How These North Korean Attacks on DeFi Aren't Like the Hacks of the Past: Bits + Bips

Transcript

Hey everybody, welcome to Bits and Bips where we explore how crypto and macro collide one basis point at a time. We're here to discuss the latest stories in the worlds of crypto and macro and today one or two interesting new developments and products. But before we begin, first a word from our sponsors. If you've been loving Bits and Bips, [music] don't forget that the show is transitioning to its own feeds on X, YouTube, and your favorite podcast player. If you're not already subscribed [music] to Bits and Bips on channels, go there now and hit that subscribe button so you can keep up with our twice weekly [music] live streams and macro news crypto breakdowns. Bits and Bips will only be on the Unchained feed for a few more weeks, [music] so subscribe today to be ready for launch. You can get all the links at

unchainedcrypto.com/bitsandbips. [music] All right, today is Monday, April 20th and I am your host, Austin Campbell, high scholar of Zero Knowledge Group, here with my co-hosts, Ram Ahluwalia, master of wealth, the leader of Lumina, Chris Perkins, uh CEO of 250 Digital Asset Management. And today we're going to be joined by multiple guests, but starting with Parker White, uh founding contributor to Apex. So, let's start with that one, which is Apex.

We've seen a significant set of products launch over the past few years attempting to capitalize on blockchain rails, developments around crypto, and call it alternative means of creating, I guess in this case, stablecoins. So, Apex, uh Parker, I'm going to let you give us the download on this first to describe, as our as our like foundation here, what is it? How does this work? Sure.

So, the general idea is to create a stablecoin or a stable-like asset backed by digital credit. And digital credit is what Michael Saylor is calling their preferred equity instrument issued by strategy, STR C. So, if anyone's been paying attention, uh believe it was last week they bought about two and a half billion dollars worth of Bitcoin. Um they are raising capital at a pretty astonishing pace. Uh MicroStrategy's STR C, or stretch instrument as they call it, is the most traded, most liquid, and largest preferred stock ever in history. Preferred stocks are kind of a somewhat niche area of the

market, but interestingly, many people don't know this, stretch's IPO was actually the largest IPO of 2025. Full stop. Larger than Circle, larger than any other asset, you know, IPO. And so, it has really been catching on now. And but, you know, it's Nasdaq listed, it's not really accessible into the DeFi world. And so, essentially what we did was we created a stablecoin backed by this instrument, some cash in there as well, a little bit of SATA, but we think a whole bunch of other dApps are going to be issuing very similar variable rate non-convertible preferreds as well.

And so, this basically ports that yield from the Nasdaq into the on-chain world. So, right now, um APY-USD, the staked version, is paying about 12%. We target about 13. Um and so, it's, you know, good double-digit yield on-chain and it's super transparent backing. There's no like trading strategies or borrowing and lending across Aave and centralized exchanges. It's just people give us cash, we send it to the brokerage account, we buy the stretch.

That's that. Um now we, of course, are listed on Pendle and we, you know, have the points farm and all of that, which helps to boost the yield a little bit, but the underlying collateral basis you know, itself yielding about 12% because we've got, you know, stretch in there, which is 11 and a half, and we've also got SATA. So, um pretty straightforward, pretty simple product, but over the last seven and a half weeks we've been growing pretty significantly. Um we've hit about 180 million in supply. Um we announced, uh I guess it was week or so ago, um crossing the million share, so $100 million worth of stretch on the balance sheet, so we're one of the largest holders of stretch at this point. Um and

today, actually, the stablecoin was just listed on Kraken, which is pretty wild for a stablecoin pre-TGE uh to be listed on Kraken. Obviously, the entire team is ex-Kraken, so that certainly helped. But um there's a lot of steam um being built here around this narrative of kind of digital credit on-chain. Excellent. So, looking at this as we look at, call it, press commentary out in the world, one uh bull case. So, if we look at Joseph Onaolapo, the CEO at DeFi Development Court, it's Apex creates a feedback mechanism that bridges between publicly

listed balance sheets and on-chain markets. Benchmark Research was noting that stretch is becoming the backbone of yield-backed stablecoin ecosystem. And Parker, you just gave us a good description of how to get this yield on-chain. So, bear case to go the other way. Um Alexander Blum, CEO of 2 Prime, says a product that pays more than 6% over Treasuries must come with additional risk. And Steven Strong says Apex USD is a BTC fall derivative dressed up as a dollar. If stretch trades below par, the yield story will break. Now, JPMorgan Research has pointed out that yield-bearing stables are growing significantly faster than traditional

stables, call it 15x faster right now, though noting for everybody coming off a small denominator is much easier than coming off a large denominator. 15x size from current non-yield-bearing stablecoins would be a giant amount of money. And Post Genius, yield-bearing stablecoins are no longer, call it, stablecoins in the United States. So, what I want to dig into, and actually, I I would like to start with Chris as a former investor and somebody who's managed a liquid fund and like currently looking at these strategies is where do you place this in the risk taxonomy in the world? Right? As we look at an instrument like this and where is it going to be used on-chain?

