Unchained - The Chopping Block: Is Canton a Real Blockchain? Ethereum’s Cypherpunk Dilemma, AI Security Chaos

Episode Date: April 3, 2026

The Chopping Block crew and Wintermute’s Evgeny Gaevoy debate whether Canton is truly permissionless, if Ethereum Foundation should double down on cypherpunk ideals or embrace institutions, and how AI-driven attacks are forcing everyone in crypto and open source to rethink security models. Welcome to The Chopping Block — where crypto insiders Haseeb Qureshi, Tom Schmidt, Tarun Chitra, and Robert Leshner chop it up about the latest in crypto. This week we’ve got Evgeny Gaevoy, Founder of Wintermute, known for sharp takes and sharper trades. First up, the group unpacks the Twitter war over enterprise chain Canton—does it deserve to be called “permissionless”, or is it just TradFi with extra steps? Cue the Solana–Ethereum truce, and a rare moment where every old-school degenerate finds a common enemy. Evgeny makes a strong case for why, despite years of jokes at the Ethereum Foundation’s expense, he thinks they’re finally ahead of the curve by doubling down on cypherpunk roots—even if it makes ETH a little more Linux and a little less Nasdaq. But does decentralization matter if stablecoins and institutions now control the fork-choice? Haseeb and Evgeny spar over whether Ethereum’s “world computer” vision means inviting in the corporate crowd or keeping the punk sanctuary alive. The mood shifts as the hosts dig into crypto’s unfolding security meltdown: AI-written hacks, NPM supply chain fiascos, and what that means for the future of open source in crypto. Plus, a fresh new hack (RIP Drift), and predictions on how defensive tech (or lack thereof) will shape the next cycle. Barstool banter, spicy takes, and zero investment advice as always—let’s get into it. Listen to the episode on Apple Podcasts, Spotify, Pods, Fountain, Podcast Addict, Pocket Casts, Amazon Music, or on your favorite podcast platform. Show highlights 🔹 The Chopping Block crew and Evgeny Gaevoy debate whether Canton is a permissionless blockchain or just TradFi LARPing as crypto   🔹 Does Ethereum need to double down on cypherpunk “sanctuary” values—or let BlackRock and Circle join the party?   🔹 Haseeb dismantles the idea that all “tokenized RWAs” on “permissioned” blockchains are equivalent to Ethereum   🔹 Solana and Ethereum align—briefly!—with both camps skeptical of enterprise “default no” blockchains   🔹 Circle and Tether’s growing influence: can fork-choice governance still exist if stables dictate the canonical chain?   🔹 Linux, the open internet, and how crypto’s utopian dreams get co-opted by institutions   🔹 Drift’s $270M hack highlights the AI-enabled acceleration of exploits and the mounting risks for open-source software   🔹 AI in security: From North Korean supply chain attacks to open source’s existential crisis   🔹 Is the future of crypto code closed or open? Zero knowledge proofs vs. code visibility in the LLM era   🔹 Are we headed for a world where only org-backed, audit-heavy open source survives? Hosts ⭐️Haseeb Qureshi, Managing Partner at Dragonfly ⭐️Tarun Chitra, Managing Partner at Robot Ventures ⭐️Tom Schmidt, General Partner at Dragonfly  Guest ⭐️ Evgeny Gaevoy, Founder and CEO at Wintermute Disclosures Learn more about your ad choices. Visit megaphone.fm/adchoices

I guess my most contrarian view on this is Ethereum Foundation for the first time in its life is being ahead of a curve currently because it basically reads the room and it understands, okay, all those people who weren't the cypherpunk values in the past, they have nowhere to turn anymore. Not a dividend. It's a tale of two fun. Now, your losses are on someone else's balance. Generally speaking, air drops are kind of pointless anyways. I'm into trading firms who are very involved. Dalek.Eat is the ultimate

top. DFI protocols are part of the antidote to this problem. Hello, everybody. Welcome to the shopping block. Every couple weeks

the four of us get together and give the industry insider perspective on the crypto topics of the day. So quick control. I'm just got Tom,

the DFI, and Master of Memes. Hello, everyone. Next we've got Tarun, the Gigabrain, and Grand Puba at Conlet. You.

And joining us again, we've got a Vigni, a high-frequency hustler and head honcho at Wintermute. Hello. And I am a sieb, the head hype man

at Dragonfly. We're at least invested in crypto, but I want to caveat that nothing we say here is investment advice, legal advice, or even life advice. Please see chopping block. That's Y, Z, for more disclosures. So there's been an increasing debate that's continued on since we had our previous show where we talked about the EF about this kind of, you know, core crypto, cypherpunk values versus the new normal of what is increasingly focused on adoption, enterprises, and, you know, the sort of

quote-to-un-up version of crypto. And a lot of this has really fixated on this debate waging between ZK Sync and Canton. So we're, first caveat that we're investors in ZK. Sync, they wrote a long thread, basically targeting some of the claims that the Canton team has been making. Those of you don't know what Canton is, Canton is, they've had another name before, I think before they were Canton. But basically, they're an enterprise-focused blockchain that is not, They're primarily focusing on banks and financial institutions, and they allow you to deploy these somewhat private blockchains that they have, I'm going to butcher some of this, but basically they're primarily focused on institutions. If you want to become a validator on Canton, so they have this one big Canton chain. And to become a validator, you submit a business proposal to existing validators and you need a two-thirds vote. They have individual Canton instances, I guess, that are kind of permissioned enterprise databases. I don't actually, I might be butchering this.

Does anyone correct me know a lot more detail about Canton? No. None of us are Canton-execis. Well, the only thing I will say is the company that sort of later developed Canton has been around probably much longer than Ethereum, digital asset or whatever. That's like 2013. That's right. That's right.

So they've been in the space for a long time targeting enterprise adoption. And Canton is clearly onboarded a lot of enterprises and financial institutions. But there's now a lot of debate. about does Canton even count as a permissionless blockchain? So Canton has claimed that they are a permissionless blockchain. I think the understanding is that they're not permissionless in the sense that you would normally think of in that anybody can validate the chain, anybody can become a validator for the chain, and in some cases, not even everybody can use the chain. So they're, and of course, like the issuers of all the assets, they have complete control.

