EB130 – Erik Voorhees: Fooling The Fox - The Story Of The Shapeshift Hack

Transcript

this episode of epicenter Bitcoin is brought to you by hide me protect yourself against hackers and safeguard your identity online with a first-class VPN go to hide me slash epicenter and sign up for a free account today hi welcome to epicenter Bitcoin the show which talks about the technologies projects with people driving decentralization and the global cryptocurrency revolution my name is sitting with you and my name is ben hi ben Crane we're here today with Erik Voorhees or he's probably most people have heard of and he's of course the founder of shape-shift to longtime podcast listeners will know very well cuz there were a long time and one of the first sponsors of the show and he's

been well known in the industry for being involved in Bitcoin very early on being a sort of a very great advocate for Bitcoin and and also for libertarianism and and sort of Bitcoin and libertarianism so I thanks so much for joining us Eric thanks for having me on the show today it's sort of coincidental that like you are like right now because we I think we invited you before but then there's all this news around shape-shift and so recently we've been yeah a big a big story around you guys getting hacked can you talk a little bit about what happened there yeah so about see how we can have for two weeks ago we put out basically the

all the details of what happened and I wrote up a like 15 page piece about the whole the whole story from start to finish because it's quite which by I mean it was a great story by the way and I am NOT one to read really long blog posts but I read this one and was just I couldn't stop reading it it was really fascinating the way you it reads like a it reads like some kind of novel you know yeah well I when I I sat down and decided to write about what happened I thought it might be like four or five pages and I got through four or five pages just you know talking about the first incident so basically what happened we brought on a guy to be our our head

sysadmin basically our head of security our server DevOps person because we knew that as we were growing we needed both you know to start scaling larger and also to be more secure because we're handling cryptocurrency and so that was all fine but about a little a month and a half ago in middle of March March 14th we we wake up and discover that 315 Bitcoin had been stolen from our hot wallet and it's important to mention that none of the funds that were lost for customer money because we don't hold any customer money but it was it was our money and that's still a lot of funds so

we we started investigating right away we were we were pretty upset and confused about what had happened and within a couple hours we realized that it was actually stolen by an employee and the very employee who we had hired to to set up all the servers safely in VR our sysadmin so um we there were a number of smoking guns but the biggest one was that while we were while we were in the office trying to figure everything out investigating we see in the logs he deleted the keys that had accessed the server where the coins were

restored that morning so while we're all sitting there he's deleting keys and then he left during sort of the middle of the afternoon said he got a call from his mother to take her to the hospital and he had to leave we we have been getting very suspicious by that point and so we didn't try to stop him because we kind of wanted to start working without him near us and as soon as he left you know I was told about what we'd seen them logs so basically we never saw him again and we knew that he did it and the Bitcoin hadn't left the address that he stole it to it's still there the address is shown in the blog post people can go see but

um the big boys are still there today yep yeah we we have a quite a few notifications set up if funds ever moved from that address so we since we since we caught him so quickly we knew where he was we had a lot of his personal information and the funds hadn't moved we we thought okay fine we'll we'll proceed with a the case against him we'll get the funds back one way or another but basically it's it's fine and case closed but then about that we were working on brand-new infrastructure because we assumed that the stuff he had been working on for us was was largely compromised so we had to divert you know lots of our resources into rebuilding things and a couple weeks later as we're

getting ready to launch that new infrastructure the hot wallace in that new infrastructure got bitcoin litecoin and etherium stolen from them and this was April 7th it was a Thursday so again just like a terrible feeling of dread and panic and what the hell happened obviously this former employee wasn't with us we we saw no immediate evidence that he was involved of course he was on the top of our concern list but we we tracked some of the some of the coins that were stolen to an exchange we got information about the account holder at that exchange this is one part of the

story where I thought was sort of interesting so you you contacted is this exchange and they just hand it over the the information of the account the question they don't just hand over information but if you show a direct link of your coins leaving your hot wallet and going into a wall to they control and they know who you are and they trust you then then yeah it's not just gonna proceed on unimpeded so a lot of the exchanges work with each other on these theft cases and sometimes they can find out quite a bit of information so got we got basically the account details of this guy his name was ravi on and we assumed it was all fake information but

there was an email there and I contacted the email and I I said nice job on the hack how'd you do it basically just trying to see if he would you know want to boast and give some details on what he had done and the next day we had taken the site down we're trying to figure out what had happened and rebuild again in a wholly new infrastructure once again and it was just a horrible like panic mode situation and we get I get an email back the next day from the guy and to my question how he did it he responded with the email saying just quote unquote one word Bob and Bob is the pseudonym we're giving to the it's a a former employee so when we got that

email it was just one of those like holy [ __ ] moments and the first like okay does that mean that the hacker is his bob but that didn't seem likely because that would mean just he's implicating himself in the prior hack even further so then we we started realizing that like would it probably meant was that Bob had sold our information or giving it away online to some hacker who had used that to infiltrate and get in and carry out another hack so um I tried to chat with him and just get some more details in the meantime you know the next day we got the site back up on holy new infrastructure with with brand new keys and like should have been as safe

as could be and this would have been Saturday April 9th and then that morning we're hacked again and more Bitcoin and aetherium stolen from Pablo on this new infrastructure and this was boggling our minds because we we were not we're not sharing any any keys these were fresh wallets created on the new servers there should not have been any any way for these to happen so just just to sort of explain like you're building this new infrastructure of course all your employees I mean all your employees but some of your employees strategic ones have SSH keys to to get onto this infrastructure I mean we're not talking about you know