So, I think you you nailed it. Um this is definitely not a genius uh denominated stablecoin, not genius regulated stablecoin, right? Like that's uh so so so names matter and I think if we're United States, we have to call it something maybe differently. Um it's kind of a mix of on-chain private credit. Um I guess I've got a couple questions if it's okay. What's what's the goal of having a, quote, um yield-bearing stablecoin um versus it it sounds like in this case it's to maximize yield.

But why call it a stablecoin? Is the end use case to have that stablecoin serve as collateral to back additional exposures? Uh why don't you just say, "Hey, this is a private credit exposure that's yielding 11 and a half percent, 12%?" Well, very importantly, it's not private credit, right? It's not backed by illiquid assets, it's not backed by Apollo funds. It's backed by preferred stock, trades on the Nasdaq. Um you can see it every day, it trades hundreds of millions, um some days billions of dollars in volume. And so, that's actually kind of the, you know, the interesting um juxtaposition here is that you've seen a lot of these private credit instruments come on-chain, whether it's um straight private credit or it's um

the uh you know, the reinsurance stuff. This is not that. This is kind of the opposite of those. It's just you can see the balance sheet, you can see the number of holdings. Got it. And then and then when you take something that's a security and you bring it on-chain, isn't it still a security? Um so, when you wrap it, it's part of a basket, right? So, you've got a mix of some securities, some non-securities, um some other stablecoins, that kind of thing. Um but, you know, the asset or at least our front end is not available to folks in the US. Um so, that is important, you know, you can't um access it in the US, it's kind of geo-blocked um to a number of jurisdictions. Reg S exemption.

Offered to foreign foreign investors. Yeah, so Is there any additional value added? Sorry, just one quick clarification. Like, is there any additional value added versus owning STR C directly? Other than that it's on-chain. Well, it's a couple things. So, you get the diversification of holding a little bit of SATA as well, and then there will be others of these um that'll be launched, you know, one or two from the large Ethereum dApps, maybe one or two from some of the Solana dApps. Um and so, you kind of get that that diversification um that basket there.

Um the other one is because we are overcollateralized and there's a mix of some cash in the pool as well as the preferreds, you get a little bit of reduced vol. So, if the vol on the prefs is, say, you know, well, right now it's like 1%. Well, let's say it's like historically it's maybe like 5%, then the vol here might be like two and a half percent or something. So, you get some of that reduction there. Um Those are like, I'd say, the two things. >> if overcollateralized, though, cuz you're tying up more capital.

But it if I understand correctly, it matches the yield of STR C. Um it's it's a lower wall because it's over collateralized. Maybe I don't fully understand the question. >> Right. So, if it's over collateralized then that's consuming some capital. Right? So, therefore shouldn't have a lower yield versus investing STRC? Well, because of the diversified basket, right? Some of these other props do pay a little bit more yield. Um you know, that generates some extra yield. And then of course because it's a crypto project, we've got the governance token and um so, you know, we can sell some of that to kind of build the

reserve. But then very importantly here is the two-token stable model. So, very similar to Athena where we've got APXUSD is the non-staked version and then APYUSD is the staked version. APYUSD is the only bucket that pays yield. And so, right now we've got let's just call it 50% of the balance sheet or 50% of the issued assets are um staked. So, the whole collateral base is paying yield to just the 50%.

So, that's how you actually get some, you know, kind of yield leverage if you will. Um so, that kind of allows us to be a little bit lower wall and a little bit higher yield than just holding stretch directly. So, it's really kind of packaged to make it more accessible for set and forget it investors. But then it also creates this ecosystem where you can have the active traders trading the non-staked version as well and that all creates a liquidity flywheel um such that, you know, our stock or our asset is much more liquid on chain than say like an X TRC X one of the you know, X stocks tokenized versions.

So, if we're thinking >> So, which if we're thinking about the framework here and it's going to be a reg S issue and so, it's going to non-US persons. It sounds to me like the value prop is I don't have a US brokerage account. I can't buy this thing natively. I'm elsewhere in the world. I would like to get my hands on this yield. I go into Dfy and buy that thing. A little bit like Athena works, right? As you said, which is a packaged version of the basis trade. And then if we're thinking about the collateral pool that you have in there the risk that these people are taking is basically a combination of stretch continuing to work because obviously impairments there just pass through.

That is what it is. That that is the nature of like the risk that you're taking. And then the second part of that I suppose is all the usual like Dfy protocol risks, which, you know, you will try to manage as well as you can in a relatively linear way. But do I have the profile right of the investors that you're looking for and what the underlying risks are there? Yeah, I think you've nailed the risks really well. I think the the other um demand pool is going to be investors that want to use this as a you know, a Dfy building block, a Dfy Lego.

