started to use them to assist in these hacks. And back then, we understood that that is going to be a problem. That's why we started to invest in our own system to protect against this, to detect

Starting point is 00:28:44 this situation. We knew that hacks are going to happen. We are not able to protect drift itself or buy bit, but we are able to quickly detect it and try to shut the door and say, no, no, no, no, we don't want to interact with this, with this money. And that was the birth of the system that we call shield. This is wider than just hack detection. It is also detection and deviation of the operations of the blockchains. Earlier this year, there was an incident with light coin. So this system detected that light coin started to have a degraded performance. And that's why it slowed down and actually eventually stopped some of the transactions. And it decreased our losses within that incident by 80%. The system is also performing the money laundering checks and many additional

Starting point is 00:29:35 things. This is kind of like our internal Oracle, if you wish, that answers us a question, is there something sketchy happening here? And then this system just takes all of this information and tries to analyze it and give us the answer. This system, we're continuing to reinforce it, but already with the BitGat hack, the stats on the bidget hack and how the system operated is amazing. When it fully understands that something sketchy is happening,

Starting point is 00:30:03 it does respond that we have no liquidity to trade to these funds. This is a very simple response, and then everybody are able to expect that you can just kind of trade, right? We detected more than 50 million US dollars who were trying to path through near intents that are connected with this hack. In cases when the transaction is in the process, the system and the tax that this has happened, it stops the execution. And then the compliance council needs to make a decision what to do with this funds.

Starting point is 00:30:32 Approximately 500,000 US dollars were locked amid execution with this system. And in case it is not able to understand in time and execution finishes, it means that these black equities flowing through the protocol. And through the near intense, it was only 166,000 U.S. dollars, which passed. And from my point of view, this is an amazing and excellent stats, because 99% was kept outside of the protocol. Approximately 1% was frozen mid-execution. We would like at least to be zero, obviously.

Starting point is 00:31:06 but still it's better than allow to trade of 166,000, which is less than half of percent of all of the funds that were attempt to go through us. I do believe that it is very important for everybody who are building in the blockchain vertical to understand what are the boundaries of the technology that they are building. That's okay that I'm not able to execute transactions

Starting point is 00:31:34 on the Ethereum main net without having ETH to pay for the gas. And this is not hindering Ethereum being permissionless. And I hope that the rule that we do not want to help people launder money is not making our system non-permissionless. It's just a different behavior for different set of users. Ethereum is not for people who don't have ETH, the same way near-intense is not for people who want to launder money. So yeah, my next question was actually going to address that because I'm sure you know that on the timeline there's a debate about, you know, when, you know, you can do something about stolen funds and try to help prevent those from, you know, getting away. The version of the debate that I've seen largely centers around centralization versus decentralization.

Starting point is 00:32:30 And so what I was going to ask you was if there is a point in the future where you think near intense would be decentralized. where it would be not centralized enough to stop this kind of thing. But it almost seems like you're saying that you feel like it will always work to try to block illicit funds from moving through your system. So is that just an embrace of always being centralized? Or what do you think are the factors that determine when people should or when a system should act and when it shouldn't? So from my point of view, centralization and decentralization is also, orthogonal to the rules of the game.

Starting point is 00:33:09 Is Ethereum decentralized? Probably many will say yes. Some people are going to say, well, there are only two biggest miners there, so maybe not that much, but let's not go into the weeds. But then still, I'm not able to pay for the gas with a near token. Does this mean that it is kind of centralized on top of ETH? It is not, right? So from my point of view, there is this thing as decentralization,

Starting point is 00:33:35 and the question, what it answers is, is there a single party that is able to stop things? The answer about whether Neurintense is decentralized or centralized, the answer is that it is decentralized. There is no single party that is able to stop execution. There is no company or there is a person who is able to do this. There is a service that is running inside of the trusted execution environment. There is a key within this service. The service is called in Shield. Shield is, again, the system that collects all of this information.

