Compliance-Conscious Cross-Chain Interoperability

Transcript

[Music] Heat. Heat. [Music] Great. Uh, good afternoon everyone. Um, thank you for joining me. My name is Tamin Louie. I'm the CEO of Wanchchain.

Um, since we have a very manageable group here today, um, feel free to chime in with any questions throughout the presentation. No need to wait at the end. If not, I'll probably use up the whole 20 minutes. It's a big topic. So, we're going to have to narrow it down to get through it uh in this time frame. But the topic today basically is we're going to be talking about and exploring one of the big tensions that is um you know current currently in place in our industry and that is how do we enable seamless decentralized interoperability between blockchains without compromising regulatory compliance.

So just quickly um a little bit about who chain is. So, Wanchchain is the original decentralized blockchain interoperability protocol. We focus heavily on R&D and we have a special specialization in nonem interoperability. Um, having been around for so long, we've got many milestones under our belt. We built and deployed the first direct decentralized bridge connecting Ethereum to Bitcoin. And for people in this room, you might know us uh best as the co-chair of the interoperability work group at the Enterprise Ethereum Alliance. And more recently, um, we've become maintainers of Smoot, which is the newest project at the Linux Foundation. This is an open-source interoperability framework. Um, it's compliant with the, um, standards that

we developed at the Enterprise Ethereum Alliance, and Smooch is basically, you know, 100% open-source WAN chain. In the past seven years or so, nearing eight years that we've been around, um, we're pretty proud of the fact that we haven't suffered any security incidents or hacks. Um as all of you know that does happen from time to time with crosschain bridges and despite that you know we've managed to secure billions of dollars in crosschain value and this is across 40 plus chains both EVM and nonvm as of today I think the number stands at 44 but the number is you know slowly ticking up every every few months but the road map for today so this is what we're here to discuss first I'm really going to narrow down these

definitions first interoperability and compliance both are huge topics I'm going to bring it down as small as possible so we have any chance at all of talking about something and then we will um turn our eyes to a recent event. It was covered in the media pretty con um you know pretty comprehensively although I do think it probably could have been covered even more and this is that big by bit hack that happened about a month ago or two months ago or so and then we will um pivot to look at some of the compliance tools that are available to builders today look at how they work and then we'll share some of our own personal experience we have some experience with these tools have found them to be lacking in some ways and we'll share kind of our learnings about how how we've tried to adapt them to

make them more suitable for decentralized protocols and for DeFi Okay, but what do we mean by interoperability? You know, again, huge topic. We could be talking about web 2 to web 3 interoperability, blockchain to blockchain subcategories here, public to public, public to private. Private to private is a little bit easier. We could be talking about, you know, legal to technical interoperability, all sorts of stuff. But for us, like I said, we're narrowing it down a topic that we're all very familiar with. We're going to be talking about crosschain bridges. Whenever I say interoperability today for the rest of the pres presentation this is what I'm talking about and this is as you all know the infrastructure that um basically allows assets value data to move between different blockchains

and crosschain bridges you know we view them as core core infrastructure I think the the idea that there will only be one chain I think that has been abandoned by the industry you know a long time ago if we're going to reach mainstream adoption there's going to be multiple chains involved and therefore we need some sort of decentralized is interoperability solution. Um these there is some kind of variance in how the different bridges works but just so we're all on the same page they sort of follow the same framework. You have some infrastructure that's deployed on the source chain. You'll have some infrastructure that's deployed on the destination chain and you'll have an off-chain component. We just call it a relayer. Um this can be designed in lots of different ways, but it is an off-chain piece that basically all crosschain bridges have. And this is

what's responsible for essentially just detecting events on the source chain and recording those same events hopefully unchanged on the destination chain. And when you have these thing three three things in place you have quote unquote interoperability. Now on the other hand we have compliance an equally large topic. Um here again way too big to talk about in 20 minutes. So we're just going to narrow it right down. We're not going to be talking about things like data privacy. We're not going to be talking things about you know tax laws or t or things like that. We're just going to be talking about anti-money laundering. Um, especially when we're talking about crosschain bridges. Yes, okay, it's technically data, but most use cases for bridges is moving value, moving tokens, moving assets. And so, they become targets for, you know, bad actors who might want to

be doing some money laundering. And for builders, this is actually quite interesting because, you know, any kind of mechanism that is designed to be anti- uh moneyaundering, it's basically intentionally introducing some friction into your system because you want to create the opportunity to either block or at the very least track the the dirty money or or the bad actors. So, it's kind of making it your system less efficient on purpose so that you can do some other activities. And so, on the one hand here, we have interoperability. We have bridges. thrive in permissionless uh trustless environments. And on the other hand, we have compliance, anti-moneyaundering for the rest of this topic. And this requires control. It requires identification. And these two things