Right? So, right now you've got it trading on Pendle. People can farm the YT points on the YT or they can do the PT. And we're talking to a number of these tranching protocols where they you know, take the yield version and split it into a senior and junior tranche. So, you know, once it's kind of in that Dfy package, it can um be used in all sorts of creative ways. And so, investors that want exposure to, you know, stretch and some of this other, you know, pool basket, but they want it in a unique way, maybe a higher yield junior tranche, maybe a senior tranche, maybe a points farm, whatever, they can access it here versus, you know, a stretch

um shareholding in your Schwab account like you can't use it in Dfy at all. It reminds me of some of the financial engineering that we saw like in 2008 where you had CDOs. Like, well, this product is so good. Let's just CDO the CDO. Let's take all the tranches and tranche it up again. You know, STRC is itself financial engineering. It's creating yield on an underlying that has no yield, right? Now, your product is a pass-through. It improves portability and accessibility to non-US investors. It's what Austin is saying.

And it creates more yield for the junior tranche through structural leverage. It's really it's it's kind of fascinating. You know, humans love leverage, right? We'll find a way. Give me something with a stable yield. We'll find a way to create more leverage. Juice it up. Distribute it to the far corners of the earth. No, Ron. Humans love yield. They don't love leverage. They love yield. >> Humans love yield? Yes, if it comes through leverage, that's in the fine print. Humans love yield. >> That's right. >> With no drawdown risk. That just always pays 10%. That's what humans like. Yes. Equity investors don't like volatility.

The thing that's got to be keeping you awake at night right now is kind of the stuff that we saw at the countdown, right? Is it Is it if Dfy is the end utility use case here? How do you get your head around that, you know, with what we continue to see over and over again? Yeah, it's um it's certainly I think slowing down our um you know, product road map and having us spend a lot more time on security, getting audits on lots of different areas. Um you know, we all of our minting and redeeming is done manually.

Um we have a multi-sig that we do that. So, that kind of would help us um avoid the resolve issue. Um we also have time locks on all of our contracts. Everything is manually reviewed. So, that would help us avoid the drift issue. And then right now we use um for our bridge to base, we have um you know, use chain link CCIP protocol and also have um amounts daily limits um for the bridging there. Um which would help us have, you know, avoided the um the kelp issue. But yeah, I mean look, these are all issues and the next issue is probably not going to look like any of the last three or

any of the last 20 that we've seen over the years. And so, it's being, you know, it's all about being hypervigilant. Um and you know, I the team here at Kraken going all the way back to 2013 at Kraken, we've got a pretty good um upbringing and you know, training in the security realm just having been at Kraken. And so, applying all that knowledge here. Um but yeah, it certainly makes things, you know, slower and more difficult. Yeah, it's even if you have every all of your act together, it's like the third-party dependencies that you can't control it. That's keeping you awake.

Look, I'm a big buyer of Dfy. I think it's going to be, you know, one of the fundamental unlocks, you know, into the future. But gosh, we really got to navigate this this really critical juncture. Don't Yeah absolutely. So, I'm going to go the other way as I think about this and say I agree with um Ron's commentary and Parker what you're saying that this is effective packaging to get these equities into the Dfy markets and distributed to people who cannot currently hold them. I think the risk profile of that becomes pretty clear, which is to say if bad things happen to strategy or stretch, bad things will happen here and vice versa that as long to me as long as that is fairly disclosed to people I believe people

should be able to evaluate take risks with their money. That sounds fine. If I were the founder behind this thing though, in a strange way are you not long call it US regulatory stasis? That is to say the worst nightmare in some ways would be stretch being able to just trade in Dfy freely in the first place because that reduces a lot of the value of the wrapper here. So, in a sense are you guys kind of call it betting on more restrictive versions of clarity, less action from the SEC or simply never finding a path to distribute US equities effectively on chain to non-US persons?

Well, today you already have US equities on chain via X stocks and some of these other superstate Ondo so on. So, we're actually now the largest holder of STRC X on chain. So, we just actually mint STRC into STRC X and then hold it ourselves. Um but there's no market for this stuff, right? It's not trading. It's not really being used in Dfy. It can be. There's nothing preventing X stocks. But there's just not a lot of demand for it. We are already far more liquid than STRC X on chain and more liquid than I think all of the X stocks maybe combined at this point. And so, the uh the packaging, you know, as I

mentioned, it's not just straight STRC pass-through. It's basket. It's got some of these other things. It's got the two-token model. Couple different kind of crypto modifications if you will that really uh boost the liquidity. And ultimately that is going to be the moat for you know, a just a straight STRC on chain. Because again, it's not just non-US investors that um like all non-US investors that can't get access to stretch. There's lots of brokers all over the world. People can buy this stuff directly in their brokerage accounts, you know, interactive brokers, all these different brokers around the world. But people want to buy this because of the way that it's packaged. It's maybe more

similar to, you know, an ETF with some unique crypto features than it is just holding stretch itself. And I think that'll become more clear over time as more of these dApps issue these instruments. And we can have a little more diversified base. Right now it's just stretch and Theta and mostly stretch. But I think over time you'll start to see that spread out and, you know, that'll add some liquidity benefits as well. Looks like they're going to go for stretches. Sorry Chris, go I was just going to say for you that how how do you get back on shore? I mean, you you don't want to have a a an instrument that's only available to non-US persons in the long term. You want to you want to have, you know, maximum liquidity as possible, right? So how how do you do that?