Bitcoin wallet probably keys here we're talking about SSH keys to connect your servers yeah but new anymore these new keys yeah I mean you're generating new wallet keys but if you're generating you keys what what's where you're being confused as like how is he getting these news keys if right Bob's no longer here and how is he accessing the server that were only were the only ones that were supposed to have access to exactly it was very confusing and so immediately I decided to bring the big guns like cold Michael berkland at at Ledger labs they're a blockchain forensics company and Michael's fantastic I highly recommend him he he flew out right away

and we started investigating site was down for for several days about 10 days total after it was all said and done but during during all the investigation we found a number of things we found that the guy had deleted a bunch of logs we actually recovered a bunch of the logs in empty disk space which was just pure luck because it just meant that the bits hadn't been overwritten so that was all helpful when we started piecing together a lot of things we found the malware that had been installed it it gave a backdoor to to hack the funds and that same malware was found on both the infrastructure on that April 7th and the infrastructure on April 9th was Chris

holes a wholly new infrastructure which said the third hack was used this their attack was also by involved because he had these we are you know we know that the first hack was by Bob and then the second hack the hacker said that bob was responsible and this and the third hack was also done by the second hacker so there basically there are two people that are relevant bob was the employee in the first hack and then Rovi on who was the hacker on April 7th and the same hacker on people ninth and he sent me a smiley face email like two minutes after the the hack on the ninth just being a dick but uh so anyway I ended up having some

chats with Ravi on he he parked popped into our public slack and we we talked just over chat the first chat was was light on details but it gave us he basically said that he had bought information about how to to break in from Bob so that config was he was late was he like on the Republic like slack channels or just was talking him into public slack channel but it was a p.m. between him and me okay i'ma slack so are you able to a slack able to help effect I was he using some like tour or something like that you don't know we're pursuing all leads so I won't get into that

yeah but I okay Wow unlike unlike Club Row V on Bob was Bob eat a lot of really stupid mistake trophy on seemed to be a little more sophisticated so I wouldn't be surprised if he was fairly well hidden we still know some things about him out and we're finding out more but basically the first chat with him was was light on details the second chat with him was because he came back to me unlike the Wednesday following the second hack or the third hack and he asked if he could exchange the etherium that he had stolen for Bitcoin because we were tracking some of the etherium and it could have gotten frozen at

several accounts so he had been trying to convert his aetherium into into Bitcoin it was getting stuck at the exchanges in frozen so he comes back to me and asked if I will exchange the etherium that he took or for Bitcoin so I feel like me yes me fairly well connected with exchanges like the this is like some exchange mailing lists where you just like send an email and all the exchanges like they have this Laurie have this personal more person isn't a dime you know obviously I know a lot of the exchange operators well there's - and they all have an interest stopping you know legitimate crime and fraud and theft some of them really like

kind of diving into these investigations and trying to find these people because these thieves like have have really poisoned the entire industry continually it's like a constant problem and you know for those for those who don't tend to rely on government quote-unquote services to to help stop these things because they generally don't what that requires is that industry participants step up and figure it out themselves so there's a lot of that because I'm he gets back to you and now offers proposes that you you buy back this is very important yeah a market rate so we wouldn't lose any value from it we just be converting

one corn for another which ironically is what we do for business so I was like well okay but you need to tell us a lot more details about how this all happened and and he did so and basically in that conversation he revealed that he got he was sold ssh keys he was sold IP addresses of servers he was sold IP addresses of the land passwords to routers and on the local network and most importantly bob had installed like a not a back door is not the right word but a remote access and a remote access terminal on on one or more of of our

employees computers Wow I guess like our VNC II or some like that remote desktop Dan mode editing right while he was here so so which means that when he stole the money on March 14th it wasn't just a quick like opportunistic oh there's some funds I'm going to take it he he basically set up a whole bunch of of of malicious you know software in the network and then used and then stole the funds and then used all that malicious stuff to sell and get more money from other from other people so he to our computers so he sold him just so we can understand maybe how so he sold him access to IPS

your server IP C or your router in your office and ax and admin access to those routers and then installed VPN software so basically the guy that Rho V on he he gets into your local network can connect to a VNC like actually like he's sitting behind the desk one of your employees desks looking at the computer and then with this SSH keys can login to into the into the infrastructure that's that's really fascinating and so the one thing I didn't quite understand is at what point that Bob and ro V on like crossed paths

like who was the initiator was it ro V on that contacted Bob or was a bob that sold that sucks went to seek out ro v on so where Rho V unsaid and of course like he he's a hacker here and we don't trust him so we have to take everything he says with a grain of salt but what he said is that he learned of the of the hack that Bob had done a he contacted Bob and offered to buy the information and then Bob lives in solitude he showed us an email from Bob basically stating that he had received the funds and he in that email was the IP addresses and the passwords and stuff that only someone in this office would have known all that

kind of thing how would how would Rho V on learn about Bob's hack we run clear on that we have a couple suspicions but I we think we know how but we haven't given out that detail let's take a short break to talk about hi dot me look when you're choosing a VPN provider you want to make sure that your privacy is protected you know if a government agency tries to force the VPN provider to hand over some of your traffic or bent or browsing information will they be able to do that and is your payment information attached to the account these are all things that you want to consider when choosing a VPN provider would hide me all that's taken care of

