Unchained - Uneasy Money: Why Ledger's Supply Chain Became a Nearly $100M Target

Episode Date: October 15, 2026

A Ledger reseller's devices shipped with a hidden LTE modem inside. Taylor Monahan lays out how it passed the genuine check and why panicking now costs more. ======================================================== Thank you to our sponsor! Put your crypto to work with Nexo: earn daily interest or borrow funds against your assets on one platform trusted by more than 10 million clients. Find out more at Nexo. Geo-restrictions, eligibility and terms apply. ======================================================== Quick favor: We’re deciding what Unchained does next; new shows, stream times, what’s worth paying for. ⁠⁠⁠Our listener survey⁠⁠⁠ takes five minutes, it’s anonymous, and I read the write-in answers myself. Everyone who takes it can enter a drawing for a free year of Unchained Premium or Bits + Bips Premium. Open through Sunday, October 18. — Laura ======================================================== Genuine Ledger devices sold through the reseller CryptoBilis shipped with an LTE chip and eSIM wired inside, intercepting seed phrases on their way to the screen. The losses are estimated at $70 million to $100 million over roughly four months. Kain Warwick, Taylor Monahan, and Austin Griffith trace how the implant passed Ledger's genuine check, why panicked users are now losing money to phishing and fake apps, and whether an iPhone or a DIY build makes a better hardware wallet. They also cover the recording device planted in OpenAI's office, the decade-old XRP infinite mint bug that earned a $250K bounty, and why Taylor finds Google's Chrome payouts and $40K compute bills the more interesting math. Then StarkNet's talk of becoming an L1 turns into a debate over whether Ethereum will need L2s at all. Kain's answer: the most Ethereum-equivalent chain is Ethereum itself. Hosts: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Kain Warwick⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ - Host of Uneasy Money and Founder of Infinex and Synthetix ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Taylor Monahan⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ - Co-host of Uneasy Money and Security Expert ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Austin Griffith⁠⁠⁠⁠ - Co-host of Uneasy Money and Builder Enablement at Ethereum Foundation Timestamps 🎬 00:00 Intro  🔐 01:32 Why a Ledger reseller became the entry point for a supply chain attack 📡 09:15 Taylor on how the CryptoBilis attack moved past fake devices and scratchers 🧯 19:01 Why Taylor says panicked Ledger owners now face the bigger risk 💸 20:17 Why Austin sees DIY hardware wallets as the future 🕵️ 30:34 How Taylor “demixed” Zcash by following the gas trail 📣 34:52 Nexo: Generate daily interest on your crypto or borrow funds against your assets at https://unchainedcrypto.com/go/nexo-podcast-yt  🎙️ 35:37 What the bug planted in OpenAI's office says about AI espionage 🛠️ 41:42 Austin's homemade Alexa, blood wallet, and AI-run electronics bench 🪙 48:04 Why a decade-old XRP infinite mint bug points to AI-assisted hunting 🧮 51:04 Is $250K enough? Taylor compares the XRP bounty to Google's Chrome payout ⛓️ 01:00:30 StarkNet wants to become an L1: why Kain thinks that's where L2s end up 🏚️ 01:11:03 How MegaETH shows why L2 ecosystems struggle to keep their apps Learn more about your ad choices. Visit megaphone.fm/adchoices

And you know what, if you're moving fast, you're trying to launder this money, about $100 million to get through, okay? Chase's Guide to Laundering Money, Part 1. Let me tell you. The gals will you up every time, kids. Hey, everyone, I'm Gain Warwick and welcome to un-ezy money because what happens on chain never stays on chain. Before we begin, here is a word from the sponsors that make this show possible. This episode is brought to you by Nexo, the premier digital assets wealth platform, Earn daily interest on your crypto or borrow funds all through one platform trusted by more than 10 million clients.

Find out more at nexo.com. Geo restrictions, eligibility, and terms apply. Not listening to Bits & Bips yet. It's our weekly crypto and macro market show with Ram Alamalia, Austin Campbell, and Chris Birkins. Search Bits and Bips and subscribe. All right. Hey, guys. We are back. I'm here with my co-host, Taylor Monaghan's, security expert, and Austin Griffith, Builder Enablement at the Ethereum Foundation. Hey, guys. It's been a fun week. I just got back from a token in Singapore, which was good.

It felt like early bullish vibes. Like, bad things were still happening, but, like, people were partying. So it's that little, like, dip as we come out of the bottom. Hopefully, we'll see. All right, our first story this week is Ledger. Man, ledger. Like, ledger, ledger, ledger. I get that, look, I've been a Traiser Maxi for a long time.

And so, you know, I feel kind of contractually obligated to break these guys over the coals. But like you have to feel for them, right? Like, it's a little bit like running a defy protocol. You know, everything that you do is scrutinized. You have people that are attacking you constantly. every possible vector or, you know, mistake that you make is, like, massively exploited. And some of those mistakes are unforced errors, for sure, right? Like, you know.

100%. Like, their company, right? They keep... And they're French. They're so fucking French. Like, I don't know. Like, I mean, you know. So, so I think, like, the, the, yeah, so the background is.

is like Ledger has probably been one of the most problematic attacked entities in the space, right? And part of that is because, you know, your job is a hardware wallet, right, is to secure a lot of money. Like, that's kind of the purpose, right? You don't need a hardware wallet for your $50 shitter slinging account, right? You do need it if you're like the signer on the unyswap fucking multi-sig. or whatever the hell you might be up to, right? Or like the Ethereum Foundation's, you know, ETH trove, right?

Like you want that shit to be secured by hardware wallet. Ideally, you want the hardware wallet to be connected to a machine that's air-gapped. Ideally, you want to be in like a clean room with a fucking Faraday cage or whatever the hell that you're doing. And yet here we are, right? So this week's ledger debacle, I guess, was that one of the, resellers. And like, correct me if I'm wrong, but like, there was a period of time where you didn't buy hardware wallets from resellers.

Yes. You just wasn't done, right? But also, if you lived anywhere outside of basically the US or you, you couldn't buy a hardware wallet either, right? Like, where did you get your from, Jane? Like, fucking fly to the country. Yeah. You're securing millions of dollars, man.

It's like a $2,000. Okay, but Ledger has to. it's a business, bro. They have to sell their shit. And this is, I mean, it's painful. It is painful. I think one of the reasons why Ledger keeps getting, there keep being situations with Ledger,

but also with Trezor. Like none of this is, you know, is unique to just them. Partially it's because they have built a successful business that is still alive after nearly a decade. Yeah. For both Ledger and Trezor. And I have mad respect for both of them for.

And hardware is fucking hard, man. So hard. I tell people don't build a freaking software wallet. These motherfuckers out here. We're building a harder wall. And, you know, the funny thing is for me, though, as well, is like, you know, hardware is the hardest thing you can do, right? Clankers can't even really help you that much at this point, right?

Like, they can do software stuff. So, you know, the degree of difficulty of what these guys are doing is very high. And one consequence we understand deeply now, I think in this space, but in startups generally of doing hard things, is you have to find some easy things to fuck up, right? Like when you do hard things, you will inevitably focus on the things that are hard and not focus on the things that are easy, like vetting the fucking people that are selling your hard.

Imagine you spend your whole life, like, you think about all of the effort and pain and suffering that went in. And then you just like send a pile of these fucking. fucking things to some like crackhead who starts opening them up and putting fucking modems in. Right. So, okay. So story is. Oh yeah.

Yeah. Let's do the full story because it's a wild tale. This is not like we've normally seen. We've seen their mailing lists get breached, which by the way, everyone's mailing lists get breached and then emails are sent out. But we've also seen for, I think all the hardware, right, the physical letters. Yeah. So it's not just like a fishy email. it's a phishing letter, which hits different.