There's no sense in which like, like USC, anybody can hold USC. That's not true for a Canton issued asset or assets that are issued on Canton by default. And so there's been a lot of back and forth from a lot of crypto-oGs like Mertz, like L.E. Ben Sasson from Starknet, claiming that these things are not, they're not decentralized, they're not verifiable, they're not publicly verifiable, and therefore they don't really qualify as blockchains. You know, Mertz kind of making the same rough argument. And other people saying like, hey, well, this is really about pragmatism. This is a different mechanism and or a different modality of blockchains that are really going to fit more for financial institutions that don't want to change the core ways in which

they operate. And that's how they're going to be brought on to the blockchain revolution, as opposed to maybe some of the more radical changes that you have to make in order to launch a product on Ethereum or on Solana. Now, in Guinea, you have been a very vocal critic of where you feel like the industry has gone wrong. And maybe Canton is even in embodiment of that counter-revolution. And your claim is that, no, the core cyphorpunk values of crypto and of the original Ethereum white paper are the core value proposition of crypto. And why don't you elaborate and how you view this whole Canton drama that's been taking

place over the last couple weeks? Yeah, no, it's a lot to unpack. So I think starting with Canton, I think what Canton ultimately, this is, I think what Canton ultimately it disrupts from my perspective is like not Solano Ethereum. It basically disrupts a bunch of intermediaries in TreadFi. That's what they're aiming to effectively disrupt. And also things like important disclosure that we need to know about Canton's. It was incubated, built like whatever we call it, by DRW, one of the largest prop trade firms in TreadFI.

And I do think DRW still owns very significant amount of tokens. from Canton still to this day and so yeah in terms of decentralization in terms of ownership it's definitely very concentrated in the moment does it work better for chat file yeah i think so like for existing trade five people like it's basically just yeah it's probably more efficient than existing like whatever settlement rails t plus one or whatever that people transact stocks by prime brokers like it's it's more efficient but the same time basically what like the point don't makes and he's been pretty active recently on this like with like how mbv is horrible how everything is horrible like on salana and ethereum and it's been actually

amazing to see syrium and salana finally finding a common enemy for once actually never seen this before thanks it's it's quite interesting from that perspective but yeah his point is like miv is just yeah try to find institutions never going to function with mbv and to me it's a bit strange because okay, like the way, like the transactions that are currently happening on Kenton, at least from my understanding, and I might be wrong about this, but it's basically almost like peer-to-peer, like two, yeah, two counterparties agree on things, and they're basically transacting or transferring something on Canton and sat in Samsung and Canton,

and nobody can basically see it. And those kinds of transactions are really possible on the Syrian or Solana. You can just use like RFQ platforms, like nobody can use, can really front on you, like if you already pre-greed a transaction off-chain and then just signed it, okay, it's already possible. Like the other saying is, yeah, you can actually make it a lot more private, is my understanding on Canton, which is a benefit. But it's also like, yeah, it's definitely not true that everything should go via any route

on the blockchains that we know and love. So, yeah, that I don't really get. My understanding of Canton is that the state is not publicly visible, right? So basically the validators know the state, but you cannot query an RPC node and see, here's the total supply of this asset, or here's the holders of this asset, or this person moved this much from here to there. You can't see any of that on Canton. The validators can see it, but nobody else can see it.

This is, and Canton has gotten this weird campaign of trying to malign ZK proofs or ZK generally as being like buggy and or just not reliable. and something that institutions are not going to want to trust as a way of getting this kind of effective privacy. And so their claim is that, well, no, you really need a Canton-like architecture for this, which, you know, they're... I think the only thing is they got, like, a memo

that, like, nobody knows Canton. And to be honest, like, I knew about Canton for, like, probably two and a half years now, at least two years. But, yeah, nobody in Crypta knew about Canton, like, up until, like, maybe six months ago. So maybe they got a memo and decided, like, we just need to be more of these born Twitter.

so people know about us as well. They sponsored like a coffee station at ECC. They did launch a token, so I feel like that, before that they didn't really have a token. So I feel like that's sort of the... That helps people learn about you.

That's definitely true. And it's like a top 50 token now, but it's surprisingly thinly traded for how... The token is done very, very well, but it also has very little circulating supply, it doesn't have great price discovery. So it's kind of a weird asset,

and it's owned a lot by DRW and also by a lot of the private investors who are financial institutions because you have to buy a bunch of Canton to stake it to become a validator. It's all quite odd. Tom, what's your take on the Canton story? Also my understanding about validators, like, is that you need other validators to approve it before it become validator or something like this? Yes, but you also need stake. Correct.

You also need stake. You also need stake. It's funny. I feel like it's almost like inspired by like the CME, which is probably what Don is familiar with. Right. Right. You can buy a C. You can borrow some of somebody's seat.

And it's like, okay, I'm going to apply those same principles to a blockchain instead of a blockchain being like, no, there are no intermediaries. You don't have to buy a seat. It's not limited. And so he's like trying to like reverse apply these like principles that he's familiar with to like the design of the system. Look, I do think people are kind of talking past each other a little bit. Like yes, Ethereum at its core is permissionless. But a lot of things that touch the real world are obviously. obviously not permissionless. If you're trading tokenized securities on chains,

those are obviously not permissionless. UstC has a blacklist and they use it, or Tether uses it more aggressively, but it is, it is using that way. And so the question is like, where does sort of the gating come in? Is it on the chain layer? Is it on the asset layer? Is it a white list or is it a blacklist or is it something else? Like those feel kind of like what people are slicing up. And so I like, it's, it's, I have a hard time saying that like, you know, a, I don't know, tokenized piece of stock on Ethereum that is limited to like a I see white list is like more permissionless than something on on canton like they're just you sort of inverted you know the principles but the sort of end result is still the same I mean I didn't

know that no no no I don't buy this I don't buy this I don't buy this so like the the difference is a very big difference which is default yes first default though right canton is default I'm talking about I'm talking about it I'm talking about is yeah this asset that I'm describing is a default though it's a white list and that's exactly right right what we're talking about yeah so but like the the the Delta is that like I can't even see it. I don't have access to it. I can't get access to it. That's what I was about to say. That's what I was about to say. It was that okay. The thing that I don't. Yeah, maybe. And so I think that's the that's the point I'm trying to get at, which wow, getting shushed to see. I think the comp would be like all right. Tom,

you're moderating the rest of the show. Yeah, right. You can take a break. Go get some water. Okay. All right. I, uh, I, I come up a little bit to like, you know, business source license. Really pisses off a lot of open source people. But it still accomplishes one of the goals. of open source, which is like auditability, even if it doesn't accomplish some of the other goals. And Kendall doesn't even feel like it does that. Like I can forgive something like, you know, provenance, which is like figures blockchain that they do for like Heelock issuance because, hey, at least you can go see what's happening on chain.