for starters they're based in Malaysia and Malaysian laws don't require them to keep any logs in fact I got me has no logs of your traffic or browsing history so even if a government agency was trying to force them to hand over some information they would be straight out of luck because Hidemi has nothing to give them in addition to that they use a third party party payment provider which doesn't give them any of your payment information so they'd have they have no way to link an account to like a credit card or a PayPal account so even if you're paying with PayPal or credit card there's no way for hide not me to know which account paid for what and of course if you're paying with Bitcoin then you're completely transparent and so what we suggest is if you're creating an account with hi dummy if you want

that extra level of privacy just make a fake gmail address and use that to sign in so that way you're completely anonymous you can give high tamiya try with their free plan their free plan includes two gigabytes of data at on throttled bandwidth you can use any of their free exit nodes which are in Amsterdam in Singapore and in Montreal and you can sign up for that at height me slash epicenter now if you use our URL and if you decide to go premium down the line it's gonna get you 35% off and the premium plan gives you a lot it gives you unlimited data you can use as much as you want you can connect up to five devices so your whole household fits on the plan and you can use any of

their exit nodes all over the world and they've got like 30 of them and of course you can pay with Bitcoin so give it a try we would like to thank hi to me for their support of Epson and Bitcoin so let's say now row being bought from Bob this information do these people use escrow in any way or like how does that work or exchange the Bitcoin for the ether yeah trust it's an interesting kind of social problem when two people they don't trust each other are trying to exchange and you're trying to try to be quick like you don't want to set up an escrow account with some third party over time so when he wanted to convert the etherium to Bitcoin obviously we can't

just send him a huge chunk of Bitcoin and then expect him to send it giving back to us so essentially what you do is you just break it into little pieces and one person goes first and sends a small amount and the other person sends a small amount you just do that over and over and it's tedious but it works and you know interestingly like there were there's a period where we were sending a bunch of the little pieces of Bitcoin and he was sending the etherium to us and the Bitcoin wasn't confirming because all the blocks were full and so there was like a period of just well about an hour where blocks had happened and the transactions that that I had sent to him weren't confirming and he started getting really suspicious like

that I was trying to double spend him or something and so it then we had to wait and we just kind of sat there awkwardly for about 20 or 30 minutes until a block finally came her along that confirmed those so that was the I mean him and I were joking about the block size thing it must be so weird to like you must be so angry and upset at this person you just but on the other hand you're having some sort of really casual conversation with them about how they just stole the thousands I mean it was thousands it wasn't really it wasn't really casual but there was just a brief moment of levity during that period because he he

started suspecting me of double spending him and then all came through fine it was okay but obviously he was an enemy and someone who I who I detest but at the same time he was giving us useful information that that we needed about you know the the true villain in this case which was Bob which essentially you know betrayed us completely and the hacker Rovi on he made this this funny statement toward the end that he had said after we did our exchange he didn't want to have any more communication and then at the end he said actually I know I said that but I do want you to tell me when when Bob's been arrested or sued or whatever

because stealing from your employer is really shitty and so like even the hacker was pretty dismayed about Bob's character and behavior in this whole thing okay and so I mean you've been back up now for a couple weeks I think yeah two weeks I think at the end of okay we can have so you might say I think I was checking around that time so used to first started with etherium and then you brought on some other coins and now I'd like your back up to the 50 or so poins that not fifty we so at our max we had like 45 coins we have about 25 at this point so we're adding writing them chunk by chunk each coin has its own

little awkward behavioral issues and in the new infrastructure that we set up we locked it down to such a degree that like every little piece takes a lot of work to make it connect and operate properly so trying to get the coins on as fast as we can but most of the big important ones are back online already and how much money did you lose in total like including like revenues lost from this whole thing being gone for ten days or whatever the amount that was directly hacked was was probably a little under a quarter million dollars over three hacks and lost revenues I mean at least another at least another fifty thousand

and then you know everything from like reputational damage and lost customers and just all that I don't know how to put a figure on that but then there's the cost of of all the security auditing which is ridiculously expensive to do it well and to have good people doing it and then you know all the lawyer fees and just the opportunity cost of all the engineers being diverted from productive work into scrambling to build secure infrastructure in sort of panic mode for for a period of time it's a huge a huge loss in terms of money and time and

resources and just psychologically it's incredibly difficult and defeating to go through multiple hacks like that over time but the I was very impressed with the team they they totally rallied behind the mission and put in ridiculous hours to make sure that we'd be back up and safe and I got to say I mean I was impressed by the level of support that you got from the community and that was really like on Reddit and on your slack and I barely saw any negative comments sort of like people just you know just rooting for you to get through it and you know like bashing this hacker Bob

and that was really encouraging as well it was very encouraging and I got a lot of really nice emails and calls from people who were just there to offer their support and sympathy and to say that you know they had been through similar things and that they understood how horrible it was so that that was really helpful but of course a lot of people really liked how transparent we were being and so we got a lot of praise for that and a lot of goodwill absolutely but fundamentally I think the reason that the response was so positive and supportive of us was because no customer money got lost you know not a dollar of customer funds was was ever at risk or lost in the hack and I think it showed the community that like an exchange built in a certain way can be

hacked in this case three times by an insider you know that had like all the information and connection to do whatever you wanted and still even in that case not a single dollar of customer money is lost and for an industry that has been plagued with this kind of thing since since the beginning I think that was a relief for a lot of people to feel and and while I theoretically understood that like that was a great advantage of shape-shift this made it very real and I can't imagine having to go through this and also having lost you know 10 or 20 or hundred million dollars of customer money so we've how the infrastructure is now do you feel like this could happen again if it's an insider because I mean this is it I guess it's one thing to protect