Yeah. And then we've also seen, historically we've seen, you have to buy them off of a sketchy shop, though, like a really like Amazon, you know, fakeledger.com or whatever. But usually there's been these ones where basically like they'll either, it's a sketchy seller, super sketchy marketplace seller situation, or it's like a return to a place that doesn't have good diligence. originally the first one I ever saw back in the day was I thought it was the most creative

shit they didn't get that many victims though but I thought it was so creative they would open up the box really carefully and they'd put a little they'd pre-initialized the device with the 24 word phrase and then they would print that 24 word phrase on a piece of paper and so if you weren't super familiar with the flow people would think about how convenient and then the second yeah the second iteration of this was they did it on this fancy card and the card was a scratcher. So you scratched off your 24 words.

They already knew about it and had painted it. I need to the scratchy stuff on there for you. You felt like you were. Yeah. You got to get them some good human psychology. Yeah. I mean, I thought that was like the most creative shit. I still think it is actually like the scratcher. Like are you

crazy? People trust scratchers. Like how would someone know what's underneath? It looks so legit. How did they know? So those were like the ones. But again, these were like, they were like one-offs. They were not mass operations. And the solution was like, don't buy it from a random person on Amazon.

Literally. Like, you know, the boxes weren't that great. Go to a conference. Like, dude, go to a conference and they will get, they will give you them for free. Yeah. Like literally just go to a conference. They'll give them to you for free. I remember when, when we, when we launched.

I bought Trasers for everyone in the team, all of our investors. And I got like 50 people into a room together. Right. And we went through the whole setup process. Yep. Like here's what you need. They're the same thing with my team. Yeah.

Like you got like and it was so funny, man, because like we had a range of people in that room as you can imagine. Right. And one guy who was my friend, the only guy, the only fucking guy forgets his password. So we put, we put like the 25th seed word on there as well. Yeah. You can add, you know, I think you can do it with ledgers, but back then you could, you could do it with tracers.

So I said like it's not sufficient that you write this down, these 24 words. You write the 24 words. You put them in a safe or something. You need one other word that every, this motherfucker forgot it like three years later. Anyway, that's a different story. So. Been there, done that. Yeah.

So, so, so major, yeah. So basically major evolution from those types of attacks to what's happening today. And the biggest, the biggest evolution, well, it's twofold. So one, it seems like they have gained access to a distribution channel, a legitimate one or a person. Businessman, it's fucking, like the chaining of vectors here is genius. insane. So that's evolution number one. And that's probably why this we're talking by the way, we're talking about somewhere between like 70 million and $100 million stolen for what's basically like a three, four month operation. All of the ledgers were seeing all the reports that we have

seem to be bought in June, July, August, September, October, very beginning of October. Right. So we're talking about four months, I guess, five months maybe, nearly $100 million stolen. So yeah, distribution, like they basically got these malicious devices onto a distribution channel. They got into the distribution channel into the supply chain, probably something with this Cryptobillus company, which we'll dive into in a minute. Then the other evolution, though, which is like, this is what's wild to me because we've seen the letters, we've seen the scratchers, right? We've seen fake devices. And what this means is like we've seen where Trezor has these as well. the whole the fucking device is fake

it's a glorified USB plug it in your computer and then your computer is like load up your D drive the ledger D drive and then you click it and it's like a little fake ledger live or like Trezler application

and then the application is literally just a malicious app right it's just malware it's just like it's almost the same as fishing it's just the delivery mechanism is like this fancy hardware wallet yeah but they also like they feel cheap

like the devices feel cheap they feel different Again, you have to buy it off a sketchy seller. Like, it's, yeah. And then again, these are not real devices. So it's a USB. You plug it in and it looks like a USB. And it has a fake app.

And then you, whatever. You have malware on your computer or it seals your seat or whatever. Okay, these ones, first off, it's in a legit sort of like in the distribution channel, that's legit. It's not Ledger literally, but it's these authorized resellers who, Cryptobilis has been working with Ledger and other people in the space. since like 2021. They go to conferences.

They're known like it's wild. And then the other thing is that it's a genuine ledger that actually fucking works. And inside the hardware. By the way, I wish I had my ledger in front of me so I could like show you how tiny these things are. Like inside the little tiny. It's crazy.

They managed to put an LTE chip, a little CPU. an e-sim. So that's like where your data plan is, right? It used to be, you had like a SIM card. Yeah. Now it's like, it's this little E-Sim chip. And they've connected that to the legitimate ledger board.

And basically what happens is that they're intercepting the data as it's shown as it goes from the secure ledger element stuff to the screen. they're sort of intercepting it and sending it to their own little CPU module and then that CPU basically will, we assume, sends the seed phrase to their C2

server somewhere via these LTE data plans. You did a fair day cage. You said Faraday cage earlier. This is the only way to save it would be other than taking it apart and looking would be to be in a Faraday cage. Or like underground, April in the graph, there's no signal or whatever, right?

If you remember when, And I think when Zcash was doing their, they had to do like a big trusted setup or whatever to kick off or whatever, right? Do you remember the guys were like out in the middle of the perfect desert? With like laptops and and like smashing that once they had it done. Yeah. Yes. Okay. So this is why because they're like, okay, someone you could have a man in the middle in my network. So like got rid of the network. The any network could be right.

Like. Yeah. Yeah. So go out in the middle of the desert where there's no connection. activity, but also like smash your Wi-Fi card out. Like, you know, they did all of these different things. This is like, it's this level of like paranoia. Crazy, man. For this level of attack, right?

They should have encrypted the screen. They should have given you some like crypted glosses that like decrypted or something to send them to a different package. My dad has done hardware his whole life. So I like grew up in factories and stuff. He does a lot more in the U.S. than in China, but I'm familiar with China supply chains, Mexico supply chains. I ask him, and I ask him of his friends, and they're like, why would you, the screen? You want the screen, like the display encrypted? Like, what is that?

I was like, okay, so. It should not, you have, there are encrypted channels, and there's a lot of different encrypted components and stuff, but the screen is deliberately made to show the end user information. There's no point. Clankers wouldn't tear. Just fucking point it at a clanker and let it look at the screen. Just show random flips. By the way, my dad and his friends.

It'll figure it out. Like a weird cipher and like just hold, you're going to hold it up in front of the clanker for like eight hours. And it eventually like decrypts the cipher and goes, oh, I know what it is. Yeah. My dad has to me his friends have like a lot of respect for me. over the years, although they've, like, lost it a few times as well, obviously.

But like, generally they have, but this question was the one where they're like, oh, she's lost it. He's retired. Where's the screen encryption even coming from? Like, is this something you guys are just saying? I'm kind of joking. Okay. Let's be sure.

I was like, I'm not following the screen. So this is the thing is that the way that they get the ledger. So ledger and Treasler have a thing called a genuine truck, meaning that if the CPU is tampered with, if the secure element is. tampered with if any of these components are tampered with if the firmware sampered with right when you plug the device into your computer it's going to fail the genuine check anything is like you know yeah and by the way the way that the previous like malicious ledger devices got around this was that they weren't even a ledger they were just a USB that's how they got around the genuine track was like

we're not even in the same world right yeah okay so this is completely different like it's just there's nothing involved in this. Yeah. Like, if your ledger live app doesn't tell you that like your random USB stick is a genuine. Like, it's just not relevant at all, right? Yeah. And so, but now what's happening is that there, it is a genuine ledger. It's a real ledger. And it passes the genuine test or the genuine check because it doesn't actually tamper with anything. So it doesn't, it doesn't replace the CPU. It doesn't fuck with the CPU. It doesn't try to replace the firmware like it just completely bypassed

all that and my understanding this might be like oversimplified but my understanding is that because data has to go from one place to the other they have to show you the fucking words on a screen like at some point they need to show you a thing

it makes that you generate the seeds securely yeah but in order to have the backup you have to yeah and so basically what it's doing is the words right like they company to crypt. That was like I was sort of semi-joking, right? But like if you encrypt that part, like I don't even know. Like, what are you giving the person like the complexity just gets crazy, right?