And it's sort of this like like looking at it through a piece of glass, but you can't actually touch it. This to your point. And it's not even like clever privacy. It's sort of like, you know, privacy through obscurity, which I think we've seen has almost always going to get broken or degrade at some point. It also just feels to me like, you know, I don't totally understand the mechanics here. Ifgeny, maybe you understand the better than I do of what role Canton, what roles Canton is playing in this story.

From my perspective, it's really just a ledger, right? Like if you're, if you're issuing some bonds or some repo or whatever it is that you're doing on Canton, like, you have to have some internal accounting of what's going on on Canton. And your internal accounting, you could say, like, okay, well, we're going to match whatever Canton says. Or more likely, Canton's going to match whatever we say about, you know, what's the state of play between us and our counterparty or whatever it is. And the ability to affect a transaction on a weekend or, you know, past market close or whatever is really just like your willingness to do that. Like, there's nothing stopping you from saying like, well, our Canton instance doesn't allow

transfers after, you know, 6 p.m. on Fridays. And so if you're deciding, like, yeah, we're also going to allow settlement on weekends, that's a decision that you, made and you could have had your own internal ledger that was doing that before. And so like that said, I don't totally understand what is the restriction from a financial institution marking its own books or its own internal ledger on a weekend. But these kinds of things feel to me always a little bit magical where it's like, okay, there's some internal willingness from these organizations or financial institutions to start settling in hours or at times or with counterparties with whom they would not otherwise be settling. But it's kind of like, well, you have to build your back end

to connect up to whatever Canton is representing because obviously Canton, there's no bare assets on Canton, right? It's not like, okay, well, Canton says this, therefore I now own this. So I don't know. Can you help disentangle this for me or am I just confused here?

I mean, starting with bare assets, like that part I actually don't know. Like I don't know like how legally it works with Canton. Like is everything just being broadcasted there and actually like it's settled somewhere else or is it actually like legally? settled there and that actually like if somebody goes to court they can say okay i have this on canton so it's true like i don't know how it actually works on the legal side of things which is probably the

more interesting aspect of it which nobody really talks about as for weekends etc yeah like okay you can basically say that canton is a glorified bit database like if you're a hater but ultimately yeah like blockchains are better than databases because of that because they can run like without anyone supporting them without anyone i don't know sitting there on the weekends and like moving one saying into another clicking buttons to approve so from that perspective it's better i guess and whatever cm is operating on but that's pretty much it like it doesn't have any i guess it doesn't have like any other important aspects of blockchains that we appreciate from like especially from our I would build it.

Yeah. So I suppose at the end of the day, if you already know the set of counterparties with whom you want to interact, then Canton is a sufficient solution, right? Because, you know, if you're Goldman and you already know who all your clients are

and you can get them all on your Canton instance or on Canton Maynet or whatever it's called, great, right? Like that, you're kind of in a closed loop anyway. You didn't really need the openness that a public blockchain would demand. The story for public blockchains has always been that, like,

actually there's more counterparties than you know of, that the world is a big place. The market is bigger than you can imagine. And actually that the blockchain itself expands the market in some important and meaningful way, right? Like the people who are using stable coins are all people that we didn't know they would be using stable coins. They were as kind of surprise who are the people who are using stable coins. There's no business that would have been able to source all these customers.

Even at institutional scale, right, even there's these very, very large organizations that are holding stable coins, Circle would never have been able to find these customers if it had not been for the fact that the blockchain itself is open and permissionless and, you know, available for anybody to just spin up a thing and say, great, I'm going to go buy some USDC. And I think this is in large part also true for even closed assets or KYC assets, right? Even if you have a tokenized security, anybody can go in KYC to, you know, they just use some, you know, whatever identity provider.

And like, obviously there are some countries that are disallowed. But if you're anybody that can pass any of the allowed KICs, you can get access to it, right? And obviously, most people have an identity and have a, you know, most people are not criminal masterminds that would not be allowed to own a security. So I think the story here is one of blockchains are not just about, like the public blockchains, the story is not really that, oh, it's like a great database in a way for us to like agree on state. it's actually really easy for people who want to work together to agree on state. The thing about it is the fact that it's open and makes you available to users and counterparties

that you would never have otherwise been able to meet. And that's kind of what the internet story is as well, right? Is that like anybody can come to your website, even if they would never have come to your shorefront? You know, I don't know. I feel like that's a story that we don't tell very often, but to me, that feels like the essence of what makes blockchain is different. Yeah. It's two aspects, right?

Like, one is this, like, yeah, you just open it for everyone. And I don't think that's what Canton is about. And the second was, it's about efficiency. Like, okay, you can sell way more books over the Internet and people working at your store. So I think Canton is much more about this efficiency bit. That basically, okay, we're just going to disintermediate, CME and custodians and whatever, everyone.

Right, right. Yeah. I think a little bit, like, I don't know if you watch that show, the rehearsal, with Nathan Fielder, But in the second season, they do this thing with pilots where he gets the pilots to have some point of view, but they don't feel comfortable sharing, but then he gets them to role play and be like,

well, you're actually the type of pilot that enjoys sharing their feelings. And then they open up and they talk about their feelings. And they do things that they could have always done, obviously, but just whenever I do. And I feel like this is very similar thing where it's like, you really want to offer 24-7 trading, but I don't know, I don't know how, I don't even transfer.

It's like, no, now you are a blockchain. Oh, great. Okay, now I can just go do it. and it's like this mind trick kind of thing. Wow. I've never thought of it that way, but that might be it. It's like you're role playing as a blockchain and all of a sudden you just feel this renewed openness and energy.