Yeah, that's a great question. You know, I think um there's probably going to be, you know, assuming clarity does eventually pass, there's probably going to be a lot of room making around that. So it might take a little while. Um but we eventually need to see some type of regime for um yield-bearing instruments, you know, not exactly stablecoins, but you know, it's loosely stablecoins or just loosely stable in value. Um but some kind of regime to offer that uh to US users.

Um you know, so we'll have to see what kind of developments come, but you know, it might take a while. Um but interestingly, on a secondary market basis, so the primary issuer, us, you know, we can't um kind of issue roughly or or relatively speaking to US users, but for example, APXUSD that just listed on Kraken, it is available to US users. So on a secondary basis, users can go out and trade it and you know, we can't really do anything to control that. Um and so this is kind of the you know, um I wouldn't say loophole, but kind of the construct that even like an X stocks is using where X stocks is not formally issued to US users, but if they happen to interact with it within DeFi, that's

kind of like up to them. Um so I think over time, um you know, it might just naturally get into the hands of folks. Um again, we're not, you know, offering that or marketing that, but um hopefully a sandbox does appear over time from, you know, the SEC and the CFTC to make this, you know, formally available to US users. All right. So speaking of things available to US users, um Rom, stocks hit a record high, Bitcoin has been ripping and is up significantly right now back to things that are helping stretch.

Um I think it's at like 76K today if I'm seeing this correctly. And yet the war in Iran continues. We don't yet have a ceasefire and the markets appear to be shrugging. I mean, previously people used to think Trump would talk out and back off when economic pain bites, but instead we're just not really having economic pain as we can see through the lens of Bitcoin right now. What do you make of what is going on, right? If if Trump, you know, as the Wall Street Journal earlier alleged, are is in the process of putting up impulsive posts and yelling at people, but the markets are shrugging it off and moving onwards as though this will be,

to quote you, a nothingburger. What's going on here? Two topics. One is positioning and the second is uh Iran. So what happened is, and I mentioned this on Twitter, I think on April 7th, is that the hedging, the shorting is so significant. People also exited the market. BlackRock took a neutral view on equities. That's Black the largest asset manager in the world, which many investment advisors follow. And they're themselves an asset manager, went to a neutral position.

So they're offsides. There's a lot of cash offsides. And they're trying to find a way to get back in. So that's one. The second thing that happened is Claude went from AI apocalypse to decimating whole categories when they had these product releases at a seemingly unstoppable frenetic pace of every two days, right? Hurting SAS, hurting Wall Street names, trading names, uh Adobe, you name it. Now it is, "Hey, this AI stuff is real. The world is short data center compute."

So semis have to go up, industrials have to go up, financial services see a productivity boom. That is the new thing and people are scrambling to get in. This is very reminiscent of last year, actually. This is a non-consensus rally. So I'm excited. I I I think you should be constructive. On the Iran piece, I think Iran is largely priced in now. The people that wanted to sell sold out. The US economy can handle oil at 85, 90, 95. They can't handle 120.

But it seems largely contained. There's been no further escalation. The US is blockading the Strait of Hormuz and tankers are lined up outside of Houston. Venezuela is increasing production. Not bad. So far, so good. Uh there was a fantastic Wall Street Journal article that came out this weekend. I don't know if you guys had a chance to look at it. It gave a lot of insight into Trump's decision-making. It was a behind-the- the-scenes view into what is into what is happening. We can talk about this, Austin, if you want to go there. I'll I'll just kind of pause and give you the market view.

Yeah, I uh I know Parker has to depart momentarily. So Parker, I wanted to ask, do you want to throw anything in here on the global macro? Like how how does this make you feel as somebody who's structurally long Bitcoin, shall we say? Sure. And you know, just to I've been structurally long personally uh for quite a while and basically in all the projects that I've worked on. I think it's really interesting seeing Bitcoin kind of decouple from equity markets during this crisis. Um started to move higher. That was a real interesting moment.

