Unchained - Will the Nomad Mass Looting Change How Law Enforcement Treats DeFi Hacks? - Ep. 382

Starting point is 00:00:00 Hi everyone. Welcome to Unchained, your no hype resource for all things crypto. I'm your host, Laura Shin, author of The Cryptopians. I started covering crypto seven years ago, and as the senior editor at Forbes, was the first mainstream media reporter to cover cryptocurrency full-time. This is the August 9th, 2022 episode of Unchained. Do you have a burning question for Hasu and Roon Christensen? Don't miss the great maker debate today on the chopping block at 12 p.m. Eastern Time. Hasu and Rune will join hosts Haseeb Qureshi, Robert Leshner, Tom Schmidt, and Turun Chitra. Hop onto the live stream at YouTube.com slash c slash unchained podcast at 12 p.m. Eastern Time today. With the crypto.com app, you can buy, earn, and spend crypto in one place. Download and get $25

Starting point is 00:00:52 with the code Laura. Link in the description. Harness the full power of the Avalanche Network with Core, your new Web 3 command center. Built by Aval Labs, core is more than just a wallet. It's a non-custodial browser extension, engineered for users to seamlessly and securely experience Web3 like never before. Explore Avalanche DAVs, NFTs, bridges, subnets, and more today. OASIS Labs has recently partnered with Meta, previously known as Facebook, to build a platform that will assess fairness for its AI models.

Starting point is 00:01:27 The first of its kind initiative will advance fairness measurement. in AI models, which will positively impact the lives of individuals and benefits society as a whole. Today's guest is Lane Haber, co-founder of Connects Network. Welcome, Lane. Hi. Hi. Great to be here. Last Monday, hackers stole almost $200 million from Nomad, a cross-chain bridge. Before we get into the details, can you start just by explaining what Nomad is? Yeah, sure. So Nomad is a an optimistic messaging system. That basically means they send messages between two different domains or chains. And the way that they do that in a trust minimized way is by using the same optimistic fraud proofs that are common in arbitram and optimism and all the other optimistic

Starting point is 00:02:20 roll-ups. What that means is messages are passed from one domain to the other. And then there's a 30-minute delay where watchers or anybody in the system can submit a fraud-proof. and an updater who is responsible for propagating the roots get slashed. Okay, so explain how this hack occurred. What was the vulnerability that was exploited? Yeah, so the Nomad protocol and its base layer is just this message passing protocol, and it allows you to build cross-chain applications on top. So one of the applications that they built as a flagship application is a token bridge.

Starting point is 00:02:58 The token bridge had a bug in it where it would, process messages that weren't proven in this route so they hadn't gone through the optimistic fraud window and that allowed, you know, any arbitrary message to be processed by this contract as if it were certified and verified. So attackers were able to put in messages that said, I've withdrawn funds to Mainnet and please let me take those and unlock those from the contracts and they were able to drain the funds that existed in the bridge router. And that was even if they hadn't actually done that, they were just able to, it was like kind of pretending like you were owed this money, but instead you're just literally stealing.

Starting point is 00:03:45 Exactly. Yeah, exactly like that. Yeah. And how much TVL was in Nomad at the time? So I believe that the total TVL was around 190 million, which is also the, that was drained from the contracts. Wow. Yeah. Okay. Wow. So pretty much a mass looting, as it was described,

Starting point is 00:04:09 people were also calling it a free-for-all. Why were they using that term? Yeah. So this hack was actually really interesting in the sense, in terms of who was able to participate. Like most hacks that you see of smart contracts, you know, they generally have a very sophisticated attacker who's able to drain the contracts really quickly,

Starting point is 00:04:31 but it's just one, maybe two people. And what was unique about the nomad hack is that while that the vulnerability could have been exploited in that way, it wasn't. And so people were able to, instead of draining all of the money at once, they were draining it a little bit at a time. And there were a large number of bots

Starting point is 00:04:52 and white hats and opportunists, just the whole gamut of people watching EtherScan who copy-paste the transaction data and were able to take some of the funds. So I think there were, you know, over 50 addresses that participated in this and some people just running M-AV bots who didn't know that they were participating in a hack that were able to withdraw some of the funds from the contract. So in that sense, it was really unique in how it was exploited. And yeah, people have called it eluding. Yeah, I saw people saying it was the first.