from the outsider but when you have an insider that's such a yeah in serious threat what happened what happened could not happen again even if there was an insider so we've we've tried to harden it from many angles to to prevent the same thing from happening again but also anything else that could possibly be fattened and security can never be 100 percent and you can spend an infinite sum of money trying to become infinitely secure which is impossible but we I'm pretty impressed with what we've built it's it's been amazing to see some of the technologies that we've employed to make this kind of thing not able to happen again and it was things that we

that we should have done eventually anyway of course yeah that's the thing right I mean when you're building a start-up enough of course like you know you guys have been around for a while you've especially around security a lot of times it feels like you know like this is something we have to do and we'll do it at some point it's important that we do it but you know then you're caught off guard by something like this yeah you know obviously it could be you know this was an extreme case of that happening but so just to come back to the infrastructure built so I presume that you're you're hot wallets weren't multi-sig they they weren't but that

wouldn't have prevented what happened what we've done with him now will prevent it but a lot of the problem is that like much of the good way to store Bitcoin he's done putting in checks and balances so that when funds move they can't move without passing all those checks multistate being one check of number that you can use and often those kind of checks start getting in the way of automation and so you get into the system are you trying to you're trying to find the right balance between something that's automated and scalable and can handle lots of you know customer orders without delaying them because our whole our whole enterprise is built to make

exchange easy and fast for people so if we clog it all up with a bunch of security checks that starts defeating the point but at the same time yeah you can't just let things flow through without watching what it's doing so it's a very tricky balance and there's now that it's not a perfect answer it's just a process of learning so what's your takeaway from this like what did you what's a lesson a few lessons what the most important theme is most people understand how dangerous you know hackers can be from the outside and that they're this world of hackers out there that'll get you if they can and so people try to protect themselves from the the outside and they often do a

pretty decent job of that but the threat from inside the threat from an internal employee someone who's closed through social engineering or anything in that realm has to be understood as an equal threat just just as powerful and dangerous and while most people put a lot of effort into protecting from the outside they they put minimal efforts into protecting from the inside and that that was the most important lesson that we learned is to treat the two those two realms as equal threats because you can hire a hundred people and 99 percent of them can be angels but one person can can totally screw it up for everything and it's impossible to it's impossible to know the character intent and intentions of everyone all the time yeah

cool I until maybe one last question on this is there any kind of takeaway about how you would deal with that threat in the future because it means one thing to understand that it's another thing to do something about it and prevent it from having an impact on the business right yeah well the lowest hanging fruit is making sure the computers are always locked when you're not next to it so what we think happened in our case is that like Bob found computers at the office that were open and install things on them and how he did it may have been pretty sneaky because again he was our persist admin

guy right so when your sysadmin guy like says he needs to do something you're usually inclined to trust him but I think in this case he actually just went to open computers and install things and if that's like if you go to the if you go to the bathroom during the day just turn your your screen off and make sure it's locked like it's it's super easy it takes two seconds to do and it can in this in this case we think it would have prevented all or at least latter two of the hacks and you know after I read that that blog post like immediately the next day I would I went to the office and I told my co-founders okay you know we need to do security

audit we're about to launch a beta where you know of course we don't hold any funds except for maybe like you know a little bit of funds to pay for Bitcoin transactions but because we you know we do a completely different type of thing but but regardless of that in this industry it feels that you can you know it's pretty easy for people to have a grudge on you and to be sort of on yeah so for a startup that perhaps doesn't have a whole lot of funding and and you know it doesn't have like a hundred thousand dollars to put in to invest in a security audit with ledger labs for

instance what what kind of things you suggest that a really important that they do except for just locking computers yeah well or is it worth that investment like is it you know the money for the record I didn't cost quite that much with them but it was pretty expensive anyway I mean it's often just proportional and one of our one of our mistakes was that like when the shape-shift got started you know I sort of had in my mind like our security doesn't really matter much at all because we're only holding you know 10k and crypto currencies in these various hot wallets and that was probably a true statement back then when we were getting started but growth growth happens and it's kind of

like the the frog in the boiling pot situation and before we knew it we're not we're not storing 10 K we're storing you know a few hundred K of still our funds not customer money but still a you know at that point we needed to we need to see that that had happened and reassessed our security and taking steps before this hack to to make that more secure so that was that was wholly my my mistake it doesn't mean that a startup should spend 100 grand on on security right when they're getting started that's it's probably a bad business decision but it doesn't mean that there's probably a point at which you need to spend that much to do it and you know if we had done that before it

sounds expensive but it would have saved us a lot of money in this case today's magic where it is Bob b.o.b ed over let's talk Bitcoin comm to sign in enter the magic word and claim your part of listener award where do you see the company and and kind of the ecosystem let's say five years from now what's shape-shift going to look like so shapeshifter will look very similar and that it's always and forever going to be in exchange for digital assets an engine to convert between any blockchain asset

to any other and so as the world of blockchain assets becomes richer and more intricate shape-shift will have more and more roles to fill for various parties but um I think the the rise of aetherium has has shown that it's unlikely that we're gonna live in a world with just one blotching asset you know being Bitcoin and that was that was my hunch when I got started was that Bitcoin may forever be the the biggest cryptocurrency used or the biggest most important blockchain but these software systems are are so intricate enough that that they will have uses for different things and in each each blockchain is not going to be appropriate for