Um but then I think as investors look at this catch-up trade, look how to, you know, get back on sides here, you got to look across the risk spectrum, look at equities, and then you look at Bitcoin. Um still well off all-time highs. Um you got to think that there's going to be some type of catch-up trade here. I know we're in the throes of a bear market and all this DeFi stuff is going on, but you know, Bitcoin's not impacted by that. And strategies buying, you know, billions of dollars of Bitcoin a week now. Um you know, I kind of like the setup from, you know, just a relative value perspective. How long do you think MicroStrategy can continue to market stretch

and not run out of the marginal buyer? Isn't that what the Bitcoin complex depends on? Yeah, so what's really interesting about stretch is rather than having to pitch to people, do you, you know, want to buy Bitcoin? Here's the story about Bitcoin. It's, you know, here's the returns, volatility, whatever. You just go pitch, do you want to buy a one vol asset that yields 11 and 1/2%? It's a much easier pitch. And as you see all the redemptions in private credit, where investors were just slinging tens of billions, hundreds of billions of dollars in without fully

understanding what was in there, right? Clearly, you have all these redemptions hitting all these gates. I think you're going to see a rotation and private credit investors that are used to double-digit yields, they're not just going to say, "Well, I guess my mandate needs to change and I'm going to go buy treasuries." No, they're going to go look for something else that is also yielding double digits but needs to solve the problems of the last, you know, area they were in. And the two problems of private credit are illiquidity and lack of transparency. Stretch is liquid and transparent. And so I think you're going to see people typically look at preferred stocks and be like, "Well, it's this tiny bit of the market and like the TAM's not really going to grow." But I think it's going

to grow massively because you're going to see this huge wave of capital moving out of private credit into this and investors can easily model it. You can short Bitcoin, you can short MicroStrategy common. There's lots of ways you can hedge it um on the TradFi side if you wanted. Um and so I think I think stretch can grow grow quite a bit. Now it'll start to be a little bit constrained by the MicroStrategy balance sheet and the leverage ratio that they take on. But if as long as they can continue to run the common ATM as well, they should be able to balance that out. And then of course, you know, every move in Bitcoin to the upside also deleverages the balance sheet. Um so I think they've got quite a bit of runway here. It's only a 8 and 1/2 billion dollar instrument, which is a drop in

the bucket from um you know, global financial products perspective. I think you hit the nail on the head with the ultimate thing this all hangs on is MicroStrategy's common and Bitcoin price. Right? Like Bitcoin having another very significant leg down is a very different story here than going back up towards the all-time highs. And so all roads, you know, Rom, you've said this before, but all roads ultimately just lead back to sentiment to markets overall. So I guess we'll pause there on this one. Parker, thank you very much for joining us. We appreciate the time today.

>> Thanks. And >> me on. See you. Absolutely. And for everybody else, uh we're going to take a quick commercial break before we're back with our next guest. If you've been loving Bits N' Bips, [music] don't forget that the show is transitioning to its own feeds on X, YouTube, and your favorite podcast player. If you're not already [music] subscribed to Bits N' Bips on its own channels, go there now and hit that subscribe button so you can keep up with our twice-weekly livestreams [music] and macro meets crypto breakdowns. Bits N' Bips will only be on the Unchained feed for a few more weeks, [music] so subscribe today to be ready for launch. You can get all the links at unchainedcrypto.com/bitsnbips.

>> All right, everybody. Welcome back. Uh we are now joined by Michael Bentley, uh Lord Protector of Euler. Um and we're going to be talking about the Kelp DAO hack. So, as an ongoing trend in DeFi, we've continued to have some security issues. Kelp DAO appears to have been about a $290 million hack where attackers, allegedly North Korea's Lazarus Group, drained 116,500 RETH valued at about 290 million uh from Kelp DAO via its LayerZero bridge. The attack mechanics are basically that attackers compromised two RPC nodes

feeding LayerZero's single DVN swapped um the OP Geth binary for a malicious one, and then the clean nodes were DDoS'd to force a failover to what are essentially now poisoned nodes which approved a fraudulent cross-chain mint. The malicious nodes straight up lied um selectively, so the monitoring queues failed. This is Blockaid's analysis of what occurred. Um perhaps unsurprisingly, LayerZero and Kelp DAO are now fighting with each other. Um LayerZero said Kelp DAO chose a one-of-one DVN configuration. A hardened setup requires consensus across multiple independent DVNs.

Kelp DAO countered LayerZero's own quick start in GitHub defaults point to the one-of-one structure, and 40% of LayerZero protocols use it. Um third-party analysts are to be honest, blaming largely more LayerZero here. So, Zach Rines of Chainlink, uh 0xngmi, The Defiant, and Dune Analytics, and uh Euler have all said single verifier setups have always been centralized oracles. So, I'm going to start right here before we get into some of the downstream economic implications of this of what do people make of this specific attack, the sophistication, how the

setup was done? Michael, I see you nodding. Do you want to start? Yeah, sure. I mean, this is is clearly a sophisticated attack. There's there's no doubt about that. I mean, uh yeah, changing the binaries, managing to carry out a DDoS at just the right time, and being able to um yeah, then trick the trick the RPC nodes into to essentially providing a false view of the world. It's all quite sophisticated, and clearly I think yeah, it looks like a nation-state level. So, I think the Lazarus attribution is probably correct. Um yeah, I think I'd I I think there's I think there's all sorts of like uh issues here with with sort of like risk, and I wouldn't lay it all on LayerZero, although I do agree that uh the the yeah, the default setup that's

kind of out of the box for people to use is is probably not great, and and I think it's something like 40% of people decided to use that setup. And so, they're saying it's mainly it's mainly the the the fault of Kelp DAO for not sort of modifying that and going going further. But, uh I think there's there's some truth in that. Obviously, there's 60% of people, including Euler and all these other projects, that decided to use more DVNs. But, yeah, certainly certainly there's some uh there's some blame across all parties here, I would say.