Like at some point you wouldn't have a, you wouldn't have to get rid of the, you basically couldn't have a backup or like your backup would have to be like some, I don't know, something, right? Yeah. Like, yeah. genuinely like the whole thing can't be secured like there has to be some vector at some point where you have plain text that you go to the user or the user has to be able to read the plain text to know what the seat is like yeah there there there will always be some door if a user is involved so that they can physically write down the seed phrase right like that's right and have that backup otherwise you you're going to end up relying on servers and yes like you like you can just to be clear right like you shouldn't do this but you absolutely can not write the C phrase down

oh yeah people do this all the time yeah you can just like put the pin in and not care right now if you did that and the ledger and you were like I don't believe that you don't have an LTE modem inside of you ledger do not show me if you put it in that mode, like, don't show me the seed phrase mode. Like, I'm going to protect this device with my life or whatever, right? Then, yeah, that it would be fine. Then you wouldn't need to show the seed phrase and this would not be an attack. But do you know how much, I'll say this, the amount of

loss from people not correctly backing up their seed phrases or not backing them up at all is like probably in the billions of dollars at this point. It's like Justin Drake being, move all your crypto now. Like, like, like, worst thing. will happen if people stop moving their crypto around randomly. By the way, I do want to just say that if you are, if you have a ledger, like, please don't freak out. Don't panic. I really want to emphasize this because all week we've been doing the ledger incident,

like the airport, we're working with Ledger, obviously. Trezler's actually been really helpful as well. Like their guys are so good. Like, you know, everyone has to compete and like, hate each other or whatever. but like treasler and ledger are you know they're they're all just like fantastic people who have survived this long in our super fucking serious about this stuff yeah i will say that in the past couple days though the reports that we've been dealing with are not actually ledger drains due to rogue lt modems in the devices it's people who panicked and then did something

terrifically stupid and so we're seeing yeah like you guys like the google ads if you try to install ledger live there's like a chance you'll close you'll like a bad ad. There's also just like fake applications. There's also fishing sites that are trying to scare you. There's emails trying to scare you. And then there's also people that will call you on the phone and try to scare you. And all of these are going to create loss in addition to like the original thing just from people panicking.

So don't panic. There's so much asymmetric loss here. Like we went back to talking about a hardware wallet costing you $100. but then you store $20 million on it. Like you're saying travel somewhere and get the thing from a certain place. You understand the business. They need to run a business. They need to have distribution worldwide.

They need to have the hardware cost as little as possible so they can make a margin on top of it. But in the long run, it's like, why are we paying $100 for a device that we store $20 million? Like, isn't that worth maybe like $5,000? And then like if the device is worth $5,000, what can we, do here with a five grand margin in terms of like yeah you know fly to the person's house and set it up for them like literally like that would be a better solution right like but then if someone shows up in ledger gear do i know literally there's so many there's yeah i think that just the fact that you're making a hardware wallet makes you an asymmetric target also so i'm i'm going to push back on the

people don't want to fuck around hardware because i think that with AI we're going to have a a blooming, a whole renaissance of like people doing hardware, people running Linux, things that Normies didn't do before. You can now just ask AI about and you can give AI observability into your hardware and it'll be like, oh, that wire is wrong or whatever. Yeah. So I do think that we will have a resurgence of hardware and DIY Linux. And I think that DIY hardware wallets are the next step here where you're just ordering parts off of Amazon that. Like an iPhone don't have ledger names like the best. The best. Harder wallet is an iPhone.

Or like a Chromebook. We're getting pretty close. People talk to your phone, but like we're getting pretty dang close to having that be like an actual really secure thing that you can actually use, right? Because this is the other thing that people forget is like the reason that we recommend harder a robot so much is that it narrows the points of like compromise, the points of attack. It really does narrow them a lot. Like you can get malware on your computer and you're going to be basically safe with a hardware

wallet, right? That's like, that just cuts out a huge amount of loss. But you can also, like, use it. You can use your hardware wallet. If you really want, like, the most secure thing, just go back to paper, but realize that you're not going to be. You can't do transactions, right? You're not going to be sending anything with paper. Yeah. I mean, you know, the thing about an iPhone, right, like, talking about, like, spend $5,000, right? Like, the newest, cheapest iPhone's, like $700 or a box, right? So it's like three times the cheapest ledger or whatever, right? There is zero chance today, right, that if you buy an iPhone, it's going to be compromised in the supply chain because it's just security through obscurity. You're like one person out of a billion buying an iPhone.

You go into an Apple store, like there's no way that someone has set up a fake Apple store that they bought on eBay and, you know, like Tim Apple just allowed them, you know. Now, if you go into a random Apple reseller and then, you know, that Apple reseller has become known for selling Apple devices as hardware. Well, then obviously, the asymmetry flips, right? But if you go into like your town's Apple store, I don't know, where the fuck you live, right? But like, you go, there's an Apple store near you. There just is. It's like an official app store and you buy a fucking hardware device, a phone. And you go and tell your clanker, hey, help me to set this up as a hardware wallet. It can do that for you. And it will, and it

be more secure. It might not be like quite as ergonomic because you might not have old software, but like it probably is. It probably will be fine, right? You just never connected to the internet. You only connect it by USB or whatever. It's just a bunch of different things you can do. I mean, the proximate calls of all of this stuff is crypto is too valuable. It's exactly. That's what I was going to say like Bitcoin should not be worth fucking $80,000. If it wasn't for that, if Bitcoin was worth $8, none of this would be a problem. That's the fundamental issue here is that crypto's just simply gotten too valuable.

Yeah. And if you spend all this energy and resources and time to do this attack on a thing where literally 100% of the user base, right? 100% of the people that buy a ledger have serious money to protect. Right? Yeah. Suddenly the supply chain becomes worthwhile. Whereas if you look at the Apple supply chain,

okay the vast majority of people buying iPhones don't have anything that you want quite the opposite right however if there's a

custom iPhone that's made for like government officials you're going to see that be targeted for espionage instantly right and so it's a whole

it's a whole game I don't know I still by the way I'm still using my ledgers I'm still using my treasers I'm going to continue to do so I'm going to be way more careful

about where I buy them from, I'm going to be way more aware. I'm going to keep my strategy for the longest time because I live this life of like terror all the time is never have all of my eggs in one basket. So I have ledger. You see like the multi-sig also. Like having a multi-sig where the ledger or the treasor is just one signer and can be replaced if you lose it or it leaks. Yeah. At this point like I just.

You got a most safe, right? Yeah. If this was a signer on like a one of two even, right? And the other signer, sorry, a two of three in this case, right? Because the secret is compromised, right? A two of three, like the other signer could be a hot wallet and it would be fine. Yep. You would actually have been fine.

And Martin said it the other day, if you Google knows it safe, the top thing is someone trying to fish. I was about to say, just be careful when you're doing your safe. Because they're just, I mean, the attackers are just crazy. But yeah, my basic strategy at this point, and it has been for years, is that there's not a single thing that will completely let me out. Like, I have so many ledgers. I have so many treasers. They're in different places. I still have paper. Like, because I just, like, you can't live. You can't use crypto. You can't live if, if, like, you know. Like, I wouldn't do anything there. Just hide it a bunker. Like, literally, if all myself wasn't. in one thing. So that's my best advice.