Yeah, you could have done the whole time. I mean, arguably that was the Libra pitch also, right? That's true. Yeah. It's true. We should ask Canton customers if they feel empowered and open all of a sudden now that they're using Canton. Well, I do think the one thing that is a little confusing. me about Canton is like all these like TVL numbers you can't verify but you're just kind of accepting

I don't know like I don't I'm kind of a little confused when I go to RWA. XYZ now because I'm like okay well how do I check that this number is true and then it's like I can't really like that's sort of the stuff where I'm like you've been spoiled by this idea that you can check things yeah but that's my point right it's like how how like what is the legality of it like is it like if it's settled on Canton, has the same power, has been settled on like traditional custodian. Yeah, like, does it work the same way? And it's probably different from asset to asset, right? Like, you'd have to go and look at the actual underlying contract.

Like, nobody who's transacting on Canton doesn't have a contract with their counterparty, I would bet. So it is just, it's like not the same thing. Is it like what is primary, right? Like, is primary what happens on Canton? And then they just like maybe update. the database somewhere else or is it like, I mean, I'm not, I'm definitely not saying it's this what it is, but like, okay, we do like, I don't know, this Tara Chai saying, for example,

is it like this? Well, yeah. Wait, what, fraud? Like, what do you say? What is it like what? No, they just, they just copy paste the transactions on the blockchain and, but it doesn't mean names. Right. Right. Right. Yeah. I mean, another question to me is like, how do you do, I know there are a lot of like Canton deckses that people are supposedly building, but like, how do you? Yeah. Okay, I'm only saying this.

And so I'm no Canton expert. I would say I'm a Canton Dunce mainly. But I've just seen all these people shilling these market maps of like, here's the decks is on Canton. Here's the whatever. And like, okay, I'm just going to assume someone to Zoom. How does that work? Like I don't really understand how any of these things are. Like, there's just so many things.

Yeah, our Canton IQ now is so low. I feel like we should stop talking about it. Maybe get somebody from Canton on the show to clarify. Yeah, I think I... You might get a legal notice, you know? Yeah. Yeah. Yeah.

I think the main thing is more like, it's impressive to convince people to put their assets in a new vehicle, right? Like that, to Afghanistan's point on the legal side, like, I don't know how they got the $200 billion or more. But it's sort of just... like a little hard for me to understand like what the point of it is. Like it's just it's it's really hard for me to be like okay like yes I can borrow against all these assets I tokenize. Can you do that? Like it's it's not clear at all to me like what the set of functionality is. Yes,

they're these smart contracts. But no, you can't verify them between zones and so like it's it's, it just feels like it reminds me of enterprise blockchain circuit 2014 more than it reminds me of like L2s are like all of kind of because it is enterprise blockchain. It is self-consciously enterprise blockchain. They don't pretend to not be. But like it's like the enterprise blockchain pitch hasn't changed, even though the market has changed.

And so then they're like using terminology that was like Dexes that has a particular meaning to people used to public blockchains that like is not, I don't understand how that works here. At least that again, this is just my, you know, I'm like, I haven't really spent a ton of time on Canton.

So I can't tell you. I mean, I've heard a lot of stories about, oh, you know, this financial institution is now doing a ton of reverse repo on Canton. This one is doing, you know, they're moving assets from one entity to another entity much faster than they would if they were using, you know, Swift. So I've heard a lot of these stories, right? And my assumption is that they're not lying to me. They are actually doing this, right? They lived experience, the people on those teams is that this stuff is really happening since we integrate a Canton. But at the same time, like, you know, I made this analogy earlier, it's a little bit like when I hear, you know, somebody say that like, oh, you know, I use Devin and allowed me to ship my AI code way faster.

So, like, it's real. Like Devin really does solve all these problems. And it's like, yes, Devin does, but like so does everything. Like, there are many other ways that you could get AI coding. Like, what you're describing is AI coding. You know, you could, there's a lot of other ways to do AI coding. And so I kind of feel like it's a little bit what I hear with Canton is that like, wow, when you decide to use a system that allows 24-7 settlement, you get 24-7 settlement. It's

amazing. Blockchain is so incredible and Canton is the secret to all my problems. And it's kind of like, yeah, I'm sure there are other systems that are not blockchain-based that I'll also give you that. Anyway, okay, before we embarrass ourselves any further, the beginning, I want to come back to the conversation that we've been having on the show. So we went through a lot of back and forth about the ways in which crypto has maybe lost this way. And especially about the Ethereum Foundation, there was a big debate that has continued to rage about the EF mandate, which is this document where it was kind of reinforcing the EF vibes

and crops and all the values that Ethereum holds dear. And there's now been this weird thing about Melaides as well. So the whole thing is kind of getting a little bit out of hand. But I wanted to specifically bring you on to talk about so far, I think you're probably the number one person that we've had on the show who can mount a really full-throat defense of this idea that Ethereum should stay the course, that crypto is losing its way, and that in fact, it is really important for us to turn away from this institutional diaspora and instead focus on the core cyphepunk values. I want to, especially given that you're a market maker and you make your money, trading every day. I want you to give me your best defense of this position. Right. Yeah, I mean, I do it in the time, like the least likely candidate to be defended in the Syrian Foundation, especially given that, yeah, I made a lot of fun of them in the previous years as like soyboys and

such. I mean, last couple of years especially, like we went through this, I don't know, the whole financial nihilism stage. And now it's like, we got, I don't know, the most friendly SEC, the FTC regime. We got like blockchain are working, institutions are adopting, like everything is supposed to be great. But I've been in this space for

pretty much nine years now. And it's probably the worst vibe I've ever felt. Like even 2018, I'm not sure if it was worse than now. Because I think people just don't have anything to believe in anymore ultimately. Like people

came here for various reasons and like, again, some people don't believe in it because the prices don't go up. Yeah, so that sucks, I guess. But if they're building in a space, what are you building for exactly? Because, okay, like, everything is just really, really moving full steam ahead to trade for institutions, basically just taking crypto and adjusting it.

I don't know, Kenton style or whatever, tempo style. Like just like taking all those blockchains, enterprise and auto and basically just improving their own process and ignoring pretty much. all cypherpunky that was about that. And where effectively Ethereum, like I guess my most contrarian view on this is Ethereum Foundation for the first time in its life is being ahead of the curve currently. Because it basically reads the room and it understands, okay, all those people who weren't the cypherpunk values in the past, they have nowhere to turn anymore.