really kind of at a glance seem to be in conflict. And this is kind of where the whole tension lies about how to regulate DeFi. And we saw this kind of play out recently. Um a perfect use case for this discussion or a perfect example. And this is that big by bit hack. So, so you've probably heard of it happening, but we'll just run through kind of at a high level what happened with this. First, North Korea, as is uh, you know, often the case, their Lazar Lazarus group hacked into the Bybit centralized exchange and stole 1.4ish billion dollars mostly in ETH. Now, whenever there's this type of like hack either on the DeFi or the CFI level, the first thing that these hackers will do, these bad actors will do is they'll try to clean that money. They're going to try

to opuscate, try to cover their tracks so it's more difficult to see where the money is going. They're also going to try to swap into kind of a less controllable asset. So, usually that means try to get the Bitcoin as quickly as possible. And they have a few tools that they tend to use. One, they'll use sometimes a centralized service, probably registered in kind of a non-regulated market. And they're this centralized exchange is definitely not doing any KYC or anything like that. Sometimes they'll use that, failing that, they'll rely on decentralized protocols. This will be crosschain bridges, these will be dexes, and this will be mixers. basically, you know, we're covering probably about 95% of the behavior if we just mention those things. So, in this case, $1.4 billion, Lazarus Group did basically what we expect them to do. They got the money and they immediately started to transfer

or to convert the ETH to BTC. And in this case, um, they ended up using Thor Chain, Thor Swap, but got to it via OKX DEX, which is a bridge index aggregator. And, um, basically, this caused a huge controversy. You know, you don't move this type. This is one of the biggest hacks ever. you don't move this volume of money without kind of gaining attention. You saw things like on Thor chain on Thor swap in one day. Their kind of volume just skyrocketed a billion dollars processed on Thor chain in the first day. They, you know, earned millions of dollars in fees themselves from doing from having this happened.

And it caused a big controversy in their own community. There's a lot of discussion, okay, should we step in? Should we freeze the ETH swaps? You know, we don't want to be helping North Korea kind of uh launder their money, fund their nuclear program, etc., etc. But the vote failed and Thor Chain decided they were not going to step in. another controversy lead dev of Thor chain stepped down resigned in protest basically citing kind of um you know ethical concerns and saying you know in 2025 we have to we can't be having our decentralized protocols be used in this way um but not everyone agreed obviously so then they voted and they didn't uh they didn't do anything so all the money kept flowing through this situation was a little more interesting because Lazarus group didn't directly interact with Thor chain Thor swap u for most of

these funds they went through the aggregator Like I mentioned now, OKX DEX is a decentralized protocol as well, DEX and Bridge Aggregator, but it's built by the OKX um you know, web 3 team and that's a very easy group of people to find and the European regulators did find them, have some discussions, expressed their concerns politely and uh OKX basically decided to shut down OKX. You know, they turned it off um and then basically announced that they were going to be instituting some new kind of security features. they're going to add kind of the ability to track addresses, to scan addresses, to freeze funds if need be. And you know, they must have gotten their uh their buil their their devs to work overtime because it only took them about six weeks or so and they

had totally reconstructed their application and relaunched as a kind of secure DeFi gateway. So that all happened with Bybit. I think there's some important takeaways when we watched this happen. There's a lot of different actors involved. Um but a few of the hard truths that were revealed I think first is that you know DeFi is no longer just pure neutral infrastructure. Um it's a target both for regulators as well as um kind of bad actors. Um this is just how things have gone. Number two in 2025 um there's you know if you want if you want DeFi or your decentralized protocol to be used in the real world world you're just going to have to figure out a way to um kind of block sanctioned addresses and sanctioned entities at the very least. um if you want this to be

used in the quote unquote real world. And then third, the kind of viability of decentralization itself is being stress tested in real time. Um like I said, you have regulators on one side, you have users in the middle, you got bad actors on the other side. you know, whether or not you agree with what Thor Chain did and decided not to kind of get involved or you think that OKX was right and they shut down the thing, regardless um you there's a clear trend here and that from the real world quote unquote or the mainstream there's a growing expectation that all these protocols whether centralized or decentralized have to have some sort of protections in place to combat um kind of money laundering and making sure that they're not being used for nefarious purposes.