Starting point is 00:34:08 I'm not able to influence this system single-handedly. This system is trying its best to protect everybody from this. So it is decentralized. And then if there is a lock of the funds, then there is a compliance council that steps in. Can people review on this? And this is like a multi-six style solution on top. So it is decentralized. But the rules of the game here are determined.

Starting point is 00:34:36 The same way how on the Ethereum blockchain, you must have ETH to execute transactions. There is no other way around. The same way in our system, we are trying our best to make sure that there are some like very, and I do understand the debate about that like there is the whole spectrum, right? There is stolen money, the money that I use for funding terrorism. This is really black.

Starting point is 00:35:01 And then there are people who, are sanctioned. They're sanctioned by whom? If North Korea is sanctioning you, is that really bad? If you're a political prisoner and then the government says that you are the criminal, is this bad thing? So I'm super happy that I'm not in the Compliance Council to figure these things out. And that's why the Shield system at the moment is blocking things that are like 100% bad.

Starting point is 00:35:29 you know, child pornography, finance and terrorism, and stolen and hacked funds, right? So like that type of things, we're not talking about your, you know, complicated aspects and the moral choices around this. Yeah, we knew at the moment of the reaction of the shield system

Starting point is 00:35:48 that big get was hacked. And it was, there was no, like, there is no, no other opinion on how this can be done. I'm going to give you one additional paradox to think about and also to the listeners. I'm in crypto since 2015 and I'm here for the same reason as many of the OGs. We're trying to build a better version of the future.

Starting point is 00:36:14 That is, can I decentralize without centralized parties? I do believe that we have a great chance of building the better economic backbone of the future world. Now, the tricky part with economy is that there needs to be value in this economy. In case the system that we are building is not protecting the value, which means that we're not protecting the ownership of some tangible assets, it means that we are destroying the value of these things. So these numbers that you're seeing in the ledger, now they should not have the value because they can be stolen and nothing is going to happen. There is no no responsibility for it, there is no, you know, consequences.

Starting point is 00:37:04 Which means that if we're building these type of systems without boundaries, it means that we're building towards the future where crypto doesn't have any value. So it is not going to become an economic backbone of the future. This is the paradox that I'm telling to you. And this is one of the thinking that that kind of says to me that fully open system that protects that protects thieves is not something

Starting point is 00:37:39 that is going to help us change the world. So it sounds like, so I feel like critics of your point of view would say, well then your system isn't censorship resistant. But you're saying for any funds where it, with almost near certainty, you can say these are stolen funds, you are going to do your best to block them.

Starting point is 00:38:04 And so, because obviously with censorship, the reason why censorship resistance is important is because, you know, not everybody lives in a jurisdiction where their government is good. And so there might be cases where people are doing something, quote unquote, elicit with their funds.

Starting point is 00:38:22 But when you kind of look at it, maybe from a moral perspective, it's like, oh, well, the government's saying it's bad, but, you know, maybe a lot of people would think that actually what this person living under that government is doing is good. So, but you're just saying for anything where it's super obvious, we are just not going to accept those funds. In general, yes, but I also believe that the current financial systems have been trying to somehow draw the line what is bad and what is not bad. They're heavily influenced by the governments and they're making different decisions. There is this thin KYC that is happening, and we know that it actually doesn't help that much.

Starting point is 00:39:04 Many people are laundering money through bought KYC accounts or the centralized exchanges. So this means that the existing solution in the Tredify is not good. And the questions that you're asking, how to determine what is the thin line that we need to walk here, within this very wide spectrum of absolutely white money that is trying to flow through the system and 100% sure black money, where is the line here? My answer to these, I don't know, but I do stand very strongly on a point that there are black money and there are white money, and we need to do everything that is possible in order to block black money, And in the middle, let's figure out together how we are able to properly govern this.