There is nobody else to, like, there is no blockchain to go. like, okay, you can go to Solana and Solana, what they achieved, like, post-FTX laps. It's amazing. Like, they, well, they stop stopping. Like, they're working, like, they throughput-wise, it's amazing, like, what they did with Mincoins. But you basically, okay, like, it's a competition between Solana and Canton, I guess, like, who is going to be the next NASDAQ. And I would say Canton might win this one, simply because it's just more threat-fi focused and oriented. But, There is nothing cypherpunkey per se about Salano or about like most other blockchain.

Even Bitcoin, if you look at Bitcoin, like it's just being co-opted by TreadFi in such a big way. With Sailor, with, I don't know, strategic Bitcoin Reserve is pretty much everything. Right. Is it really a cypherpunk asset? Not really. Like people are just like, okay, Bitcoin needs to go up and solve whatever quantum bullshit. But nobody cares about like Bitcoin, fulfilling its original Satoshi, whatever. vision, whatever it was. And the Syrian foundation is just saying, okay, if you built on us,

if you built within the Syrium, you're actually staying true to what we are here, what we came here to do initially, which is basically not become a part of existing threat fire system, but actually becomes something parallel to existing threat fire system, becomes this sanctuary, basically, like sanctuary attack. And yeah, nobody else is remotely close to saying that it's basically their vision and direction. And that's from like pure diversification standpoint, I think it's very important that we have at least one blockchain that it's just like, yes, this is our way.

And we'll just do something contrary to everyone else. I think that's kind of true in a sense of like there's not a home for these kinds of people right now. I think my concern is like that home is probably. be just like much more niche and smaller than like what I think people have built Ethereum up to be. And so that's kind of where this disconnect comes from. Like I think that's okay. Like you can be, you know, really into like a home brew scene and like amateur ham radio and all that. But like that's a very different kind of goal than we're going to take all the

world's financial activities and and put them on chain. And like I think that's what people kind of really, at least, you know, let's say the past, I don't know, six, seven years have really gotten into Ethereum for versus, you know, when it first started, maybe it was kind of a different ethos and a different, different group of people. So I think, I feel like that, that is like ultimately, I mean, as we were kind of discussing with Canton, that feels like kind of like the fight right now. But I think it's also, like, for the longest time, like, ever since I was, I was in the space, like, actually, I never believed that you can put the whole world on blockchain. Like, it sounds silly, but like, I, I,

don't, I still to this day, do not believe that Savannah can become Nasdaq. Like, I don't think block, it's just physics. Like, I don't think blockchains can ever be through, can never have enough throughput compared to, well, private databases, basically. They can just like function a lot more efficiently and also function a lot more privately. Like, even like, even Kenton probably like cannot achieve the like speed sense throughput required from that.

So I don't think Ethereum or any blockchain for that matter was ever in a race for everything to be on it. Okay, maybe things can settle in it, sure. Like, okay, you can like put a lot of assets and tokenize a lot of assets. Yes. But I do think Ethereum is still in the race for it. And actually, they're still like definitely TVL-L-wise with RWAs. They're still like way ahead of Fibranos. Well, except for Kanto maybe.

I don't know. Yeah. So I think the question is not, is it important for Ethereum to remain decentralized? or is it's important for Ethereum to maintain its values. I think everybody would agree with that statement in and of itself. The question is, what does Ethereum need more of? The question is always at the margin. Does Ethereum need more of, you know,

the sort of the priests and the monks chanting in the corner, like kind of keeping the flame alive of, oh, decentralization is our one true God. Or is what Ethereum needs more of is Canton. You know, like, I'm kind of like, yeah, Ethereum kind of needs a little more Canton in it. And Canton needs a little more Ethereum in it. You know what I mean?

that sort of feels like the right answer as opposed to the other way around, which is like Canton should be more Canton and Ethereum should be more Ethereum. I think like Ethereum, today, the reality is that, look, if Ethereum is going to appeal more to the cypherpunks, first of all, I don't know the problem with Ethereum is that it doesn't appeal enough to cypherpunks, right? The cyphorpunks already love Ethereum. Where else are there to go? There's no other game in town if you're a cypherpunk.

Second, the cypherpunks, as crypto grows, the cyberpunks become a smaller and smaller part of the population. and or of the real true user base of these crypto products. Now, I think what Vitalik's goal is when he says that he wants Ethereum to be a sanctuary technology is not the same thing as saying that Ethereum is for cypherpugs. What he's saying specifically is that Ethereum is meant to be for the people who have nothing else. Like literally they have no other option. We want Ethereum to be the thing that people with no other option can always use.

And I think, look, that's an admirable goal. But I think the place where I disagree with it is that Ethereum already has that property. You know, like there are not people, like, who are you safeguarding Ethereum against that you think, oh, Ethereum is at real risk of losing its ability to be used by political dissidents or something like this. Like, this is not a problem.

I have an answer to this. Like, if you, like, I don't remember we had this discussion during the merge, which are like, okay, what's going to be the canonical, like new canonical Assyrium? Like, the old one, the proof of. stake one or the new one. The proof of work one or proof of stake one. And like the answer that a lot of people gave at the time, which I think was true at the time as well, is it's going to be the chain that circle and doesn't choose to be the canonical chain

because that's where most of the stable coins are. And it's still to a degree pretty pretty true today. So like the more you, the more in stratifying institutions you have settling stuff on your chain, the more you basically pretty much hostage to them. and the least the less you become this sanctuary chain in a way. So hold on, hold on. So I wrote the article originally that described this, you know, the ability for circle slash tether to fork

and kind of control the fork choice in effect, or the ability to do governance by fork. But I don't think that's the same thing as what you are arguing here, okay? The claim that I made in that in that article is that it is impossible for people to do governance by forking and basically say, look, I'm going to create a minority fork of Ethereum, go in a different direction. And if more people agree with me,

then my fork is going to beat the original fork, right? That is no longer possible in a world where you have Circle and Tether and all these other people, because on one fork, the RWA just won't exist and everything will fall apart. Like, all the state will get destroyed, basically on this other for this other force. It can be like, okay,

Ethereum Foundation wants to do another random name upgrade and circle it as a second. No, we don't like it. Right. Right, in principle that's true. Right, in principle, that's true. Of course. And that's also true for users, and it's true for anybody with an influential application,

is that they could say, well, we're going to brick this app on, like, you know, think lighter, right? Like, lighter also has one canonical representation of its state. And they could say, okay, well, we're going to brick lighter on the fork, and we're not going to maintain its state, and therefore, you know, all the lighter deposits are going to be. Like, every single issuer has this choice in a fork, right? The claim that I'm making now is that, while that is true,

Forking is no longer a viable way to enforce governance. But that doesn't mean that Circle is unilaterally making these decisions. Unilaterally is, like, it'd be very surprising if that were true. And Circle just happened to choose whatever the EF and the user consensus is choosing, right? Like, wow, what incredible coincidence? No, it's the industry aligned, right? Is that Circle, in normal times, does want to follow what the EF wants to do. And when we did the merge, Circle followed the merge, right?