every other application the Bitcoin blockchain is not appropriate for every application and so that that means there will be lots of these tokens and we're seeing lots of new tokens be built on top of a theory in mail so we have like the the digits gold token that was just released we have the augur reputation token that's coming out and all these things are built not to be competing monies with Bitcoin but they are valuable blockchain tokens and so shape-shift is here to help this industry be able to convert any of those tokens into any other one without any friction whatsoever so that brings up an interesting topic right here iam so when you have assets that about running like on top of other blockchain let's say you

want to trade some hume acid for ether or in a different hue method this shapes you still have a role in that and it is that a different role than from for example just trading Bitcoin for ether we're pretty agnostic when it comes to which tokens there are and how they're constructed we just we just know that there will always need to be a way to convert between them easily and because they are assets that have monetary value it means there are lots of issues surrounding liquidity in exchange and you know that that's the kind of thing that can't necessarily just be

programmed so shape shifters is in many ways a service for the exchange of those things so you mean if you have you because it would be possible to do let's say for example a decentralized exchange with you know let's say some human token in ether but then the issue might be you may not have liquidity there so it might still be better to use shape-shift that leverages some other exchange yeah I mean and I'm a fan of decentralized exchanges I'm glad to see them growing we we also will use them because we plug into every exchange so the more exchanges out there in the world the

better our pricing becomes and the more liquid we become as well but a lot of those a lot of those trustless decentralized exchanges have sort of a capital cost which is that you have to put up escrow funds in order to hold balances or or trade with people and so that that means that they're in in one dimension it is less efficient to trade that way because you're putting up sometimes double the capital per per trade that you need to do and when you're talking about a small order that that's not a big deal but when you're talking about like industrial size financial operations that starts to become a little unrealistic so so shape shifts you know tries to provide the fastest

and easiest way and probably the most capital efficient way as well okay that's it that's very interesting we've 50 cent receipt changes do you think that those problems are gonna be solved or do you think they will always have these kind of disadvantage is supposed to centralized exchanges I'm not sure I I think as with many things in this industry decentralization is a really important goal and a fundamental principle of what everyone's building but not everything should always be decentralized all the time it had decentralization comes with a certain set of features and costs to it which are often great and solve certain problems but sometimes caused because

others and I think that the blockchain world is going to be nuanced enough that that there are going to be different types of services for different people just as just as the interest in the Internet industry doesn't have just one company you know that it runs everything there's a lot of different use cases for different things and so it'll be a healthy ecosystem and a lot of these tools help each other out so you know as I was saying other exchanges provide us liquidity and they they help make us better I think the fact that aetherium exists is good for Bitcoin I think it makes Bitcoin stronger and I think Bitcoin makes aetherium stronger and people are too quick to jump to to seeing all these things as competitors and there can only be one when in

reality the ecosystem I think will be very very rich and dynamic so another question that kind of goes into the you know a little bit for the future right so now we have here mm and all kinds of small contract chains right so interactions between different block teens might start to look a little bit different than simply moving a token around and you may have more complex type of interactions or contracts interacting with each other are you thinking about the impact that will have on shape-shift and if whether shape-shift will also be able to play a role in there yeah sort of in the same way that we're kind agnostic world we're

also technology agnostic so the way that this whole industry evolves into the future I think is going to be unpredictable there's no way to figure it all out today so part you know part of what we're building is a brand that people know like if I need to change one asset into another easily change just the way to do it the specific technology that shape-shifts using today is probably not the same that it's going to be using in five years and that's fine it doesn't matter to a user that's all things that are our companies to work on to always stay competitive and always be building things that are that are fundamentally useful to people in in that in that vein we have a cool new exchange that we're building right now

which isn't isn't known about yet but which people will see later this year and I think it'll demonstrate that principle can you talk about your product roadmap what extent are you willing to talk about some of the things that that you're working on or that have having the pipe sure I don't I don't want to discuss it publicly without you know getting the the pass from our our team but suffice to say there are there's certain ways of trading that are needed for large scale operators and people who care a lot about price and so we're building a tool to allow that

without without leaving our principles of non custody so I know that's a big answer and not helpful but we'll we'll let you guys know as soon as we're ready to talk about it yeah I think that was the definition of they answer thank you very much yeah no but what you mentioned which I thought was you know right honest is that you know in terms of branding I think that you guys have been extremely successful at just really building that brand of like shape-shift is the one place where you can really simply and easily convert your coins from one to the other and I mean we've said this many times on this show as as a past sponsor and and so you know you really like good good job for

for building that trust and not only the branding but also being it build it sort of building trust in the ecosystem it's not easy and I think you're one of the companies in the Bitcoin space that really stands out in this regard yeah hopefully a lot of that just comes from like the customer service angle this is another one of those things that like a decentralized exchange is always going to have problems with because to grow you need to bring on new people and that necessarily means people who have not used the system before who are not experts who have not read white papers on how things work and those people often need to have their hands held to one degree or another and one of the principles that I think is really

important for those industries to understand is that it will only grow to the extent that we make crypto stuff easy for people and that means you know being able to chat with them and walk them through these these tools that they're learning this technology and these processes won't be ubiquitous for the next you know for the next ten years and that means there's gonna be a lot of work that has to be done just to just to help people walk through it and so regarding the product right now like I'm on their website so you've got a couple of tools maybe focus on those four I mean a lot of our listeners will know but like lens extension the shifty button the skeleton plugin and all that stuff specifically regarding the API what are the most common use cases that

people are using the API except for like the obvious one which is having a shape shift button on your in your and your you know wallet that you know allows you there really easily exchange coins from one to another I think that as as as the world of as the multi token world proceeds lots of wallets and services will just by their nature support many tokens and for any customer that is using that service they should be able to just snap their finger and turn one into the other they they should not have to withdraw one send it to an exchange sign up with that