We had on two weeks ago on Slop Computer told me about basically Samir Shemir's secret sharing but with your 24 word where you take the 24 word and you split it into three and then you put it into sealed bags and you even store that in three different places and you have to have two out of three. We even have four cups. It's like it's fucking wild. Yeah. Yeah. And I do. I have

seeds that are split and stuff. Although again it's like the risk goes back and forth because in my what is it I've been answering support tickets for a decade now right I would say that there's probably still more loss from people who got like super paranoid and created these big elaborate schemes to store their money especially long-term storage like you know he was saying earlier that the 25th word will fuck people up on the fifth word dude even writing down the 24 words words. Some people don't write them down. They write them down in the wrong order. Sure and tweet. The picture on the device is a big one. So the ledger cards, I talked to Ledger about this forever ago, but the ledger cards historically were in two columns and they were sort of numbered, but it turns out that humans naturally will either go one in their brains. One, two, three, four, five, six, or it'll be one, two, three, four, five, six down the left column, and then 12, 13, 14, 14,

down, right? Yeah. But then when they read the words back in a year or two, they might switch it, flip-flop it, or they might, like, listen to the numbers or whatever. So, yeah, we have, like, all these things where people have basically lost their crypto

because of one of these things, and the more elaborate the scheme, the more likely, like, that you are to actually just lose your money. But plus side is that you have, like, in those cases, you have almost an infinite amount of time to like figure it out. So like there's scripts and GPUs that like we have so many scripts to try to like

root force these things. Yeah, throw 24 words in and like try every combination or whatever. Yeah. But it's kind of like the dumpster guy, right? Like where his hard drive, he lost, he accidentally threw away the hard drive. Yeah. Sometimes not going to lie. Sometimes the best thing for your mental health insanity is to have someone like steal your money.

Sometimes it's worse to have it locked up. up. Because then you know it's like there. It could be recovered. It's just like one. And it just sort of besters you. And like every year you come back. And every time the price of Bitcoin goes up, you go back.

And then you pay another guy to run his, the new improved GPU scripts. And you don't ever get to like release it. Like I did some big thefts after like FTX. It's been four years now. And those people have basically moved on. They've rebuilt their life. They have their jobs. Like it sucks.

Don't get me wrong. But like. because you have to find, yeah, you're like forced to find the closure. I still have people from like 2016, 2017 who locked up like 10,000 Eath. And every couple of years they come back and. It's just rough. I mean, yeah, it's like the party.

Can I try this? Can I do this? Can I? Yeah, it's just hanging there. It's just sitting there. Like it's right there. You can see it. It's like in the thing, right?

Like, yeah. Yeah. So anyways, my best advice for this. situation in every situation multiple baskets multiple eggs and multiple baskets that's it but trying to have to overcomplicate like try to find a simplistic way

to have a multi-sig like setup or a Shamir secret shared like setup where you custody your funds from a few different accounts that are very clear and easy to understand just just scratch off the little scratchy off it's already made for you exactly

oh more adds to we have one other little side story on this story, which is everyone was like, oh, my God, they trace through Zcash. It's not private anymore. Guys, I did not trace through Zcash. I think some people actually did manage to trace through. Like they managed to like do a property mix. They cross their inputs and their outputs, meaning that they have money over here that's going into tornado and also into Zcash.

And then they have money out over here that's coming out of tornado and also out of see cash, right? And so ideally when you're laundering money goes in one end and it comes out the other and you force everyone to properly follow you through. However, when you have like thousands of addresses, you have gas, your funding, right? You get confused easily. Okay. The wallets are not that great. Okay. And the amounts need to be different too, right? Like if you have an exact amount in and then an exact amount out, it's easier to follow that too. And you know what? If you're moving fast, you're trying to launder this frick of money, about $100 million to get through, okay? guide to laundering money.

Let me tell you. The gas will fuck you up every time, kids. Stop. Don't stop fucking with USDT. Because what ends up happening, right, is they come out in USDT because that's what it has the most liquidity. Right. But then they're very rapidly trying to get out of USDA because they can get

frozen. Okay. And so then they send gas from over here to over here. And that is how I demix the Zcash, because you just follow this little trail over here. Everyone else is like brute forcing it through the pools or whatever. Like no, no. So anyways, the cash still sufficiently private,

unless you're laundering $100 million incredibly rapidly and stupid. And by the way, all the XMR people were like, Minero is so much more private use it. It's exactly the same. Okay? We trace it in the exact same ways. You can brute force the ins and out. If you fuck up your obsec and you fund the gas,

floor cross like come out of the pool like yeah people are gonna like and that's by way that's why can this been doing for yeah and that's just on chain for yeah yeah so don't I don't know people there's so much drama around this I just want to like everyone needs to calm down it's things are still private especially for I mean be careful right if you want to separate your ins and your outs make sure that you're doing so but it's a lot easier how do you build your own Faraday Kay just like some aluminum foil around the windows.

It's a big screen basically, a big metal screen. Yeah. Make sure your phone is dead. Coinbase used to have tents. That's cool. Courtney's this is cold storage. Yeah, yeah.

Okay, so they would go to a random location. This is like my favorite coinvary story ever. They would go to random location somewhere around the city of San Francisco that like only a few people noticed. And there's already tents up everywhere. Okay. And then they would sit in a fair day cage where the power was like source from somewhere that like nobody was expecting it to be sourced from because

you can't have people side channel attacking the power supply while you generate your cold storage keys. Yeah. And then they'd sit in the Faraday cage and they would generate stuff and they'd have like printers that were all like brand new printers and the printers would be like destroyed. Like there was so many things that they did. It was completely bonkers. It's my favorite thing in the world. But it was all yeah, because like if you're going to be if you're going to be generating cold keys for long-term storage that have millions, billions of dollars in them. Like, the number one thing is, like,

don't be in the building. That's called Coinbase. Like, the attack surface is too big, right? So, like, narrow it down, get some new laptops, go to a random location, be in a cage, make sure nobody can tap the Wi-Fi or the power supply.

Nobody can tap the printers beforehand, even, right? Like... They don't have, like, cameras pointed at you. You're in a tent. You're in a very intense. Yeah. Yeah.

All right. Let's go to add. Then we'll come back and talk about more espionage, open AI. Like, Jesus, man. This is amazing. All right. We'll be back up to a quick ad break. What if your crypto could do more than just sit in your wallet?

Nexo is a digital assets wealth platform where you can generate daily interest on your crypto or borrow funds against your assets. Today, Nexo serves more than 10 million. clients. Find out more at nexo.com. If you like this show, there's another one from our network you should be listening to. Bits and Bips is our weekly market show. On Mondays, Ram Alawalia, Austin Campbell, and Chris Perkins chat about where crypto and macro collide. It's sharp, it's fast, and it has its own channel. Search Bits, plus sign Bips, and subscribe.

All right. So our next story is also about people who have too many values. legal tokens and people wanted to steal them. So this week, Open AI's office, they revealed, I don't know if they called the guy this week or whatever. I think, I think they may have arrested him this week. So Open AI's office was bugged and the guy put a recording device, felt like somewhat homemade it seemed like that he'd cooked up. He also asked Claude to help him build it, which is amazing. Hardware Renaissance. I'm telling you. Yeah, I was going to say Austin called this in the previous segment. People are going to be doing their own hardware. Yeah. Okay, pro tip. This is like going to be the episode where Taylor teaches you ought to be a criminal. No tip.

If we're going to have the AI help you turn into a hardware nerd, don't then use that information to hack the AI company. Yeah. Come on, guys. What do you do it? Yeah. Yeah. This is, so, so basically this guy, and again, this is, there's some interesting things about this. And, you know, I'm so paranoid and cynical and suspicious, right? That like, I'm now like trying to work out as this guy playing 40 chess, right? So one of the things that everyone kept talking about is that he wrapped the device in toilet paper. Right. And no one would wrap the device in toilet paper. right and no one would wrap the device in toilet paper that's bad tradecraft right like why would you wrap it doesn't it's not going to do anything it's not going to hide the fact that the paper is white by the way like the whole thing is so weird but and again this is i'm not trying to teach you how to do espionage either but there's something to be said for if you were a nation state actor looking retorting And we've seen this crypto many times, right? But looking retarded and like you've just had a psychotic break and like the agent has pulled you to go in and like bug the place, you're going to get a much, much, you're not going to get executed, right?