Chris, you've been in this space for a while. You've both had to invest in projects, evaluate projects, invest like trading setups, like evaluate those. What do you make of this hack? What does this say to you about where DeFi is right now? Yeah, I think I think that we have a lot of challenges right now in the space. Um And again, what have we lost? Like 600 million in this month alone? Um I'm not the type of guy who's going to point fingers at LayerZero or Kelp DAO. Let's point fingers at the people that really deserve it, and that's the the criminals that that perpetrated this attack.

Right? And what have we done? We continue to allow people to operate and attack our protocols without an all-government response. I think it's unacceptable. I've been talking about this forever. But like, why are we blaming the victims again? Yes, could they have been stronger? Absolutely. Yes, it's a very harsh environment. Um but when I'm walking down the street with my wallet, and someone steals it from me, you know, those are the persons that need to be held accountable. So like, I think it's I think everyone's going to point fingers, this and that. But why are we letting these threat actors destroy and impede our protocols? Like, I think it's unacceptable. I think we need a whole-government response. I think we need to take action and clarity, and it's completely completely unacceptable.

We cannot tolerate this. We want We want innovation in this country? Then we need accountability when people try to attack it. We need to put them on defense. Um Anyway, that's what I'm trying to say. >> Sorry, go ahead. Well, look, Mythos is is both an opportunity and a threat. Right? There are Someone's cat is very excited right now. But um But but look, as AI comes into into effect, it's going to provide brand new threat vectors, ones we've never heard of. But we have to be in front of that as well. So, look, I think um it's going to take a while for confidence to be restored.

What do investors care about? Investors will take market risk all day long. What they won't take is operational risk and cyber risk. And so, we got to be very, very careful. So, Chris, I'll ask you this as we look at clarity, and I know it's a topic that you've had things to think about before. Ram, Michael, feel free to pile on here. One part of this is clearly like privateering in your case. That is to say, when these assets are stolen, deputizing people to go after them, get them back, and return them in a way that is now legal. But secondarily to that, what other fixes do we need in the ecosystem right now? And you know, one of one of the things I

observe is uh security in spaces like this have been a traditional tragedy of the commons-type problem. That is to say, it needs to be done for everybody, but individually, many people don't have the incentive to spend on it if their competitors are not also spending on it. How do we get to a point where greatly hardening these systems and responding quickly is also the norm? Let me just add one other thing. The one thing that was pretty good here was that Kelp DAO was able to take action within 46 minutes. Um that's an eternity, actually. But what we talk about all the time here is latency matters. At least they were they were able to prevent incremental I mean, other incremental hundreds of 200 million dollars of being of being stolen. So, so I think that is a very

That's Everything when you're dealing with security comes down to latency. So, to Ram's point, we need to be much more aggressive with agentic activity agentic defense. And frankly, um we need to be much more on offense. I've been talking about this from the day one. We need to have our private sector supporting the security of our infrastructure. Yeah, let me layer on here. Last week we talked about Mythos AI. I did some more homework on it. It is it is really quite remarkable. So, Mythos from Anthropic uh was able to identify security vulnerabilities in BSD Linux, which has been battle-tested out there for decades.

And so, a lot of these Fortune 50 companies are using Mythos to identify security vulnerabilities and protect against that. The point is that these nation-state capabilities will be in the hands of corporates and then individuals within 1 to 2 years because of the democratization of AI. So, it's a significant thing. It's a disappointing setback. DeFi is what? Like 6, 7 years old now? You're still getting these hacks. It's hard to have confidence in the system when that happens. I think people are going to stick in the capital markets world and the ETF world because they value security first.

Um I do think you you know, yes, like hold governments accountable. But what are we going to do to North Korea? They already have sanctions. They're already a pariah of the international system. It's hard to find what the marginal response is. Yeah, I think But this is this is not North Korea, right? This is not North Korea. It's Lazarus Group. Right? Why do I say that? It's a criminal organi- Listen, it's a criminal organization. We wouldn't attack as a nation-state. >> connected to the DPRK, though? Aren't they essentially an arm of the DPRK? Of course they are. But I'm saying is DR- DPRK has to have plausible deniability because they're a nation-state. We need to We need to shut down Lazarus Group, bottom line.

I think Yeah, I mean, Part of this, I'll be real quick. One is fight AI with AI is one. Like, of course. But we need this technology. We need it yesterday, and it's not surety. The second is how do you create surety? Can use other technologies and insurance and reserve pools. You know, in insurance market, we have reinsurance, for example. There's a Berkshire Hathaway. They would collect a fee for fighting that insurance. How do they underwrite it? They perform their own security assessment. They just like a ratings agency. They rate it. They assess the protocol. They stand behind it. Collect a fee for that.