exchange account wait for the deposit to clear putting that and ask a bid order wait for the it to be withdrawn and then send it back to where they came from that's that's a horrible user experience and so everything that has digital asset tokens in the future should allow immediate conversion without friction between them that should be sort of a principle of the industry that all these things are immediately liquid into each other and so to do that you can you can plug in the shape shift API and have that ready to go immediately that's what we're building and so that makes me think of something so one of the use cases that often gets thrown around and in the blockchain space is fidelity

points and when you know one one way in which block chains can help sort of optimize the way a fidelity point systems are built is by providing more transparency etc but one of the things that people keep touting and I don't know if this is actually ever gonna come to fruition is creating a liquid market for fertility points where you can trade one type of fidelity points for another not sure if there's any incentive for brands to do that do you see that as one potential use case for shape shift we're like brands and companies start issuing their asset and yeah but like where do you see that going generally yeah we and we've we've played around with this idea before I think another another way that can look is is with like access keys to

an inclusive group so so shape shift has some number of users I mean I guess we don't even know how many users we have by our by our nature but let's say we want to create a suite of special features and release 10,000 keys for those special features normally you would sell those like as licenses to single people but then those people are stuck with them and when they buy it they're like okay if I buy this hundred-dollar thing I'm spending $100 and I won't ever get that back so is it worth $100 if you tokenize at all and and make it liquid then if you buy the hundred dollar access key you know that it will have a resale value and a very easy liquid

resale value you don't have to like post them on Craigslist and hope someone in your area will buy it for 30 percent of its value you'll know that it you'll be always be able to check the price and you may well be able to sell it for more than you bought it for if the if the service is growing so it offers a whole new way for people to engage with a company who and and a way to sell information that is both better for the company because they can bring in revenue but also better for the buyer of that information because when they're done meeting that information they can sell the rights onward to someone else in a very easy liquid way I think that is going to be a huge use case of blockchain assets but no one's doing it yet so you've been involved in in the

cryptocurrency space for a long time and also quite experienced as an entrepreneur now having started a whole bunch of projects now if you if you were to start something today or what what area would you look at there's a couple ideas that I won't mention because I I may invest in them elsewhere but someone still needs to build a way to go long or short any cryptocurrency immediately by just depositing Bitcoin so basically a website where you if you have ten Bitcoin you can deposit that with that company and then go long or short any any crypto asset that you want something

very easy with an easy user interface so that just just by because there's there's so much there's so much hatred and anger for a lot of these altcoins people throwing out you know insults on reddit forums about a certain asset they should be able to short that asset they I'm a big fan of putting your money where your mouth is and if you make a service that's easy enough for people to do that then you don't need to argue about which assets are valuable and which are frauds if you know that if a certain asset is a scam you go short the hell out of it and you'll make a bunch of money doing so and that both brings honesty to the industry and also I think would be a just a really cool

demonstration of the flexibility of Bitcoin so if I wasn't doing shape-shift right now that's one idea that I might pursue and someone needs to do it wouldn't that be something that would be natural for you guys to build as well since you already have all the connections 50 changes and you offer something that's somewhat similar yeah I mean don't think we haven't thought about building it but we have a list of like 20 20 big projects that we want to work on so I don't I don't mind sharing that one with the community and it may well be something that someone can build and then use shape-shift for the backend to to acquire or personal assets easily and and what else are there some other

areas where you feel like there's a lot of really exciting innovation happening and a lot of opportunities sort of in the blockchain space um yeah another area that's really it's gonna take off but it's mostly stymied I think by US regulation is in I don't know if there's a good term for it yet but but imagine like a new artist a new songwriter who has their their fans right and those fans are super dedicated and the fans know that this artist is gonna be big in the future but the artist doesn't want to sign up with a big record label and you can go through all that stuff there should be a way that that fans of a small project can buy for lack of a better word equity in the future success

of that project so let's imagine Taylor Swift is just getting started and she releases 10,000 Taylor Swift tokens in her early days to her fans and then promises that like future revenue from her from her work will be paid out to those tokens very much like investing in a business that that would be huge because people who know the artist is really good we'd love to both support them financially but also then reap the rewards if they're if they're right about that and I this this idea came to me because my my wife Michele she's always she always knows artists are gonna be big like two or three years out and she'll have songs that are playing

and she'll say that this person's gonna be huge and I've seen this like twenty or thirty times where the artists a few years later is really big and if she could invest in those people I mean she she'd be a multi-millionaire by now and there's no way to do it and it would help the artists it would help the users it would it would be really cool but I think largely like US securities regulation is gonna prevent that so I I don't imagine that's an innovation that will happen in the US but it absolutely will happen somewhere in the world I I feel like you know maybe a year or two ago people sort of trying to experiment with this using things like counterparty or a mostly counterparty I guess but what remains complicated is like anything in cryptocurrencies you you

have friction between the fiat world and the cryptocurrency world because you need you I would assume you would need cryptocurrencies apply those types of tokens so we're not I mean imagine if it's artist has a concert and can just get give away or sell you know cards to represent space in that person um the friction of the the star doesn't mean to be anything significant you can imagine them selling you know the the Taylor Swift shares for for ten dollars a piece and that could be done in Fiat at a at a concert the the double spend risk of a fan you know acquiring a share before it's worth a lot is I think low enough that it would be completely doable but