Whereas if they believe that you work for like the Saudi crown prince and you are like a fucking guy that's been hired and planted there to exfiltrate the weights of these models for like the Saudis, yeah, like you're probably pretty fucked, right? So this guy was the only Saudi employee apparently of Open AI. And he like used his wife's account. But again, like, these are things where you're like, even like a relatively smart person who could get hired at Open AI should be too smart for this. Like there's things where it's like, this is, it feels too dumb. Like this feels too too. I have so many questions. I don't know. I have so many questions. How many people, how many employees does Open AI have like 10,000 or something?

Like, I mean thousands for sure. Thousands, right? Okay, so like, let's say it's 5,000. So like the dumbest person out of 5,000, like some random people will get through the filters, right? Like, there's going to be some repards at Open AI. Like, they're not, they can't all be smart, right? And so, you know, maybe this is like the dumbest guy that got through who also is trying to do espionage. I don't know.

There's some stuff that seems a bit off on this, honestly. I mean, when I first read the story or saw the headlines and had dug in, to it. My first thought was like, wait, is this espionage or is this like someone had a crush on someone else? He went to the, he went to the executive. Yeah. And that's a room, right? Planted this thing behind the TV, you know, he looked to see which rooms the executives use. Like he was looking for the boardroom where they're going to be talking about whatever, right? The most important things. Yeah, the most important thing, planning, like, which fucking math problems they were going to break next week, like,

what, I don't know, right? Maybe we should ask this guy if they broke crypto. He might know. So, so, so, so yeah, like, I mean, but again, you have to imagine that for every fumbling, bumbling guy that is doing this shit, there's got to be 10 guys that have crazy fucking actual tradecraft. Oh, yeah. No, the funniest me, my saw was.

one where it was the NSA, Mazzad, and the CCP all spying and the one Saudi guy with this toilet paper implant and they're just all watching him like, what the fool? Oh, man. So, you know, again, this is like, if you have valuable stuff in the world, people will want to seal it, right? And, you know, it's hard to imagine a more valuable intellectual property cache than inside of open AI and anthropology. right like maybe at the CIA but even that's debatable right now right like that the CIA has

cooler shit than these guys don't know if they do yeah I'd me either like genuinely like what like they've got some shit for sure but like these guys have things also the government has contracts and is using these models right so so you've got it's totally and run around it right like if you can get into the yeah you get a backdoor and then topic so so I mean I mean, you know, the interesting thing about this is like, A, you can build your own stuff, right? You can make your own hardware, as you were saying. Yeah, yeah. It's like $20 on Amazon.

So, yeah. Have you been, have you been, like, are you building your own? Are you building your own? Like, what, like, what are you building? What are you building? How are you doing it? Like, what's the, yeah, give us the TLDR on, on like, whatever the fuck. I build all sorts of stuff, man.

I mean, like, yes, I have spy devices in my house. It's, I replaced my Alexa with my own Alexa. So there's a thing that's always listening and taking all of our conversations. Wow. Yeah, yeah. So dumb thing number one. Dumb thing number two, I made like a blood wallet that you have to like believe the file sign. So that took like a ton of hardware.

And it took a lot. This was the worst. It's like the psychosis loop of iterating with AI while it's like just one more fix, bro. If we do one more picks, it's going to work. and I'm like over here like bleeding for this wallet. I'm making my own hardware wallets. Like I think DIY hardware is a thing. I'm going to be showing people at devcom to do that.

I love it, dude. Just give the setup Linux, set up SSH so your clanker can talk to your Linux. It can control your whole operating system. It's scary, but I let it rip. And then that thing has observability into my whole electronics bench and it can see things and I can plug things in. So it can run the chips. It can see where I have the wiring and it can tell me how to,

you know, do it better. Now, if I was doing something nefarious, of course, they would track that back to the fourth thing or whatever. That's why you run a GV300 cluster with GLM 5.3 local. If you're really criminal act number three on the show. You're better with your own local GPU. We're going to like genuinely like if you have. Do not send it to the cloud guys. They'll catch you. If you put a cluster of, you know, I think it's about I've got a group where they're a bunch of rich guys that are cryptoGs that are hacking on this stuff. One guy, I think bought four GB 300s. It was like $2.5 million or something like that as a cluster. But he's getting like 150 tokens a second using GLM. Local. 5.3. Like the brain and everything is right there next to you.

It's right there. It's in his house. I'm so jealous. Yeah. So you know, I have a bunch of victims from the last decade who can't access their wallets. If this guy wants the throes some ram at this shit, dude like i'm not kidding every time i see this every time i hear about this i'm like wow there's power right there right there and you know it's funny because i went down this path right like i bought a mac studio in like before they even canceled like earlier this year right

and and you know it's it's the gen it's the m3 ultra whatever with 512 gigs of ram but the frontier models are just like that much better than it didn't make sense and you have to run a quantized version of most of them because it can't fully run like a lot of them like 800 gigs or even now like 1.6 terabytes of RAM. So yeah, so it's just, I don't know, it didn't feel positive EVV to go and buy these things. But I do think we are getting to the point now with like GLM, you know, GLM 5.4 comes out, let's say, right? And it's like Fable 5.1 class. At that point, like I'm probably happy. I'm probably happy. I'm

probably fine with that guy living in my house being as smart as they are. I don't know if it's worth like, you know, two million dollars or whatever the fuck it would cost to be able to run that locally, but like maybe it's probably not far off, right? Um, you know, uh, I mean, dude, I've just been falling back to the whatever, not chat TPC and not anthropic because I just, I'm just so annoyed with them nerfing me every second. Yeah. Like it's, and it's even stuff that's like, like I'm asking about ledger, I'm asking about supply chains, but it knows that I'm investigating the ledger hack.

So it just nerves me. But I'm not even asking about, like, I'm not even trying to be a hacker. I don't know. Rolling back models. I was, we were in Rocky Mountain National Park and I had Opus 5.5.5 getting me a ticket. They go on sale at a certain time. I'm like, give me this ticket. It like wailed through the.

Captcha a bunch of other things that it needed to do, but it wouldn't sign up for an account on the website for me. Yeah. So I had this dropped to four. I had to drop to four five. Four five signed up for the account. I handed it back to five five five. I mean,

that's what I mean. What are we doing this? Like what are we doing here? No, I look over and I'm like, yeah. But that's the thing is like every time I have to like look over and be like, okay, so now you're stuck because you've decided this is a cyber or whatever. But then I, yeah, I like. force it to fall back but then even sometimes you just get a different nerve message with the cyber stuff

it's so annoying so i've just been like well if i'm going to be dealing with these shitty models anyways might as well deal with one that's not like like i just go into it and i expect it you know what i mean but it's so pleasant to not have your workflows constantly sort of like nerfed and i have to like switch like my brain is in eight different places already when i have to go and like address the that it's being nerf and adjust the models and stuff. Yeah, you're like, you've already spent the time prompting it and like getting it going and and then you're like, oh wait, it's not working. Yeah. I mean- Because it'll decide five minutes in that it's a cyber task. Yes. Yeah, it's crazy. That's why like

GLM 5.3 is fine. Like it's smart enough and you know, they have fast mode as well. The fast mode stuff is pretty crazy. Like, you know, you see these like kind of little indicators of what the world would be like in three months, I guess, or a month or whatever the fuck it is. But like the, there's there's two models that have like ultra fast mode like, you know, Astra 6, 400 tokens a second. Like it's so fucking fast. I did a test. I was like, I'm going to just get two agents, 5.5 and Astra to run the same thing.

Like just build a quick little test. I've got a bunch of little test projects that I'll give them. This thing did it in like three minutes. It was insane. It could be almost real time soon. Like software will be almost real time where it's building the software for you as you're navigating through it. It was faster than I could reason about what it was doing.

Like it was literally ahead of my ability to figure out what was happening. It was crazy. So, you know, like at some point you hit a thousand tokens a second and it's thinking faster than you can be prompted, right? Like it's crazy. So good times. All right. Let's go to next story.