When there's upgrades, Circle follows all the upgrades. So we shouldn't be confused about what that means. It doesn't literally mean that Circle is deciding the roadmap of Ethereum. It does mean that if Circle does decide that their interests diverge from Ethereum in a subtle way, that it's going to be a catastrophe. And also that forking is not going to be a good answer to that problem. It's that everybody has to come into a room and negotiate. That's what has to happen in a world where, yes, Circle and Tether do have enormous influence

on what ends up becoming the future of Ethereum. But they're not the only people in the room. Yeah, but I mean, that's same. Like, the more I move towards this like TRETFI expansion, like the more of those people we have who are ultimately, yeah, ultimate stakeholders and decision makers. Like the more it's good. I think it's good.

Yeah. Yeah. I mean, is it good? But I mean, is it good because it's like, you just replicate the Trot-Fi model in the end. Okay, like you have corporations decided on every side. That's it. I think the vision of Ethereum is to be the world computer.

the world has a lot of people in it. And all those people become stakeholders when they have a stake in the world computer. So I don't think the goal of Ethereum is that Ethereum will always be governed by a bunch of crazy people in an IRC server, right? That is not the goal of Ethereum. The goal of Ethereum is to be the world computer

and to have this new, different way of owning, governing, showing, accounting for the assets in the world and creating permissionless smart contracts around them. If the rest of the world is signing up for that, then great, they all get a seat at the table. I think that is the correct way to parse the vision of Ethereum. It is not that cypherpunks rule the world. That is not the vision of Ethereum. If the vision of Ethereum is that cypherpunks rule the world, it's almost like, okay, well, the vision of Linux is that Linus Torval's rules the world. And no, that's not the vision for

Linux. The vision of Linux is that we all have Linux. It's that we all have free software that you can use and edit and modify however you want. That is the thing that's going to go and modify however you want. That is the thing. What they're going for as well. Like, they're not saying, okay, we are not going to permit BlackRock to put, like, Biddle on Ethereum. Like, they can do it if they want to. Same as Linux.

Like, they are literally, like, Linux is such a great example. Like, I know, Carlson Lani would hate it. But, like, it's, Linux is a perfect analog for me for this. He's out of the industry now. We can use all the analogies we want. No, but, like, literally, it's even price action-wise, like, okay, it's, yeah, it's, to me that's the biggest actually like Viet saying about like

I do support the current's direction for Ecerium Foundation but I think like short and midterm price-wise is going to be very bad because it's a very long shot for it if they're really successful and if they become this Linux I think I do think Ecerium will be like very valued asset but yeah if they're not successful and if everyone gives there is a canter and like other blockchains just like take over

most of the economic, yeah, economic activity, yeah, like they'll just fail and that will be it. But, yeah, Linux is a great, great analog to this. Turin, let's bring you in here. What's your take on this back and forth here? Yeah, I mean, look, I think, you know, stable coins, to your point, are the best example of something where there was a new market for users who would have not interacted with this market whatsoever. And in that sense, Ethereum is like kind of trying to, you know, to help attract new users. However, in the sanctuary case, right, of like anyone who gets rejected from everywhere else can still come here, right? Like the Groucho and Marx type of chain. That's sort of what

I've used sanctuary is. I never want to be a member of a club that would admit me type of thing. Take the contrapers of that. On the other hand, I think if you just start having a lot of assets that are not really on chain, they're kind of like half on chain, half off chain, reconciliation, hard, you have to think about multiple things, then it's like, it is a different, just completely different security mall. Stable coins are sort of lucky in that you do have to think about that reconciliation, but not at high enough liquidity. You don't really, unless you're going to get blacklisted, right? But like, when we start moving on the exotic part of the spectrum on tokenized assets, then you just have so many more control issues than you do at stable coins, right? Like, each

layer of governance or shareholder right type of behavior, like adds all this extra structure that the blockchain can't really enforce. And so there's kind of this slippery slope argument of like if all the assets are just that, then like, why don't we just like move the control and legal stuff off chain, right? Maybe that's what I don't know if that's what canton does, but that's sort of what I, in my head. That's kind of how I view it. Again, I could be very wrong. You know, Canton people can come yell at me, but that at least that's my interpretation of it. But in a real blockchain, you should have a lot more, sorry, now, see, then that probably will trigger them too.

But in like a public open blockchain, there's sort of some notion of guarantees that you really have enforceable on chain. And I just think like it's not clear to me that with a non-public chain, you could ever have the growth of stable coins again, like if we rewound history. because you kind of needed people to feel a lot of these guarantees without needing to know a lot of the hidden structure. And basically, I sort of think there's sort of this implied contract that the smart contract is telling you everything. Right? Or like, that's how defy started, right?

It was like smart contract. And like, obviously we were just moving down the spectrum of like the smart contract tells you less and less and less and less. And like at what point is it still a blockchain? Like, that's, I guess, the question that we're deciding. And I don't know where that threshold is. It seems like many people have many different opinions on that. I mean, there is a parallel to this in the open Internet, right?

Which is like the Internet is getting less and less open over time. You know, you go to, if you're not logged into X, you can't see the posts anymore. Like web scraping and, you know, cloud flare sitting in the middle of things and captures and all this stuff have made the Internet less and less of what we initially contemplated it was going to be. and maybe there's some inevitability to these things is that actually the world doesn't want to be open or that the economic models

or the financial models just kind of push in this direction. There's a plausibility to that, but then I do still think that the core value proposition of the internet is the fact that it's open and permissionless, right? Is that like anybody can go to New York Times.com and even if they can't read the articles,

they can go and buy a subscription and start reading the articles. And I think the same thing is true for blockchains. Now we've yet to see it. Maybe we need to get someone from Canton on the show to help explain what they're seeing in a little more detail. But look, there's a story today that I think also cuts in favor of the Canton story. So just to transition here, right now it's kind of hot off the press.