yeah I think you guys a mess in that there was a quite a few things around that exploring that I think swarm was was just going in that direction as well and and then hadn't really mean some of the ideas there but it's it's a I totally agree with you that it's a huge potential problem but it's also kind of a a lot of things have to come together user experience is going to be a mass of issue besides besides the regulations for sure right and in the big case of this this goes back to the whole crowdfunding phenomenon which has gotten big and and it's it almost goes against economic theory when when like people wouldn't contribute or invests in an

early-stage company but they would simply donate to it it's strange because in one you you may get a big return and then the other you you won't get any return but the better way to think of it as you're getting a certain return in sentiment or in goodwill or something but with the oculus everyone remembers it was like one of the first big crowdfunding successes and all these people contributed money to that project and they got like a t-shirt or maybe a free oculus out of it and oculus went on to become acquired by Facebook for like billions of dollars none of that money went to any of the people who originally contributed in the crowdfunding campaign

I think that I think that's terrible I mean I think those early backers should have should have made huge returns on that contribution but largely because of securities rules the company can't offer you potential returns they can only offer you zero returns that's essentially what the regulation has mandated so crowdfunding in general that whole industry is growing really fast and I think if it could be tokenized and people could get an actual share of the future revenue of something in an easy frictionless way not something we are signing investment documents you know and hiring a lawyer to do due diligence but just if you have twenty dollars and you like a project you should be able to turn that twenty

dollars into a hundred dollars if two years later that project was a success it seems like something that's very possible now with this frictionless payments but again not not in us yeah absolutely so another interesting question about kind of fewer perspectives and views on on the ecosystem Bitcoin blockchain do you feel like there are some things that people aren't seeing clearly today and kind of people have the wrong convictions and beliefs in the industry the biggest area where people have wrong convictions is in is in vilifying each other and on turning many opinions in the Bitcoin community into like a Red Team Blue team polarization

type thing the block size debate being the biggest example of this and it's been it's been really discouraging to see it because at this point has gotten to the extent that like I I was pretty disappointed with how for example Gavin was removed from his comment access due to the whole satoshi thing and I because basically the reasoning for removing him was that they thought he had been hacked and he within a couple hours came out and said he had not been hacked so what should have happened is the commit access was was granted again that should have been the end of it regardless of what one thinks about him or Satoshi or anything and so I made that point and and suddenly everyone starts thinking

that a I I must think I must be on the bandwagon that Craig Wright was Satoshi and be that I'm against core developers because I'm saying something in defense of Gavin on one specific point in one case and so you it almost like stifles all sorts of opinion because you can't say anything without the community the community pigeon holding you into a certain one team or the other and and it's gotten so ridiculous because I've I have classic supporters that think I'm just a shill for core and I've core supporters who think I'm a shill for classic and it's all a bunch of nonsense and I wish the community would realize it like the real enemies are still very much out there in a traditional

financial world and could be really nice if people would stop vilifying each other we're all essentially other core bitcoiners yeah I couldn't agree more I mean and I think that's been a really sad thing to see how to develop and just gotten worse and worse and worse do you think there is some hope here or do you see any way of that getting better I don't know I it's probably a psychological or sociological phenomenon it's the same reason that in the u.s. you have Democrats and Republicans and they are largely the same in how in how they view government and what they think government should be doing the the amount of difference they have is actually quite small between

them and yet each side thinks that the other is just the devil incarnate totally horrible and they don't it gives to the point where they don't debate policies or or a philosophy of politics and the role of government they talk about silly superficial things that that are the easiest way of vilifying each other and confirming their own suspicions that the other is the enemy and and I guess it's just a human phenomenon and so if so I don't I don't really think it can be fixed but it's probably incumbent on each person to just try to not let themselves fall into the false narrative that someone who disagrees with you it is automatically

an enemy and it automatically has bad intentions and all and all that kind of thing right and and I certainly agree if you I think if one looks at the u.s. then it seems pretty clear that also we have seen a complete disintegration of dialogue and discourse etc but the implications are interesting you know if you look at something like Bitcoin or cryptocurrencies in general which are these projects managed by a community a little bit like government or a nation in a way so if that's kind of the natural course of how these projects evolve that what would that mean there is an important difference which is that

anyone who is part of a country is essentially stuck in that country and with that government as a citizen the the friction to change your your tax farm is very high resonate in the Bitcoin and software open-source world it is really true that that you can work on a different project if you if you want and and and leave and it's there's no capture there so I think it allows in a much smaller time frame for a good feedback effect where if if the group is really going in the wrong direction people will move on to something else and and that's it's an important lesson because there are a number of

people and I think the Bitcoin community who believe Bitcoin is the only way that you can do digital currency it is the best it will forever be the best not because of its specific merits but just because that's the flag they wave and so they dismiss anyone who's trying to point out like concerns or or possible problems and if people become entrenched in that opinion then you really do run the project off off the rails and much of the community moves on to something else and then all those all those people are gonna wake up someday and say well what what the hell happened why did this fail is because they became isolated and didn't didn't try to listen to what other people were doing and all those

times they told him well if you don't like it just leave they actually just left that's yeah I don't want to see happen with biklen yeah I agree I mean one of my points of view has been and this is probably something that couldn't have been done when Bitcoin was created right because becomes like complex and off so you couldn't really find solution for these problems that would rise like six years later seven years later etc but I almost feel like you would need an explicit governance system where people could kind of vote on protocol changes and things like that because even even though the the friction to maybe leave bitcoins and go somewhere else this is