Starting point is 00:05:28 mass looting of a cross-chain bridge. And I also heard people who thought that it was the first mass looting in crypto ever. But I should say, if you followed what happened during the Dow back in 2016, it was the same mechanism. You can read about it in my book where essentially once people figured out what the vulnerability was in the Dow, then anyone who could copy that attack was doing so. And so there were multiple instances where there were a number of copycat attackers who were also stealing funds from the DA. So I wouldn't say this was the first mass leading in crypto, but definitely of a bridge. Yeah, definitely. So how did this vulnerability get introduced to Nomad's code?

Starting point is 00:06:13 Yeah, so they had submitted this code for audit with Quant Stamp. I'm not sure about the details of when it was audited by Quant Stamp and when it was audited by Quant Stamp and when it was. was submitted by Nomad. All I know is that in the, I know that it's debated between Nomad and Quant Stamp. Nomad put in their RCA, the root cause analysis that this commit hash was included in the audit, but I know that Quant Stamp has said that those changes were introduced in a commit that was not included in the audit. So that bit is a little bit unclear, but, you know, audits don't necessarily always catch everything. So it's always good when you're developing these systems to put in other safeguards like, you know, making it possible or what have you.

Starting point is 00:06:58 Okay. So basically, Nomad is blaming the auditor for like making a fix that introduced this vulnerability and constant of saying this was introduced after the audit. Oh, I don't think that they're blaming the auditor for not catching this. But yeah, I think that just whether or not the specific commit that was, that introduced the vulnerability was included in the audit is the main point of debate. Oh, I see, whether or not they caught it. Right. Yeah. Oh, okay. Okay. So afterward, Nomad asked hackers to return the funds. What was the offer that they made and then how did the hackers respond? Yeah. So the offer that they made and this is still ongoing is that if you return up to 90% of the funds, you can get up to 10% of

Starting point is 00:07:48 the total value back as a bounty. They launched wallet to accept the funds in collaboration with Anchorage. So that's kind of where you can go to find more about that. How hackers have responded. I think that there's been a lot of positive response. They've already gotten about 35 million back from White Hats and various hackers. And why do you think that law enforcement is getting involved here where normally they wouldn't? I mean, I don't want to speculate too much, but I would imagine that it has to do with the nature of how many different people participated. And also because the hack itself was so frenzied, like you could just see all of these people sending in transactions to withdraw funds. I think a lot of people may not have used the best

Starting point is 00:08:35 OPSEC in preparation for this hack or for taking some of the funds out. So they could have used docks wallets or things that it, wallets that it interact with exchanges. So I think that also makes a little bit more appealing to law enforcement. Oh, because of the time pressure. Right. Not if they didn't, right, if they didn't get to the funds before other people, then there wouldn't be any left to steal. Right. Yeah. I doubt all 50 people woke up today thinking, oh, I'm going to participate in a hack and exploit this vulnerability. I think it was a little bit more chaotic than that. And then for the hackers that have returned some of the funds, do you know what number of those 50 accounts have done so? No, that I don't know. I don't know. I don't

Starting point is 00:09:17 know the percentage of tracked accounts that have actually returned funds. Okay. All right. So in a moment, we're going to talk a little bit more about this law enforcement issue. But first, a quick word from our sponsors. Join over 10 million people using crypto.com. The easiest place to buy, earn, and spend over 150 cryptocurrencies. Spend your crypto anywhere using the crypto.com visa card. Get up to 8% cash back instantly. Plus, 100% rebates for your Netflix, Spotify, and Amazon Prime subscriptions. Download the crypto.com app now and get $25 with the code Laura. Link in the description. Check out OASIS Network, the leading privacy-enabled and scalable Layer 1 blockchain that combines high throughput and low gas fees with secure architecture to provide a next-generation