So, which brings us to kind of what what tools do we have available to us today. Um, so kind of the most mature category of these are these risk based address screening. Um, there's a quite a quite a few kind of thirdparty solution providers for this. The biggest you've probably all heard of, chain analysis, they're industry leader, but there's a few other ones that are very notable as well. Elliptic is another one that comes to mind. And basically, these third parties, they ingest all this public blockchain data and they map kind of the wallet addresses to known entities. So these are things like centralized exchanges, mixers, kind of known scams, known hacks, known thefts, as well as terrorist groups, but also legitimate businesses as well, and kind of known DeFi protocols. And they're just trying to identify. Often this is done manually, not not only manually, but

they have to do some manual intervention as well. And they're really just saying, "Okay, we know who this address is." And they try to fill it out, fill out, draw in this map as much as they possibly can. And then if you're a client of theirs, you can feed them an address, and then they will return to you some sort of risk score. in slightly more detail. Uh the way it works is let's say I'm a crosschain bridge and I'm using this type of service. A user might uh you know initiate a crosschain transaction. Then my protocol we now have at the very least their sending address that they trigger the transaction with with as well as their receiving address where they want the funds to go to. Theoretically I could take these two I could submit it to one of these service providers. And then

when they receive those addresses in real time they'll start building out a kind of graph like we have on screen here. They'll be kind of going hop by hop backwards and forwards and just tracing the funds and kind of seeing all the connections to this wallet until they hit a known entity. So they can see, okay, I followed the funds backwards. I saw it came from Coinbase. I can stop here. Coinbase has whatever data they have, they have they've done KYC, whatever. Or it kind of goes back and, oh, it's a North Korean address or a known North Korean address. Okay, now I know this money here has come from North Korea. Once they kind of have built out this whole kind of sheet here, this whole graph, then they'll evaluate the route and then they'll return um some sort of risk assessment. Some of

them depending on which service you use will be just like a number one to 10 or something like that and others will have categories low, medium, high. And then the application, the builder decides what they want to do with that information. I might say, okay, anything seven and above I'm going to block. It's up to me. I can say six and above. I can say five and above. Doesn't matter. They're just providing this information. So these are very powerful but it's a it is kind of a problem. Uh if you kind of think about it all these tools are really designed um with centralized clients in mind and the whole thing is happening offchain. So you know for kind of people who are building decentralized protocols it's useful enough you know we all well most of us will have some sort of front end that our users interact

with. Okay, this is a centralized component, easy enough to use this type of service. But the actual protocol itself, all the smart contracts onchain, it's not really suited to this because, you know, smart contracts can't directly call some random API. Smart contracts can only call other smart contracts. So, it's not a perfect fit. You know, we're talking about interoperability today and crosschain bridges. So, there is kind of a little slice that we can um kind of manipulate to use this type of service because as I mentioned at the top, all bridges will have some sort of off-chain component. So you could rig it up that your offchain component as part of your transaction flow will call these APIs and then get some some data and then you can you know design it to react however you want. But even though you could kind of force it together, it's kind of like

square circle hole. Uh it's not like a per fit. These are clearly not things that have been designed for DeFi. Um you can kind of think about it like if you do it will work and it's powerful but you if you want to kind of put this into your bridge it is basically kind of introducing an element of centralization into your protocol. And you know this is sort of counter to the whole reason why we're building the things that we're building. So it works but um you know it doesn't really sit right. Um and really I think the problem is that this whole kind of AML stuff it can't only be happening offchain. And so, you know, at WChain, we've been exploring this far before by by bit a few years. And we've spoken with several of these providers. And basically, we're saying, you know, I

think this whole flow is backwards. You really have you should have some sort of kind of service tier for decentralized protocols. And they basically all say we can't really do AML tooling on chain. It's not going to be e economically sustainable. The cost is going to be way too high. Um, but having kind of experienced and experimented with these um tools as they exist, we didn't really agree. It didn't really fit right. It sounded more like ah we don't really want to do it that way. It's not our business model. So we decided to run a few uh feasibility studies ourselves just to see okay what how would these things work. So we set some ground rules for ourselves. Um first we said whatever we decided to build and propose it had to be maximally decentralized maximally on chain had to not be isolated to a

single chain had to be usable on multiple chains interoperability and it had to be affordable enough that it's not just like a total dealbreaker for def for decentralized protocols to use. So after kind of musing over this or thinking thinking over this for a while, this is kind of the framework that we proposed. We decided that actually it will be best to rely on kind of one chain that has to be cheap and fast to serve as this kind of source of truth blockchain here. This blockchain would house um kind of OFAC list the san sanctioned entities also some gateways if you wanted to use the third party services. Um then we would deploy other gateways, other smart contracts that the applications themselves can interact with on kind of various chains where they exist. So we would deploy a piece of the infrastructure on Ethereum. So an

Ethereum DEX could interact with that smart contract. Then to connect the two, we would use a crosschain message passing protocol or data transfer protocol. You'll know this stuff as like um you know similar to like layer zero or um Axelr or you know WCain does the same thing. of this type of infrastructure to connect the two the two pieces. And then as for fees, we decided actually it makes more sense to just charge the DAPs directly and then the DAP themselves can decide if they want to pass those fees on to their end users depending on the use case and depending on how big the fees are.