So XRP had a infinite mint bug and in fairness. Wild. But XRP has been around forever. You can't be infinite mint bugs in 2020. It turns out the taxi cab drivers don't understand safe math. Fuck, man. So this is a decade old, right? And this is where like very obviously AI, right?

500%. Amazing. It just, like, if it's, yeah. I mean, it's, and even if you said like, it's not AI that found it, right? AI has allowed people to think about things in different ways, even if this was a human that found this, right? It's going to be AI assisted in the sense of like,

go and look at all the places where there could be vulnerabilities and help me like parse through it so that I can like identify the part of the code where this could be. There's no way that this is like a hundred percent human work because otherwise we would have found it a decade ago if it wasn't buried. But there is this new level of lendiness where things got Lindy, free AI.

Yeah. It's pre-AI, Lindy, and that means nothing, right? Balanced was probably the first instance of this. Something that had been around for years, billions of dollars out of door. Agreed. Yeah. It's wild. No, no, no, no. Like, it's just, like, how do you think about Lindy when all of your

, you know, priors have been blown up? Yep. Super intelligence, bro. Yeah. So, Tay, I'm curious your take on this because there was the, the, there was this incident, it was found. They paid a 250K bounty. Yep. So it wasn't like they were like, thanks, go fuck yourself, right?

Like they paid a 250K bounty. It's not clear necessarily that like there was any attempt to like exploit this or whatever. But basically a bunch of people, including Zach, XBT, were like, you fuck. fucking retards. You only paid $250k. You should have paid $2.5 billion. Way more. Yeah. Whatever. Right. Like if you have a bug bounty and the bug bounty is like, we'll pay you $250K. That's our max bug bounty. Right. You know, it's not clear to me. Let's say it was $2 million, right? Let's say it was $20 million. Like it's still positive VV for you to steal the money like in a vacuum. Yeah. Right? Like this is an infinite.

mint bug, there's so many vectors, you could, you know, you could mint $21 million worth of XRP and probably exploit it. No one would ever know because there's just a like so many places where you could wash that money. And it wouldn't even be noticed, right? You could probably set up a bot to print you a million dollars a week and no one would notice and you drop it into different exchanges and it's just never going to get picked up, right? So it's not clear to me that you can say 250K is not enough, but 2 million would have been. Like, how do you reason? So, so I think about this a lot.

So the first thing you remember is that crypto and crypto bug bounties are fundamentally different beasts than sort of the regular world and security and bug bounties. 250K for reference is also like up the top end of like Google's bug bounty program. And there was like a really amazing bug bounty that someone got from Google for I think a full remote code execution series in Chrome, meaning you could basically like have you could go and it's a good one. They haven't disclosed exactly how it works. But they went to town. They found an amazing vulnerability in Chrome that got full remote execution capabilities, right? And they got paid 250K.

When you look at these two things side by side, $250,000. You just fucking hack the ledger website, man. Like, it would have been way. So now, and then there's also an argument to be made that if $250K is the max payout and it's disclosed and it's been like that, then you should, as the company, you should sort of stick with that. You shouldn't randomly come up with a bigger bounty just because someone found a bigger

bug because then it's like, well, you don't actually have a budget or a bug bounty program, right? you're just, it's very arbitrary. Yeah. If critical, the most critical disclosure is 250K. That's what it's always been. That's what you do. Actually, this is, this is another question. Sorry.

So has this 250K bug bounty existed since like 1982 for XRP? I mean, it's been the same. And they just haven't updated it because that would go back to the like, we have too much money now, right? Like XRP used to be worth like, it's totally possible. It's totally possible.

Right. And, you know, I've dealt with this because I dealt with teams that have out of, sort of, let's say, out of date bug bounties, right? We're like, they were operating as a little team. And then they raised money, didn't ICO, had, you know, let's say 100 million TBL. And then they got a disclosure. But their max bug bounty payout, like, on paper was 5K or even like a mug, right? What do you do in that situation? And it's tough because, again, you don't want to, there's a problem with doing everything just like completely

arbitrarily, right? Because it goes both ways, right? If you have a max payout. Now you've got like someone who's trying to Yeah. So there's creative ways. There's creative ways to reward people without, you know, just completely going into arbitrary land.

If the situation is truly special, you can treat them special on and on. Anyways, the other thing I just want to say is that $150K is also a lot of money for all intensive purposes. It's only not a lot of money when you look at home much the chain is protecting or you look at the treasury of XRP.

But it was like Google, Google's worth fucking trillions of dollars, right? And they pay 250K, right? Now, you know, if someone had exploited that remote execution bug in Chrome and mass across the internet or whatever, how much money in the market cap of Google would be evaporated, right? Like $100 billion, a billion? Like, so it's.

still, you know, it's weird that suddenly there's this pressure of, oh, you're a crypto company, and we could have done this thing and exploited it for a billion dollars or 10 billion or whatever, right? Or you owe us $10 million. When Google, if they got owned, would lose billions of dollars in market cap and shareholders would be harmed. And they still are paying out $250K. It feels like a double standard a little bit, right? It does.

And it also, the other thing, like when you look at it from a cost. company's perspective, right? If you pay, if your bug bounty is basically like limitless, right? Or if it's scope to like the cost that it's going to cost you, right, like to your market cap or whatever, the long term impact or like how bug bounty sort of pan out is that eventually like no companies can afford this shit. Right. And then it actually makes the whole sort of security apparatus and bug bounty programs, it sort of diminishes their value because, you know, it's actually, it's actually more ideal for a wide variety of companies to have a wide variety of programs rather than just Google or just XRP, right? You want there to be a variety of places for different, like,

levels of people to hunt and disclose. You also just want people to be able to level up over time, right? A mug is an appropriate, like a mug or a T-shirt is a totally appropriate reward for a brand-new company, right? Right. The value for security researchers to be rewarded for hunting these bugs is also something that I think we don't talk about enough. So, for example, what, how much money do you need to incentivize someone who's capable of finding bugs, right?

How much money do you need to incentivize that person to hunt your bugs? Not rather than exploiting, but like literally dedicate their energy to finding your bugs, right? So one way to look at it is like, it's a competitive. market. People are more likely to look at Google because there's a max payout of 250K. However, they're also more likely to look at any program that's fair that has like a variety of tiers, right? Because if you're going to go spend, say, two days or two weeks or two years hunting, you don't want to have to only find the 250K bug to get paid anything to, you know, to, you know,

find a 5K bug or a 10K or whatever. Exactly. Because you can buy multiple, like 10K bugs, 10. And Google is really good, for example, at paying out every single release. They're very fair about it. And so, yeah, there's just like so many different ways to look at this. I think that in this case with XRP, I understand especially the fact that the XRP foundation, those guys are all like multi-billionaires at this point. Why 250K seems to be like an absurd number. However, that's their number. and that's, you know, if you don't like that number, you can bitch about, like, you can, if you're a security researcher, go bitch at them, try to get them to do the number. But they do have a program they did pay out, which is more to say than, you know, a lot of programs in this space. But yeah, it's not clear,

it's not clear that like, if that had been a million dollars or five million or 20 million or whatever, right, that this would have necessarily been found faster, right? Like, $0.50K is enough that, like, that's a big payout for a security researcher, you know, like, I know guys who were security researchers in like a 10K thing was like their month. You know, they're like, all right, we're going to eat for the rest of the month. Also, don't forget, like, you're not, when you're 250K, like, you know, that's a year, two years, three years even, right? Yeah.