Starting point is 00:40:00 That's why the DAOs and all the questions around this, the decentralized governance is extremely important direction. And let's figure out these together, because if we're not going to do this, crypto is going to be worthless. And there will be absolutely no value in crypto. Well, I just have to ask because now shielded Zcash can be swapped on near intent. So is there a way to have the same philosophy for these kinds of privacy coins on your platform? Or at that point, do you just say, well, this is just not possible to do? Well, shielded Zcash, there are ways how to determine whether there is a connection in between the tokens that are connected with the hack and which are not.

Starting point is 00:40:45 These are called the metadata analysis. It depends on the amounts, timeings, and any additional things. So some things can be recovered. I cannot say that this is like 100% traceable things. But indeed, shielded ZK style protocols are going to be more complicated. That's why I do believe that what the regulators are going to do about these protocols, my expectation, that over time through these protocols, they're going to attract illicit actors. and the regulators will not be in the position to kind of look inside of this.

Starting point is 00:41:23 And they're going to try to choke these protocols on the boundaries, on the entrances and exits. That's exactly the thing that happened with Monera. Monera is tradable and only on a handful of exchanges. No big exchanges trade in Manara. There will be more and more problems. So I think it all depends on how active we are with protection of these state-level privacy solutions. And I do believe that actually near intense is one of the biggest contributors towards Zcash not becoming the place for criminals too. Because in terms of the decentralized trading, we're the biggest venue there.

Starting point is 00:42:07 And since Shield is working, this 50 million of BitCat hack is not going into Zcash. is why the amount of white funds in Zcash stays high. And this is the line that we are holding. I'm sorry. Coming back. That's the line that we're holding that this is the defense shield. In here andenses shield is the shield for Zcash too, right? Okay, okay, yeah.

Starting point is 00:42:44 But I mean, it mainly works because the funds from the BitCat hack were on public blockchains. But I guess you were saying before. Yeah, unfortunately, there was a portion that was hacked from BitGat straight on Zcash. And these funds are remaining there. And they're shielded. So in the pool of the shielded Zcash, there is some amount of hacked like liquidity. You only can increase this number.

Starting point is 00:43:13 And the question is, when to draw the line again? Like with Monero, we do know that the volume of trades of. Manero from the black markets is multiple times bigger than the market cap of Monaro. If through your privacy system, there are 10- You mean of C-cash? Then the market cap of Monarch. So through Monaro, the amount of illicit activities that were happening in, the volume, is several times bigger than the market cap of macro.

Starting point is 00:43:44 So, like, bad things happened with, like, if you were going to take one coin, it is probably in the mean three to ten times traded in between illicit actors. Okay, it seems like we are taking into account of all of the action with Manara that is happening is that we are at the point when the regulators are feeling that this is not okay. And like, there's like high chance that a lot of people inside of this system are illicit actors. That's not even close with ZC. then hopefully cash is going to grow much faster and then there will be enough protections on the boundaries in order to make sure that the cash stays clean because if it would not be clean

Starting point is 00:44:33 if it will be highly penetrated into the illicit activities there will be choking like they will be choking operations and the governments are going to go to central as exchanges say to delisted and all of the same things are going to happen with Zcash similar to Montero. Okay. This is so interesting, this whole conversation. We went way over time because you just were seeing so many very insightful things about a lot of discussions that are going on in Crypto Twitter right now. Alex, it has been such a pleasure. Thank you so much for coming on Unchained. It's my pleasure, Laura. Hopefully we would be able to continue. Yes, for sure. We will have you back. All right, everyone, thanks for joining us.

Starting point is 00:45:19 Thanks for listening, and I hope you all have a great weekend. We'll see you next week. Bye now. Nothing you hear on Unchained is investment advice. This show is for informational and entertainment purposes only, and my guest and I may hold assets discussed on the show. For war disclosures, visit Unchained Crypto.com.

Unchained - How NEAR Intents Identified a Suspect and Got Its Stolen Funds Back

There aren't comments yet for this episode. Click on any sentence in the transcript to leave a comment.