Starting point is 00:10:08 foundation for Web3. OASIS Labs has recently parted with Meta, previously known as Facebook, to build a platform that will assess fairness for its AI models. The first of its kind initiative will advance fairness measurement in AI models, which will positively impact the lives of individuals and benefit society as a whole. OASIS recently announced the $235 million ecosystem fund to support projects to build on the network and is one of the top two invested blockchains by top VCs, according to Masari. Learn more by visiting Oasis Labs,

Starting point is 00:10:45 Join a community of innovative developers and start building the future of Web 3 on Oasis Network. Back to my conversation with Lane. So as you mentioned, Nomad said it was working with TRM Labs, which is one of the blockchain analytics companies, along with law enforcement, to track down the hackers. So is your sense that this is something that will see more often in the kind of defy hack space? Or do you feel that this is truly just a one-off as you described it? I'm not so sure it'll be a one-off. I think you're seeing a lot more regulation and involvement from governments kind of at all levels in the crypto space. And I think that's a trend that you'll see continue. I think that because there's so many more people who participated in this one with perhaps not the best obsec, a good opportunity for law enforcement to kind of stake their ground and set precedent. So that could be a reason why they're more willing to get involved. But I do think that the trend of, government getting more and more involved in crypto will continue across all levels of government. But are there other kind of features of different types of blockchain smart contracts

Starting point is 00:11:54 or defy smart contracts that would make it harder for law enforcement to get involved in hacks of other types of protocols? Yeah, I mean, I think we see a lot of privacy tech kind of emerging now. And I think that as those systems grow and mature, they will become more difficult for law enforcement to get involved with just because of the nature of the systems. I think with defy as it stands, there's a lot of space for law enforcement to get involved, but it's not necessarily the easiest. And I think it will continue to get more difficult. Oh, interesting, because we'll see more privacy. Exactly. So in general, as I'm sure you're well aware, there's been quite a number of hacks of cross-chain bridges. in general, why do you think we see so many of those?

Starting point is 00:12:46 Yeah, that's a really good question. I think that it's very difficult to build interoperability tech. And while that is true, I think you've seen very few cases where the core model of the bridge itself is what comes under attack, including nomad, right? Like, this is not an indictment of the security model of optimistic verification. This is an indictment of like smart contract. the difficulties of like producing secure smart contracts and secure code. I think that only the Axi Infinity one was truly an indictment of smart or like the security model of the system, but Polly Network was a giant hack that was also an implementation

Starting point is 00:13:27 issue. Same with wormhole. These implementation issues keep coming up because you have to deal with a lot of different execution models. Like if you're building a bridge that should connect to multiple changes, chains, then there's very, you have to use the right kind of abstractions. And just holding all of that in your head at the same time can embed itself in complexity in the system, which makes it more difficult to build, which makes it easier to hack. So in a way, what you're saying is it's more

Starting point is 00:13:56 like human error that's being introduced. Would you expect then that over time, once these systems kind of have been around for a while and that people sort of understand what the various pitfalls could be that then we'll see less of them, or is it just that the tech will continue to, you know, be pushing the cutting edge. And so therefore, we'll always see kind of a certain area of the tech that is more prone to vulnerabilities and hacks. I think we'll see the implementations get stronger and stronger,

Starting point is 00:14:28 but I do think that as the implementation gets stronger, there will still be risk associated with bridging between different domains. Like, for example, if I'm going from main net to EVMOS and there's a huge consensus failure on EVMOS, how exactly should the bridge handle that on the main net side? So those types of things will come up and those aren't really going, you're not going to get around it being difficult and there being security issues there. But I think the implementations themselves will get stronger and stronger. So in general, at the moment, what do you, what would your tips be for improving bridge security? Well, I mentioned one, like adding in safeguards, like making sure that things are possible.

Starting point is 00:15:13 That's pretty common practice in a lot of defy projects. When is it possible? Possible, possible. So like in the Rari-Fay hack, you can just stop, freeze everything happening with your contracts while you kind of take a second to figure it out. I think that also there's some really common sense circuit breakers that you can put in place. Those circuit breakers have a unique position in interoperability. because you're dealing with an asynchronous environment,

Starting point is 00:15:39 like you have time to stop things from contagion from spreading from one domain to many because it's not default composable. It's not like these chains are directly talking to each other. You do have some time there. So when like really common sense circuit breaker could be, okay, are netted funds out equal to netted funds in? And if that breaks in any point, then you just pause everything on the bridge. But then when you introduce plausibility, does that also then mean that the system will be more centralized?