Of not going to an office of doing whatever the hell you want, of funding more. You know what I mean? Like, it's a decent reward. I also think that like I think one thing that that programs do need to reexamine So for the Google one recently right The team disclosed the people who found it disclosed that they Basically was like three or four guys

They hunted for like six days straight And they spent 40K on compute Wow Okay so that is shifting right That's interesting to me And I think it's really interesting to look at the bug that they found Which was a really good again RCE right but what's the total cost like what's just the baseline cost for that right in a totally objective

resources how much are those guys getting paid what's their time worth right number one number two you have a hard number 40k on the compute and then to pick like you have to have a little bit of inside of just a pick we're going to spend this six days on you rather than the other person yeah i think there is a much more interesting math problem to say is that 250k objectively worth it Right? Because if they're going to do this again, would they pick the Google 250K? Right. Vers to like 500K and you know, you're going to. And like there's a whole bunch of vectors here, right?

You have to think how likely is it that we? And that's the other thing is to get to the end. How much are you willing to spend in order to be able to 250K? And you found nothing, right? Like, oh, that's not. That's all. That's so much more interesting to me. I think that the math is going to, we're going to have to math.

And maybe it comes in the form of like, you know, the guys that are doing this sorts of work, they get subsidies. Right. From on the compute or I don't know. There's all sorts of different things that you can do to make it all sort of pan out in the end and keep people hunting. But I think that that's, I think like the Google situation and when you're talking about like compute and like really objective, how do we expend resources to find really valuable vulnerabilities? I think that's a way more interesting conversation than the XRP one where you're basically saying like they have 100 bills. billion dollars, they're greedy fucks, pay out more. Like, okay, sure, yes. But Google has two trillion. So, like, you know, like, are they greedy? Like, just like, it doesn't, you know, it doesn't,

Google's probably got some crypto as well. All right. Let's go, let's go to our next story. So, this is interesting to me for a bunch of reasons, right? Stocknet is saying may become an L1. and I think this is the path that in the limit, I think this is where we end up. The whole L2 thing, Ethereum sort of said L2s were a mistake to some extent, right? Like, it only makes sense if you're an L2 that's not generalized, that specific purpose or app chains or whatever. Even that, honestly, feels like a bit of a cop-out. I think that it maybe doesn't make sense at all. and maybe we end up with like it makes sense if you're a chain right we might be back to like the

l1 proliferation thesis i just think that's what's going to happen like you know the the the premium that is applied the problem is that there was a period of time where you'd start an l2 and it was much easier and you might not have the l1 premium but you had like 50% of it right that's not the case because there were too many L2s and now it's like maybe you have like 5% of it. And so there's a very obvious like 20x play if you can get to some level of credibility as an L1 that the numbers just look better, right, as an L1 as an independent chain. Stocknet's like, oh, let's front run this and let's, you know, especially your stock net, you're looking at near. Near is an L1. You're an L2.

You think that your math is pretty good too, right? You got some privacy. You got some AI. You got some chops, right? Your founder founded Zcash, like there's a whole bunch of things where you're like, why are these guys worth 50x us or whatever the number is, right? 20x us. And it's going to, if you believe you have a credible part to being 01, I think that's just what's going to happen. Right. So StarCware said, A, we're fully quantum resistant by 2027. We think we'll be Ethereum. Now, like, there is an open question of like, can anyone beat anyone at anything anymore when clankers can clank faster than you can think, right? Like maybe everyone's quantum resistant by the end of this year if it's become super easy, right?

Obviously, there's coordination problems in Ethereum, you know, they've got to work through. But that hasn't necessarily been like the limiting factor for a change in Ethereum for a while, I would argue. It's been maybe as much technical as it has been coordination. And so if the technical constraints are gone, you can probably just do things much faster. So Starknet is saying like if we were in L1, we'd be quantum resistant and, you know, Justin Drake is scaring everyone. So it just, I don't know, like you go, maybe that makes sense, right? Especially when the market then pumps the shit out of the token when they talk about this stuff, right?

Like a lot of people are going to be looking around going, yeah, I want to get me some of that too. Well, okay. Austin, what's your take? What do you think? I'll just say this. Do you think they should be an L1? I think they could probably make more money if they become an L1, but I don't think it's the best thing for the ecosystem if they become an L1.

I think we all should be quantum by 2027. I think we should have an arms race to get quantum resist. And I think that like, why do you think people are going too slow? Why is it an issue? What's the issue for the ecosystem if Starknet becomes an L1? I guess less L2 blocks phase. I don't know.

Why do we care about that? Like genuinely, right? Why did that even, like, we have enough blocks based in Ethereum now. And we're only going to get more, right? Like, the day of- I mean, there's, well, it's sort of going out the window. So historically, like, one of the advantages of being L2 over an L1 was, I guess, the assumption. It doesn't always hold true, but, like, that you're basically going to be incredibly

compatible with EVM, with Ethereum. Which was a lie. That was a lie. first of all, right? But you can also, you can do the same thing with... Dotnet is not compatible with the L1. It's a fucking completely different scheme.

It doesn't have to do all the consensus work, but the question was, what is the ecosystem get other hard work, right? Right. And some of it, by the way, some of it's on like the user-facing integration land where, like, okay, so if you didn't change anything, right, you're launching Arbituram or whatever.

If you didn't change anything versus Ethereum, you can get the integration in the wallets, on the APIs in EtherScan relatively easily because it's basically insane. You needed a bunch of it in front. It was a lie, right? But it was like, for example,

when Metamask, when we were working on, like, if you want to add Arbiton, you want to add optimism, it's literally you just change the chain ID. Everything else is the same. As a wallet, for sure. As a wallet for a user. Whereas adding Solana was like,

all right, we got to start from square one on all the libraries. Like, everything's different, et cetera, et cetera. Now, the problem is that over time, the L2s evolve, and then they add more functionality or different functionality. I remember the first one was like, oh, shoot, all of the L2s need to have, like, their own custom gas parameters.

That was the first sign that we were going to be fucked, right? Yep. Because now it's not just changed at RPC. Now you're like, okay, how does the gas work? Gas work differently. Of course. And then they start optimizing, right? Even just the gas pricing, right?

It's like the APIs and now you're talking about proprietary APIs, on, on, right? So on the one hand, the L2 is to have an advantage in that sense, right? Like it's just more familiar. The interoperability can help with the network effects, especially early on. Long term, not so much. It also doesn't guarantee the integrations. It doesn't guarantee the usability. It doesn't guarantee even like the consensus stuff, right?

I don't know. It's kind of a restraining factor, right? Like the reason why the L2s, like, it's like, okay, we're going to try to, like, you're yourself constrained. Compatibility is hard, right? So you're trying to play in this compatibility window, right? You can't really innovate. You're trying to remain EVM equivalent or compatible or come.

Mm-hmm. Or do you want to throw out of it, right? And, you know, so you've got this like range of things you can do. Meanwhile, Ethereum has woken up and said, actually fuck all of you guys we're going to like increase our own block space and make kind of the point of your entire existence

like moot you know like the point of L2s was to have more block space cheaper blocks and like more compute right you could do bigger transactions you could do cheaper transactions you could do all these things

Ethereum is going to do that it just it just is it's in the process of doing it it's going to have like infinite block space you're going to have bigger blocks, thicker blocks, wider blocks, deeper blocks. Like, we need heavier Ethereum blocks. So, so, like, I just, I think, like, you know, the most equivalent thing to Ethereum is the fucking Ethereum chain. Like, don't go and build your own weird fork of it, right?

Like, you want, like, EVM equivalence or compatibility? Like, fucking build a thing on Ethereum, man. Like, it just, like, that, like, you know, we didn't have the technology. in 2019, 2020. And we built way too much shit. And we ran out of block space. And so we went on this weird side quest to try and solve it.

And we learned a bunch of things and, you know, whatever, made some money, lost some money. Cool. But like, it's 2026. We have Clankers. Ethereum is just not going to need L2s. It just won't. I still use L2s every day. I know.

I won't need an L2 in 2027. Like, realistically. we'll see i don't know if ethereum will ever get as fast as like consumer grade apps and when you want to make like a instant like sub-second transaction we may never get that from ethereum and it may be expensive to do that but it's like subsent sub-second transactions on l-2s that makes so much sense for consumer-facing apps and then have all of those settle to ethereum like i'm still i don't know i'm still bullish on some l-2s okay all right but okay so i guess maybe this is the problem with Starnet, right?