not that big it depends the right if you have a business bill on its very big and switch into a different version of the software is actually also quite difficult right because you so there is a huge kind of intrinsic thing where like you know core has by being the default choice that it makes actually really hard yeah there is there is friction but it's important not to overestimate that friction it's important not to assume that just because Bitcoin is the biggest and most important watching asset now that it will forever be it may be but it's not going to be because it is now it's going

to because it continues to become it continues to grow as the market needs it to grow if it doesn't if it doesn't move along with how than what the market needs then it will start to become marginalized and so it's important to be humble and realize that like Bitcoin is not perfect it should always people that are involved in it should always be listening and talking and just being polite to each other and trying to figure out you know a good way to move the project forward without becoming hostile and isolated because that's a really good recipe for project to become the project's die I mean it's not going to die because of a government it's gonna be died it's gonna die because the community itself poisons itself with with bad bad attitudes and bad behaviors toward each other the real

value of Bitcoin is the community behind it and so if that gets sick the technology won't be long behind yeah but having the government's behind all this you know the block size debate that's all so you know that's all good and everything and I think we can all agree that you know we need to be nice to each other and be humble but you know pragmatically what you feel where you feel you know government's needs to go to like what direction do we need to go in order to have you know proper governance around Bitcoin if we want this to continue to grow as an I mean I'm not sure I'm not a I'm not an expert on on the best way to govern large

groups and especially open source groups they're probably people in the open-source software world who have some good opinions on that kind of thing but unfortunately I I don't know so one last big topic you got involved in Bitcoin I think partially also from the coming from a libertarian background and it's pretty obvious to people I think the connection between Liberty you know choice having kind of you know control of your money and and Bitcoin right what do you see as the connection between maybe the larger concept of blockchain and liberty and libertarianism do you see a strong

connection there as well well the most fun connection is that like one of the one of the biggest and worst powers that states currently have is is the ability to create and control money and money is such a large part of everyone's life that the fact that that sits within the seat of government is uh is really dangerous and so like it my blog is called money and state and I often frame it as a as I frame Bitcoin as is the separation of money and state in the same way that that the church in the state were separated and everyone today understands why that was so important and agrees that it was good that that happened and yet will he give an even more important institution which is

money over to the government so Bitcoin is proving that free market money can work is proving the innovation the one of the coolest things to see is that the security and consumer protection that is getting built not by regulation but by companies in this industry building products to serve consumers and shape-shift is is an example of that so we we don't hold customer money and we don't take customer information and when we got hacked we didn't lose customer information and we didn't lose customer money so we protected both people's finances and their their personal identity and this is something that none

of the regulations seem to appreciate is that that the goals of regulation which are often noble which are protecting people and preventing crime an actual crime those things can be done without government being involved those things are can can spontaneously emerge out of market processes and it's a little new it's a nuanced argument that a lot of people don't appreciate because they always want this sort of top-down leader but the blockchain industry in general I think demonstrates that without a top-down leader order can still happen innovation happens much faster the system is much more resilience and flexible and ultimately it's it's more just well thanks so much no I think that's it that's a great note to end on

and I'm certainly excited to see where this all leads and what this world will look like cuz I think we'll look quite radically different with all these different projects and de-seed roll the evolving role the little blue shape-shift Fox is gonna take on and wear on all the places where it's gonna jump out at you in a future well I think thanks a lot for having me on the show today guys yeah thanks so much and and just one last thing so if he looked at Eric I mean we do want to point out that in the background there there is the bear whale I mean I saw that when he just went to the bathroom before and I was like I know that one we're good if you are if you're curious about that just google bear whale and and it was

quite a hilarious story I think we'll put yeah it was the artist who made that last name so after the bear well think shape-shift basically put out a bounty to see if some artists would we wanted to Commission some like artwork for the bear whale and the slaying of the bear whale back in fall of 2014 and we selected two of two of the best ones and this was one of them I think that table is the guy's name but if you go to shape-shift io / bear whale HTML the the whole story is there plus the other artwork there were so many great artists that they were also making bear well artwork this definitely one of the best

parts of the community is just all the all the jokes that people have with each other and the funny things that think it built on top of it the bear whale is I think gonna be a symbol in Bitcoin forever just like that just like the honey badger and the LP end and of course Dorian's lunch today as well yeah Andorian Dorian himself I mean he never ever be a symbol for the community okay well Eric thanks so much for coming on it was a pleasure finally meeting you and I like this as opposed to via email and talking about shapeshifter me too it's a really exciting project and we are you know excited to see what the

company will accomplish over the next few years yeah glad to be on the show and thank you guys for doing this show it's definitely something I try to listen to all the time you guys have been putting out great content for years now so keep up the good work thank you and yeah it's great to meet you as well I would actually this is the first time she's spoken I think because even before like when we were setting up the sponsorship with shape-shift like way back when you guys weren't even it wasn't even public that you were the CEO or something like that yeah Eco yeah and and I mean we've just been working with your team so I actually got to speak so

yeah yeah that's that's totally true thought that we were like that there was some fake name but what was it again Bjorn your new line a character in Lord of the Rings he's the shapeshifter oh yeah yeah all right well thanks so much and thanks much for listeners so we're part of their that's a big ho Network you can find our show and lots of other shows on less of a kind of calm and of course you know so subscribe to it in any podcast app or watch the videos on youtube.com slash episode of Bitcoin and if you would like to you can leave us a review and then email us at show episode and we're gonna calm and we'll send you the t-shirt so thanks so much and we look forward to being back

next week