That's a free market response to this, and that can instill confidence and trust. I don't Michael, we need to talk about this. So, you know, in derivatives, we have guarantee funds, right? Where we have socialized losses in case of extreme tail risks. Maybe that's the solution. Maybe we should start having these pulled type solutions to your point. It's It's a take on insurance, but it's a market-driven socialized risk approach. The The So, a few points just getting back, I mean, I think the you know, finding Lazarus is very, very difficult. You know, you've got some fantastic people out there. I've worked with law enforcement before. I mean, there There are people out there really trying. It's just a really tough challenge. And the other thing is in DeFi, there's nowhere to hide, right? In the In In the years gone by, it always

used to be a smart contract exploit. You know, my early years it was all smart contracts because they're out there public. And that's something to be celebrated because it means that everybody can verify the code and it's actually exactly what it's doing. But it also leaves you with very little wiggle room. There's no margin forever. People are spending a tremendous amount of money. You know, Euler we spent millions and millions of dollars on on on security. But there is really just no room forever whatsoever. Um You do tend to get One of the arguments I used to make about DeFi was that you would get a kind of antifragility emerging from protocols that had uh vulnerabilities would be exploited and would kind of fall away. And the ones

that remained would get this, you know, so-called Lindy effect. And they'd be the ones that you knew weren't exploitable because their code's right there and they they've held billions of dollars and you know they can't be exploited. I think this This kind of attack was was quite different. And the the kinds of attacks that we're seeing now quite different. A lot of them are kind of key leaks. So, people losing access to their private keys or or sort of like leaking infrastructure. And then this one was more sort of infrastructure level as well. It was a very, very I wouldn't say an entirely different class. It's nothing too novel, but the the way it's being carried out now, it's not all at the smart contract level. I think we're actually seeing quite a hardening of of protocols.

Um on on AI, AI's a great tool, but it's it's it's an arms race, right? It's It can be used by the good guys and the bad guys. I do think I think I think the teams need to be using it much more in auditing end-to-end, absolutely everything using AI and getting their hands on the best possible tools. I think you see a lot of security firms are working to bring these tools out now and then increasingly teams are using this, but it's also in the hands of the bad guys. And it's uh They're very, very effective operators and it's speeding up their ability to to attack things as well.

And then, yeah, the last point on the on the pulled model and insurance and all the rest of it. One thing I've I sort of said to somebody today on social media was uh a lot of a lot of the mechanism a lot of a lot of mechanisms we have in DeFi today are kind of legacy from a period where you weren't really allowed to introduce centralizing elements into the systems. So, people have been asking, you know, why are there not more monitoring systems and pause functionality and more control effectively? And part of that comes from this uh you know, regulatory stance from the past where you had to be fully decentralized and zero control because any any any amount of control you did have would would lead to

persecution by the regulators. So, as that stance has sort of softened and changed, I do think we'll start to see quite a big difference in how protocols are built up now and and the level of uh the you know, the the the kind of the kind of systems they have in place to firstly prevent attacks and then once that if an attack has happened, as you said, then how do you actually go about the process of socializing that? How do you How do you Who organizes that? Who's in charge? I think now it's hopefully going to be easier for teams to actually step up and say, "No, here's the system. Here's how it will Here's how it will work. We're in charge. We'll do this."

I mean, I think you could have decent Can I just jump in? I think you could have decentralized socialization of risk. I honestly do. Um and the way that it would work would be you create a pool. And And I think most of the perp decks should do this, too, because I hate this concept of ADL in the beginning. It should be at the end. But essentially you you create a pool. And the pool members benefit from the yield of the protocol or of the benefit from the revenue of the protocol, however that protocol may work. A pool's created. You can flex the pool. You can make it bigger with higher yield. You can square with little yield. And if there are certain, you know, if A equals B, if there is a hack, boom, that's the pool that becomes at risk. And if provided that that's fully transparent,

I think theoretical theoretically it's very, very possible. But we just haven't seen that yet. Really We've seen We've seen nuances about it, but like not really anything codified or anything hardened. I mean, one of the things that's interesting here to me is people start speaking about insurance for these protocols as insurance comes along with underwriting and it comes along with restrictions. Right? And I'll tell you right in the current day, if you look at what most insurance or reinsurance companies would charge you for DeFi, you're not going to like the quotes. And I think that is Yeah, I think that is a I mean, there are people who will give them to you, but I've seen the prices and they're an accurate reflection of risk, right?