Is like, that's actually not why they're talking about being an L1. They're talking about being L1 because we want to do like some crazy nerdy shit for quantum and AI and Starks and snarks and whatever, right? Like the most nerdiest stuff. Okay, if you guys want to do that, I applaud you. If you want to nerd out and have this network, that is a nerd network, okay? Go for it. And also like share your learning, share your research, hire people, pay.

those people have bug values for people, right? Like, I totally 100% on board with this. Don't expect anyone to use your network necessarily, right? Like, I don't know why as a regular consumer of crypto and chain. It's a bunker, it's a bunker. When we're all fleeing, we'll flee. What do you guys use Starknet for right now? It's probably D5.

I think I claimed my airdrop on it. I claimed my air drop. I'll be honest. I played myirdrop. I tested DeYDX back in the day. DiDX was the thing. You know, I think one thing that we're seeing is, you know, chains are realizing that they can't rely on, at least, you know,

non-Ethereum chains. Ethereum still is able to do this, right? In Salana, probably. But, like, most chains are realizing that, like, they need to be a vertically integrated thing, including apps. You know, DeWad-X and Starknet is such a good example, right? So, you know, yeah. So you went to Starknet to use D-YDX.

Yes. I mean, they were my competitor. What happened? Check them out. Well, I mean, then they left. Di-Y-D-X left. And D-YDX left because there's nothing else. No other reason.

I don't know, man. Like, why if you'll do anything. I'm guessing it's because there's no one. You have to have some sort of ecosystem because that's the network. It's just classic network effects, right? Having D-YDX on Starknet is going to bring a certain amount of people over. Yeah. Because they want to use this thing because it's better or whatever.

However, there have to be other apps and other reasons because then they all build off with each other. I mean, look at Megh, right? Megan Heath is the quintessential example of this, right? They curated three cohorts of like 10 teams, maybe, right? 30 teams to build consumer apps on this real-time chain and like literally 95% of those teams absolutely wrecked them. like abandon the chain as soon as they got enough traction started making their own chains like all kinds of crazy shit right and and you know like as a chain that's trying to build its own ecosystem if you're vertically integrated from like you know you're weirdly in this position especially for the

l2s right where like ethereum's the bottom layer you can't own that right so you can't be fully vertically integrated because ethereum is your basement right but above the basement you have this whole house up until like the roof where like there's a party going on and you have no control over it. And then they're like actually let's go down the street. There's a cool club like see you later. And you left to the fucking empty house that's trashed. And you're like, uh, fuck. Like what do we do here?

Right. Wait, you become an L1. That's quantum resistant. Yes. But at least then you're like, you know, what will build your own? You build your own. And like, you know, DYDX is. net or bit, right? Like, they left the chain. They went to

Cosmos, right? And Starknet is now like, fuck it, we'll build our own Perf decks. Oh. Which, like, fine, cool. Like, build your own perp decks. How is that going to leave? Like, at least they can close the doors and the party will never stop, right? It might be a shitty party, but like

the partygoers are trapped in the house with you, right? So, you know. Do you guys remember Argent? Argent was a cool wallet that did good social recovery. And then they'd built on Starknet, right? Is that where Argent went? And so account extraction had to be in part of their secret.

Like, every L2 needs to have a secret move or a secret weapon. The secret weapon had to be partially accounting. The reason why Arjun went to Starknet was because when they were on Ethereum Mainnet, right? And when you set up a wallet, it cost them. They burnt so much money in gas, man. Like, it costs $30. Dude, I remember looking at that. $30.

And the VCs that were funding. I was looking at Sargent was the hottest thing as ours getting ready to raise the next round and I'm 30 and stuff like you couldn't sign with the wallet I remember talking to those guys there was something with the wallet where wallet signatures weren't

respected across apps so even if you have the smart contract wallet apps still all had I mean you probably were too early the analysis I did on Argent totally blackfilled me on smart contract wallets because and this is why we ended up joining metamask because I was like I think they've got it right for all

the problems that I had with Madamast, I was like, they actually, from day one, the vision, the strategy and their understanding of, like, retail behavior and, like, nerdy cryptography things, like, they actually nailed it. Interoperability is king. People are going to move faster than you can ever imagine. And every time you limit their ability to do whatever they want, anytime it's not even like an actual lost money experience or, like, unable to access experience, even the perception that it might be, right? And with smart contract was, there were so many questions

that basically you were locked into this little ecosystem of things that you knew worked and there was no way that a team can keep up. I think a few things are changing. Literally Infinex. Like this is what happened. This thing. And we're like, oh, it's fine.

We'll just integrate all of the things and you just can't. There's no way. You just can't. And so it's like you have to unlock. And the second thing, you unlock anyone. And there's the thing. The biggest problem with MetaMas and its biggest success, right, was that it was so unopinionated.

It was like viciously unopinionated about everything. It was like, we are not even going to add tokens. We're going to allow people to out their own tokens, but we're not. My favorite story. Metamast didn't have Tether as a token as a Beavalt token in the wallet for years, right? Worst thing, but also best thing because it forced them to create this wallet that was fully accessible anywhere. And the priority was like, expand the ability for other people to like integrate and do things with it. All right, smart contract wallets.

I think another comeback will be smart contract wallets. The R1 curve, first of all, is a lot cheaper on Ethereum. That's nerd shit, but basically like pass keys can sign on smart contract wallets. Gas with 4357 and other account abstraction things can be sponsored. And the third thing, and I think the biggest thing is that AI is the new UI. Instead of, will the wallet integrate with all these different apps, it's going to happen at like the chain level. You will go to your wallet. You will express your intent and it will go do the things it needs to do.

It will figure it out. You don't need to go do send calls to some website and it signs things. You express your intent to your smart contract wallet. You sign with a pass key and it goes and does the stuff. Well, yeah. If the AI gets good enough, right, it will not figure out. Pace the frontier. You're going to have super intelligence next year.

Because the biggest hurdle that you're going to need to overcome, right, is like so right now, like the reason we have UI is the reason we have daps, the reason we have wallets, the reason we have all this stuff, right, is to limit the risk as much as possible. And in crypto, crypto is different because we actually want to enable people to take a huge amount of risk. But like, you don't want to just press a button and then have your money just like magically float away, right? Like that's a bad experience. Like, Planckers are going to be another attack vector that is diabolical.

It's going to be, yeah. But at some point, the clankers are going to get good enough to at least have basic sort of like, let's call them like, they're going to know how to, for example, like, stimulate. And right now, like when you have like in MetaMouse, right, like there are, we have a ton of indicators in our wallets, right? That kind of like try to hint like, yo, this might be bad. but the one thing that AI can do way easier and way better and way more robustly is actually like past the flow beforehand right

and do all these things beforehand and have a better understanding beforehand so I do agree that it'll it'll just be a different interaction style what I don't necessarily agree with is I just don't necessarily agree that it'll be a smart contract wallet I guess like a contract wallet thing

it'll be it'll be something though I agree with all right Let's close out here. Before we close out, one minor point, we talked last week after Blast shut down, like when Blur shut down, and it was this week. So end of an era there. I mean, I don't even know what else to add to that. Dude, shout out.

I remember using Blur. You could sweep the floor. It was just like bloop, bloop, bloop. And you get 15 NFTs. Now I have 15 NFTs that go to zero instead of just one. Good job, Austin. Thank you. All right.

Thank you. Thank you everyone for joining us. on this episode of Uneasy Money. Remember what happens on Chain never stays on Chain. We will be back next week. Nothing you hear on UnEasy Money is financial advice. We're just three builders talking about what's happening on chain, and we want you to always do your own research before aping in.

You can find all our disclosures at UnchainedCrypto.com slash uneasy money.