So we don't have a lot of detail yet. It's still fog of war. But it looks like Drift has been hacked for upwards of $270 million. It's one of the largest hacks in defy history. Drift is a perp decks on Solana. and it looks like a bunch of JLP, over 150 million of JLP, which is Jupiter LP positions in the Jupiter vault,

about 50 million of USTC, and then a smattering of other assets were sitting in Jupiter, or sorry, not Jupiter in Drift, that got exploited. So we don't have any details yet. We don't know exactly what the mechanism was, but it's been a very bad week for cybersecurity,

generally. Just yesterday, there was a story about this NPM package called Axios, which is a very commonly used HDP library in JS. That got compromised through some kind of seemingly North Korea planted remote access Trojan. I think this was called Maraxus Trojan. So something basically a supply chain attack in the NPM maintainers somewhere down the pipeline. And that got pushed out to like huge portion of the internet was potentially compromised with this thing. This package has 100 million weekly downloads and 175,000 dependent packages that pull up axios as a dependency. So there's a, at the same time,

we saw just yesterday, there was Mercor got hacked, there was a Claude code, a leak, just a lot of stuff happening all around the same time. And people are starting to think that like, hey, this may accelerate over the next couple of years, right? But now that we've seen, there was a story about Anthropic that took their newest model and has some kind of, cybersecurity tool that they're basically not releasing publicly. They're only allowing selective access to effectively white hats or open source maintainers to get access to this tool because they believe it might be too powerful to have it just openly available in people's hands. It seems like the capabilities of AI is making these kinds of attacks more frequent,

easier to do, and just more concentrated. So curious what you guys are thinking about this moment and how you're positioning yourselves for it. Maybe you can start. Positioning is really hard. Like it's, yeah, positioning I am not going to comment on. But like it's, I mean, it's not only like this whole sign, it's not even in a favor of private blockchains. It's almost like in the favor of like private intranets almost like,

I don't know, maybe they're moving towards the world where internet will be just like this wild space where stuff happens, but most of the stuff will actually be happening inside corporations and where stuff cannot be hacked, for example. Like, maybe that's where we are heading towards. Because the supply chain attacks is just like the worst possible. Because you, I mean, these packages, you download them, you implicitly trust them. Like, you trust that, okay, like, if you get a new version of whatever Windows, like, it's not going to be infected with some trojan virus.

So it's, yeah, it's pretty scary and we'll definitely see more of it. And yeah, like, yeah, one way to protect against it is just to make everything very, very locked, I guess. Hmm. It does feel like so many of the assumptions behind security are being violated now. Like the ability for half of the Internet's JavaScript libraries to get compromised by one dude getting popped in his NPM account, that feels not sustainable. you know, like this is just not a good architecture for a security system. And so much of open source has depended on. So if you remember, there was a while back, there was this discovery of this guy or

a guy, whatever, account that had been contributing to open source for many years. And then at one point, it'd like try to push something, it was like the Linux kernel or something or some other library to like try to push some kind of backdoor vulnerability. I think it was like an open SSH thing, right? because someone noticed that SSA was taking longer, yeah. Yeah. So, like, this, so much of open source depends on the assumption that, like,

developers who are going to do nice things are scarce. And because of that, they can mostly be trusted to do the right thing. And therefore, this model that anybody can contribute to anything, and we all are kind of kumbaya working together, now that you can basically do, like, underhanded C++ or underhanded solidity contributions, like, I don't know if you guys know

this thing called the underhanded C contest. So it's this very, very long-running competition that happens every year, where basically people try to create the most innocuous-looking sea program that actually does something totally dastardly and malicious to screw you up. And these are extremely difficult to detect. If you are really trying to put a subtle back door into some code, if you're ingenious enough, you can do it. Now, every LLM can do underhanded sea competition stuff, right? It used to be like only crazy humans we're doing that. It was extremely esoteric. But there's so many years of trading data of underhanded C competitions that are just out there on GitHub that every model can do it now.

And if you just have one open source person who's either one fabricated, it's just an LM doing this for many years, or two, you basically have, you pop one guy who's been contributing to open source for many years, and then you contribute something that's some underhanded C type construct that allows you to take over some repo or take over anybody who uses a repo, then open source just stops working. Like the trust model of open source stops working. So one thing I will say is there was like kind of this time in the 1990s and then like in the 2000, like early 20, late 2000s or early 2010s where I feel like there

was a sort of baby version of this. Like obviously this is like an exponentially worse version of the thing. But like in the late 90s, I feel like the constant thing that would happen is you constantly hear about worms and like self-replicating attacks, right? Like, I guess the most famous one was like the Windows 98 D-com attack in 1998, which was like basically a kind of very egregious memory overflow where you could just read everything in memory like instantly. And the interesting thing was like those things were spreading like crazy. Like every Fortune 500 company had a compromise machine. There was like statistics like that era. And then,

Then from that point onwards, right, like people started creating all these like encapsulated environments, like restrictions on what you can run, you know, tagged memory, dot, dot, dot. And then so it started getting better. And then like early mid 2000s, you know, Docker starts becoming popular and people start using containers, but then they start running like five million containers and they can't manage like which one is using which access control. And then like people would kind of exploit these microservices things to try to be like, oh, these particular ones are more vulnerable.

these ones are and I'll take advantage of the weakest link. I think we're just kind of in a much more speed run version of that, right? Those things took years before they got worse and then people started hardening, whereas this is like, I think you have like minus time, negative time. It's like that's kind of the weird. I think more about the time aspect of it than I think about the obviously the surface area is huge. I'm just trying to say like it feels like in these other versions like something bad had happened, but then we had a little time to react. Whereas, like, here you really don't, which I think that's the more, it's a bigger difference to me from a just like emergency response perspective. Yeah.