Starting point is 00:16:13 Yeah, there would be. I think that's an okay tradeoff to make, especially as you're figuring out, like, the potential pitfalls in your implementation. Like, you should be security minded by default, and that includes, like, having a slow phase rollout. So while I do think that everybody should move to kind of get these possible modifiers out, get admin function, out, I think it's important to be mindful of how you're rolling it out and that you don't know all the unknowns unknowns when you put something out there that could potentially hold hundreds of millions of dollars. And then are there any kind of systems that smart contract designers can put in place that would prevent these sort of mass looting type situations? There are several. Like the circuit breakers that I brought up would have prevented it as soon as the vulnerability was discovered. For example, like just because you know the nature of this vulnerability, you would have been able to withdraw at all in a few transactions, had you really understand how the vulnerability works.

Starting point is 00:17:14 It kind of indicates that whoever discovered this and exploited it originally didn't have a strong understanding of what they were actually doing, which, you know, would have given time for people to pause things or just halt actions on the bridge. Another great thing that you could do is like build in rate limiting for withdrawals. So if you notice that withdrawals on a bridge are increasing precipitously and the value in the bridge is dropping, you could kind of rate limit that to say, okay, we'll honor your withdrawal in 60 minutes instead of right now because we want to just slow things down. So those are some mechanisms that you can introduce into your system to make it more secure and make it more security-minded. But I'm sure there are a lot of others that could be explored. So going forward, you know, as you mentioned, the kind of story of the nomad hack, isn't exactly over. What are you going to be looking for to happen in the next few weeks on that front?

Starting point is 00:18:10 Yeah, well, I'm interested, obviously, to see how much of the funds get returned through this bounty program. I also think that I'll be looking to see, you know, how in the event that they don't get all returned, how they handle this partial backing of assets or kind of what their plan looks like for moving forward because on chains like Milcomeda or Evmos or moving. B, but they're holding a lot of mad assets or those assets are deeply embedded within the ecosystem. And it's not clear if you don't have 100% of the backing how you go about redistributing those funds in a fair way. So I think that that, well, an unfortunate exercise to have to go through will be an interesting one. And what are some of the options that are

Starting point is 00:18:55 on the table? I think it's still really early to kind of say what the exact options are. And I think a lot of it depends on how likely it is they think they'll get the funds back over a longer period. Because, you know, if you think, oh, we'll get 100% of the funds back throughout work with to analysis or what up or law enforcement or whatever, but that's not going to happen for five, 10 years, then the realm of possible solutions looks a little bit different than if you're writing those funds off completely. Like maybe you could take out a loan or maybe you could like commit to buying them back and open up a bond market of sorts. I'm not sure, but I think that there's still some unknown unknowns that go into the mechanisms there,

Starting point is 00:19:37 or would have a strong voice in the mechanisms there. And if you were in charge of these decisions, do you have a way that you would lean initially? Initially, I would probably, the simplest answer I could give is like a snapshot. Like whoever's holding mad assets gets reimbursed to the portion of liquidity that we have come in. I think, though, that that's a dumb, workable solution, but there's probably more. elegant ones that are out there. And a lot of it, again, depends just on the amount of funds that get returned. Okay. All right. Well, we'll have to see how it all pans out. Thank you so much for explaining this all unchanged. Thanks for having me. Don't forget. Next up is the weekly news recap.