That's what we wanted to discover. Um so we built a a proof of concept. Uh we used the Wenin L1 blockchain. It's just a standard EVM chain quick and fast um as a source of truth. So we uploaded all this information I mentioned, the OFAC list, the sanctioned entities, etc. Then we used um crosschain message passing protocol. Ours in-house one is called export. So we just use that. But it would work the same way if you used a layer zero or or or a chain link or whatever you wanted to do for this piece. It's just to connect the two uh the two chains, the source of truth blockchain and all the application layer blockchains. And then we deployed everything as we kind of desri described in the previous slide. Um this is kind of a little bit more detail about the the transaction flow, how it

works. Um, basically this would be just like a standard um, USDT on Ethereum to BNB chain um, crosschain transaction. Then it would go through an application layer, some transaction on the source network. And when you get to about this piece, this is kind of a new piece. Right now, you just go jump to the red and come back, confirm stuff on the target chain. We add a little component here where the messaging layer sends the addresses, the sort the the kind of sending address and the receiving address. Compare them to the lists on the intermediary network. this is the source of truth blockchain. It will return a response. It says okay yes it's on the list or no it's not on the list.

If it's not on the list then move on to the standard transaction flow and complete the crosschain swap. Um and the results were uh you know quite um encouraging. Um this is less important for de developers but just to deploy this infrastructure was actually um quite cheap. You'll see a link here with much more kind of technical detail for those who are interested. But the um the the initial setup was very reasonable in terms of cost and more importantly, you know, these OFAC lists and these sanctioned lists, these all exist on just like random websites that government entities put up. They don't do anything on chain themselves yet, but they do update from time to time, you know, as they discover kind of more um addresses that belong to North Korea.

It's almost always North Korea, but they that uh they kind of add um addresses over time. So, you have to make sure that you're keeping these up to date. So to update um these lists on chains, we had to consider that cost as well. But again, we're talking, you know, pennies uh very very very reasonable, especially once you're past that initial setup. And then more importantly for um applications, they have to call these gateway contracts on the chain on which they're operating. And we have to make sure that this is a reasonable cost to kind of go pay the gas fee and then get that response once you've done the comparison of the different lists. And again uh depending on the chain of course the ch the price is a little different but very very reasonable from fractions of a cent per per attempt to

um to a few cents. So this is the type of you know it's at the scale now where you could as an application add a penny to the the fee that the user is paying and you know this is not really going to create the type of friction that's going to be a deal breaker. So we're in a kind of very oper kind of very reasonable range here. Not saying the whole thing's perfect, you know, this is just a proof of concept, but it's really just to demonstrate that we can build these types of AML compliance systems and kind of host it maximally onchain rather than just throwing our hands up and being like, we're just going to use centralized offchain services. So, just as a final thought as I'm wrapping up here, um just kind of a word of caution, I would say, you know,

sometimes talking about these topics, especially in DeFi and decentralized protocols, it's a little uncomfortable. It doesn't feel like what we signed up for. But, you know, if we only rely on these offchain tools, I think we're really going to risk centralizing all of blockchain in a way that we're not comfortable with, especially if the goal here is still mainstream adoption of blockchain technology. Sure, you could do kind of niche applications and keep it 100% decentralized. But if you kind of want the world to run on blockchain, these are kind of the types of compromises that we're going to have to make. Um, but you know, I don't think we want to get into a situation where people are telling us how to how to do this. If someone else comes in who's not kind of a blockchain native and they tell us, okay, here's kind of here's

exactly how you have to do this AML stuff, this compliance stuff, it might not be palatable to what we want. So, it'll be better if we take a proactive approach and kind of demonstrate that we're taking these issues seriously. We're building the infrastructure onchain and as decentralized a way as possible because to be honest I think in 2025 um the kind of days where we protocols and builders can just say that well we're decentralized and other stuff is my problem. I I it's not my I'm not policing it's totally permissionless. You know this is just not realistic anymore. Um again assuming you want mainstream adoption. And so if we want blockchain technology to actually be used in the quote unquote real world, um let's get proactive and let's make sure

that everything is compliant. Thank you.