I think the point on open sources is right where we were kind of shifting from a world where you assume contributors are sort of default benevolent to maybe default malevolent. And that just changes the dynamic of how you, how code gets reviewed. I think there was even like a story that Cron stock accepting new PRs because they just got flooded with like bots. And so I feel like these are different sides of kind of the same coin. And I agree that like, hey, the current model of like, there's a small number of people who have like auth permissions. And like, yeah, obviously that that's wrong. And maybe, I mean, there's obviously been attempts at doing, you know,

decentralized source control in the past and like maybe we'll kind of see a revision or a reversion to that. I think the bigger thing I worry about more is, I know there's like a thunder talk about like an anthropic engineer talking about using, I don't know if it's this latest model or like a harness they had for Opus to basically discover a bunch of zero days in old pieces of code. So you found like a bunch of zero days have been like the Linux kernel since like for like literally like 20 years. And that's the kind of stuff that I'm more worried about because I think we can change how we manage open source to really mitigate a lot of these supply chain

attacks. The issue is like what about all the vulnerabilities that are already out there and old code that doesn't get updated. And like that's kind of the weird asymmetry that now feels very exploitable. By the way, the person who found that is not just a random anthropic engineer. Carlyne is like kind of a very famous security researcher from the last 20 years. Like, I think, like, for someone like that who, you know, I obviously wouldn't be a sceptic if he was an anthropic, but he's sort of someone who's like classical security researcher has been a security researcher for a long time. And I think it's not someone who exaggerates. So that's, that's like, you know, you should take it as a very real assessment, not like a hype. You know, there's a lot of AI stuff where it's like, obviously a little aggrand eyes.

This is this one I would not view us up. So the question then is like, okay, where is this? going. It strikes me that the polyana-ish kind of kumbaya version of open source that we've had over the last 20 years is going away. And crypto is kind of a weird middle ground position because crypto is not really, you know, these applications are open source, but they're not, it's not like anybody else uses the drift contracts, right? Like only drift use the drift contracts. So they're open source, but they're maintained by a single company. And I think that's actually really different than the open source that we're talking about. You know, Axios or the Linux kernel are really, really, really very different from the open source

nature of an individual startup that open sources their own contracts. I think that we may see that open sourcing just decreases over time in crypto, just because of the fact that there's such an asymmetry between attackers and defenders that like North Korea is willing to spend upwards of $100 million for a $300 million prize to just like throw a compute at you. But you don't have $100 million to spend on grinding on your own compute. So there is a way in which this may end up pushing against open source as the default for crypto, where, you know, look, you can still use your model to, like, look at the state and figure out what's going on there. But, you know, maybe they can issue some zero knowledge proof that shows there's no admin

key, but they're not going to decompile the code for you and show you the decompile code. Maybe it doesn't matter because actually I can decompile the code. Yeah, I was going to say the zero knowledge proof of proof of code is like now a real thing, even though we don't have time to talk about the quantum stuff. I feel like the fact that they didn't release the code. and they only release the ZKP. I think there's something there. I suspect what happens over time.

So on the crypto side, where it's basically your corporate smart contracts are open source, I think we just may see more movement away from open source. That seems to me like a pretty likely outcome at this point, given I expect over the next six months

that these attacks will accelerate. We had the balancer hack not that long ago. I mean, this was like four or five months ago, that that was the largest defy hack that we saw last year, I believe. And that was almost certainly LM-assisted, if not fully L-LM-driven. And then on the opposite side, if you think about open source in the sense of, okay, we're using Axios or we're using the Linux kernel or whatever, I think probably what happens that this is a collective action problem is that you will no longer trust packages that are maintained by Randos,

that basically these packages will move into Google, Facebook, or in some of these foundations that are basically protecting them and they may be still run by nonprofits. The code may still be open, but they are no longer accepting contributions from random people and the way in which these packages are updated or locked out. It's not just like some dude

who's maintaining this out of the goodwill of his heart and, you know, oh, he didn't have his two FAA enabled or oh, he had this thing that got popped. It's going to be that basically, if you are running like super secure software, it may still be open source, but it's being managed by an organization that you underwrite

and you underwrite the organization that's managing the software package. I suspect that's where we're going. Either that or the large companies like Google basically take it into their own responsibility to start basically red teaming slash whitehadding all of these other software packages that are widely used.

Is that basically they take it on themselves as being stewards of the internet and stewards of internet security. Because otherwise, like North Korea will just keep finding holes. Like the open source landscape is too big. that they'll just find targets one at a time. And the JavaScript supply chain in particular is so enormous.

And there's so many Achilles seals all over the place that we'll keep seeing stuff like this. It would be my guess if we don't see a big structural change in the way that open sources is architected. Does it we all agree? Yeah, that's not really. I wish I had, I wish there was something to disagree about with that. Fine, fine.

Okay. I'm running open time. I feel like I'm surprised there was not more mentioning of the fact that like everything released yesterday. day. In my mind, I'm like, 331 can kind of be for open source where like 1010 was for crypto, where it's this like big memorable date. And I was like, oh my God, like, why is everything coming out today? And it just, I feel he was not an acknowledgement of the fact there's just like deluge of, you know, these these vulnerabilities. So. Yeah. Yeah. So we'll see. I think this is a long-term

story. It's not going to happen overnight. But it does feel to me like AI, the defensive capabilities are nowhere near as fast developing or bringing up to parity as the offensive capabilities. And I just tweeted this today is that the offensive capabilities are concentrated, but the defensive capabilities are diffuse. You need a lot of people to get on the latest models and to start figuring out how to defend. And that's just hard. It's going to be way easier for North Korea to pick off people one out of time who aren't catching up as fast as the attackers are. So anyway, we're up on time. If Guinea, where are prices going? Where is winter you going to move the prices? Let us know. Give us some alpha.

drifting around. They're going to be drifting. Oh, geez. Drifting. Too soon. Too soon. You can't be doing that this early, man. Come on.

People are hurting. All right. Beginning, once again, not any help at all, but appreciate you coming on and giving us your perspective. Yeah, always happy.

Thanks, everybody. We'll be back next week. Hopefully we'll either, we'll either be talking Canton or Quantum. Quantum, quantum. A little more entertaining. I'm sorry. I just like,

I feel like I'm not as, educated at Canton and I also feel like I don't want to. I'm not sure I want to be. I'm not sure I want to be yet. You know what I mean? You're going to get the Canton Bulls in your comments. I I'm not saying I have anything against it. I I just yeah there's enough other things in the one. Canton army listening. Let's let's get the one to run. Cool. All right. That's it for this week. Thanks everybody.