Starting point is 00:20:15 Stick around for this week in crypto after this short break. Is your Web3 experience hindered by inadequate crypto wallets and browser extensions? Avalabs has created Core, a free non-custodial browser extension engineered for Avalanche users to have a more seamless and secure Web3 experience. The best-in-class Avalanche Bridge now offers native support for the Bitcoin network. Put your Bitcoin to work in the robust DeFi ecosystem by bridging BTC to Avalanche today. With Core, you can also easily swap assets, display your NFTs in style, store your assets in a ledger-enabled wallet, and put real dollars into your crypto wallet in just a few clicks. everything you need for a simple, secure, and convenient Web3 experience. Download the free core

Starting point is 00:21:05 browser extension from Google Chrome's App Store today. Thanks for tuning in to this week's news recap. Michael Saylor is no longer Microstrategy CEO. Bitcoin maximalist Michael Saylor stepped down as Microstrategy CEO after leading the company for over three decades. The news was dropped last Tuesday as the company released its Q2 earnings report. At that time, Micro Strategy reported a $918 million unrealized loss in Q2 from its Bitcoin holdings. The firm holds 129,699 BTC, which were bought at an average price of $30,664. Mr. Saylor will be serving as executive chairman and will be replaced by Fong Lee, the previous president of the company. It looks like Saylor wants to go full-time on Bitcoin.

Starting point is 00:22:00 As executive chairman, I will be able to focus more on our Bitcoin acquisition strategy and related Bitcoin advocacy initiatives, while Fong will be empowered as CEO to manage overall corporate operations, said Saylor. Even though some people were concerned that micro-strategy would dump its BTC when Saylor was no longer CEO, it seems that's hardly the case, since Saylor has 60% voting ownership and his Bitcoin conviction remains unchanged. It appears that the market took Saylor's. resignation as positive news. Microstrategy stock has risen almost 15% since the time of the

Starting point is 00:22:37 announcement, followed by an increase in BTC and crypto prices in general. The Solana ecosystem suffered another hack. Aside from the Nomad exploit, discussed earlier in the show, there was another important attack within the Solana ecosystem, which affected more than 10,000 users and drained more than $6 million worth of crypto tokens. Thursday morning, users in Solana started to report that their accounts were being drained, with their balances going to zero. The funds from these wallets were being sent to four different accounts, allegedly ones belonging to the hackers. The vulnerability appears to have been in Slope, a mobile wallet application. After an investigation by developers, ecosystem teams, and security auditors, it appears affected addresses

Starting point is 00:23:22 were at one point created, imported, or used in Slope, tweeted the Salana status account, adding, private key information was inadvertently transmitted to an application monitoring service. There is no evidence the Solana Protocol or its cryptography was compromised. The incident prompted criticism of Solana. All the problems with Terra One and Solana should really be a wake-up call. Defi has drifted away from Cypherpunk principles. Everyone is just trying to get rich fast with no conscience unpublished code, security by obscurity, centralized interventions to prop up bad designs, etc, wrote Gabriel Shapiro of Delphi Digital.

Starting point is 00:24:03 Slope has also launched a bounty program to recuperate the stolen assets. They asked the hackers to return 90% of the funds. After stating that the team was working with blockchain analytics firm, TRM, and law enforcement, it continued, upon the receipts of these funds, we will not make additional efforts to investigate this matter or pursue any legal action. Institutions are coming. will this be good or bad news for crypto? Coinbase, the largest crypto exchange in the United States, had two big announcements this week.

Starting point is 00:24:34 First, it is now offering Ethereum staking to institutional investors in the U.S. through Coinbase Prime, the firm's institution-focused arm. Using our industry-leading cold storage, clients can now generate yield by staking ETH, said Aaron Schnark, vice president of product. Whether this is good or bad for Eith is an open question. On the one hand, there's a threat that Ethereum becomes more centralized, as Coinbase will act as a custodian for all these institutions. This means that it will own the private keys to all the state tokens. After seeing the ripple effects that could arise from centralized companies not being responsible enough with other people's holdings,

Starting point is 00:25:12 it should come as a surprise that there are some concerns about Coinbase owning such a large amount of assets. The second announcement could have an even larger impact. BlackRock will begin offering crypto investments to its institution. clients through Coinbase Prime. BlackRock is the world's largest asset manager with $10 trillion in assets under management, and this marks its first move into crypto. Clients of BlackRock's investment platform Aladdin will have direct access to crypto. After the news broke, Coinbase stock rose as much as 35% and trading had to be temporarily halted. Coin stock is now trading at around $100, accounting for a 20% increase since the announcement.

Starting point is 00:25:52 as was the case with ETH staking through Coinbase, whether Black Rock's move is beneficial for crypto as a matter of debate. Coinbase is obviously one of the biggest winners. In addition, it could potentially be positive for crypto investors, as it creates a path for big money to enter crypto, which could push up prices. Based on ARC's simulated portfolios, institutional allocations between 2.5% and 6.5% could impact Bitcoin's price by $200,000 and $200,000. and $500,000 respectively. However, the centralization issue arises again. Soon, BlackRock will control crypto

Starting point is 00:26:31 just like they already control the stock market, said someone on Twitter. Considering the fact that BlackRock manages $10 trillion in asset center management, the danger is that it becomes a major holder of VTC and other crypto assets, making them much more centralized, which is not the Cypherpunk way. Tornado cash addresses sanctioned by OFAC. The U.S. Treasury Department, Office of Foreign Assets Control, or OFAC, decided to sanction virtual currency mixer

Starting point is 00:26:57 Tornado Cash for being used to launder more than $7 billion worth of virtual currency since its creation in 2019. In addition, the U.S. Treasury claims that Tornado Cash has been used by North Korean Group Lazarus, which has been behind many of the latest crypto hacks, including the $600 million ron exploit. The addresses of Tornado Cash were added to a blacklist by OFAC. As a consequence, all Americans are now prohibited from interacting with tornado cash or any of the addresses on the blacklist. Coin Center released a statement saying, Today's action does not seem so much a sanction against a person or entity with agency. It appears instead to be the sanctioning of a tool that is neutral in character and that can

Starting point is 00:27:43 be put to good or bad uses like any other technology. In other regulatory news, last Wednesday, a bipartisan bill was introduced, by the Senate Agricultural Committee with the intention to make the CFTC the primary regulator of the cryptocurrency industry. The Digital Commodities Consumer Protection Act of 2022 would grant the CFTC exclusive jurisdiction over crypto. Importantly, it would consider some cryptos like BTC and ETH as commodities, not securities, which would put an end to a long debate on that topic. There were other enforcement actions this week. Forage founders were charged for an alleged a $300 million pyramid and Ponzi scheme by the Securities and Exchange Commission,

Starting point is 00:28:27 and they alleged that it had been running for more than two years. Rounding out regulation news, New York regulators find Robin Hood's Crypto Division with a $30 million penalty for violating anti-money laundering rules and failing to provide cybersecurity measures on its platform. Time for FunBits! A Dow is sending people to the moon. A decentralized autonomous organization called Moon Dow sent someone to space last Thursday.

Starting point is 00:28:55 Moon Dow's mission is to create a self-sustaining, self-governing colony on the moon to act as a launch point for humanity to explore the cosmos, as if Earth wasn't close enough. The person chosen by the Dow to go to the moon was Kobe Cotton, a member of Dude Perfect, a YouTube trick shot group. The Dow purchased two tickets with Blue Origin, the aerospace company founded by Jeff Bezos, using $8 million it had crowned funded. The Dow has already used the first ticket, but still has one left. The second lucky Dow member to go to outer space will be randomly chosen.

Starting point is 00:29:30 The roadmap of Moon Dow indicates that, after sending a Dow member to the moon and putting a Moondow colony on the moon, it intends to have parties on the moon. Thanks so much for joining us today. To learn more about the Nomad Hack, Lane, and Connects Network, check out the show notes for this episode. Want to keep up with the biggest news plus market updates in crypto? Get the Unchained daily newsletter in your inbox every weekday morning. Visit Unchainedpodcast.com to subscribe. Unchained is produced by me, Laura Shin, with help from Anthony Yun, Matt Pilchard, Juan Ivanovich, Pam Majimdar, Shashonk, and CLK transcription. Thanks for listening.

Unchained - Will the Nomad Mass Looting Change How Law Enforcement Treats DeFi Hacks? - Ep. 382

There aren't comments yet for this episode. Click on any sentence in the transcript to leave a comment.