Like, how do you feel about a 30% per annum premium, right? Like, oh well, why don't you even buy it something at that point? But the reality is Chris, as an extension of what you were saying, whether it's decentralized or centralized, the nice part about insurance pricing is it's going to be pretty functional and experience rated. There were structural upgrades we need to start making to crypto because we have to start you know, and and I think this feeds into the point that Michael you were making earlier about working in legacy frameworks. The belief that transactions are, call it, optimistically correct has to be discarded in this environment. We

are clearly getting enough hacks that all large transactions should probably be viewed with some degree of skepticism. And I don't know if that means delays withdrawing from protocols, choke points on bridges, needing significantly larger shares of votes to move assets. Like, there are many ways to do that. And not all of them are implicated by having one centralized party that controls things. But I would say without a multiply redundant risk framework, I have a lot of doubts that we can solve that problem. And the reason I say that is as you look at the sophistication of some of these attacks, again, we're talking about like poisoning a bunch of like RPC nodes at

the same time we're doing a DDoS attack, at the same time we've compromised like this is not trivial stuff to defend against. If we're saying it's nation-state actors with their tremendous resources against individual protocols, the protocols will lose with certainty. However, you can still flip that security framework on its head if we make it a chain of things that have to fail with a redundant response across the ecosystem. Because the Lazarus Group breaking a single protocol is relatively easy, but breaking eight protocols simultaneously, all of which work differently, becomes so complex that if they're capable of doing that, essentially the chain is

unusable at that point. And so, I would say DeFi, if you're thinking about how to get insurance and how to build things, has to stop operating from the framework of we assume transactions are legitimate. That has been my major takeaway of the past few hacks in a row of just like starting all the way back with Bybit and then another partial interdiction, which was the Cedis hack. We just had KelpDAO here. We've had like attack after attack after attack.

And to me it raises the question, and I'm curious, you know, for the rest of the group, do we have to change our default like thought model of transactions are legitimate? It's a good question, but you risk giving up concepts like immutability and the concept of non-recourse and finality. Did Okay, so I will grant you that on finality. Yes, because if we slow down transactions processing, agreed. But immutability is just that we can't change the history of a chain. If there's like a 280 million exploit and it goes into a queue and everybody looks at it during the delayed period and says, "Oh, that's not correct." And so a transaction spits out that then reverses it, you still have an

immutable chain where the history is transparent and known and on alterable. It's just a question of under what terms do we let them sort of transact down the chain right? Yeah, it's interesting. I mean, you ask all the right questions. I was nodding my head there. And you start to see how things naturally get centralized over time. So, like over time, people flow risk to trusted parties. They're trusted because they're regulated and capitalized and have all sorts of oversight and auditing. We got to find a way to keep this going with code and technology and not bring it back into the system.

You know, one would think that there's a way to transfer the risk of each transaction. Maybe it's not, you know, at the pool level, maybe it's at a transaction level. Um there's more work to be done. It's a major setback. Like, this puts DeFi back a couple of years. Yeah. I think Go ahead, Weston. Oh, I was going to say yeah, you you you can um you can try to build these mechanisms, you know, I felt felt deeply about this kind of stuff as a sort of mechanism builder myself. I We used to try to think about how we could introduce these kind of mechanisms into uh into our protocol. And it becomes quite difficult because there's there's all sorts of nuances here and and sort of

edge cases. When you think you fix one thing, it's like pushing a bubble under the carpet. You just sort of move it somewhere else, but the bubble's still there. Um you know, if you want to do, you know, rate limiting for instance on protocols, you need to know what are you actually limiting? You know, what's the actual unit of of of limit there? Is it the underlying asset? Well, that the amount of asset in circulation can change. That needs to sort of adapt over time. Its value could certainly change, you know, a lot. So, then you need to start to bring in articles and third parties and and that that introduces new dependencies and things. So adding adding these mechanisms in principle sounds like a great idea and people often ask what often ask builders like why why don't there more of these and it does come

down to just being very very difficult to do it without adding new trust assumptions into the mix and and that carries a cost ultimately. So I strongly agree that it carries a cost, but let's look at the counterfactual which is that in 48 hours D5 TVL has gone from what 99.5 to 86.3 billion. I think the market may be speaking that the cost is what is currently there is just rapidly becoming unused. >> Yeah. I agree. I I totally agree.

So Michael, I would ask you like as a builder yourself and I know some others that have been posing this question to people. I kind of see two paths here. Path number one is increasing like call it slowness, checkpoints, multiple redundancy in the system one way or another because Chris has said the latency problem is real and if we're going to be optimistic about transactions with zero latency, I don't see a pathway to interdicting these things. Caveat. If we continue to build relatively complicated things because as a counterpoint let's look at a model that's largely been successful and stood the test of time which is Uniswap.

Right? If all of our LP pools are segregated and unalterable and to upgrade we've got to like withdraw from V2 and go to V3 and withdraw from V3 and go to V4. And all of these could sort of blow up in their own self-contained box. Yes, Uniswap is a very simple thing. They are not building complex like layers upon layers upon layers. But is the future, I guess I would ask you as a builder more likely to be actually we need to simplify a lot of these things and remove the attack surface area like go back to basics in D5 or is it if we want to retain this complexity we need to think much harder about security which may as you noted lead to certain forms of centralization.

The the Yeah, this this came a lot up a lot through my time built building building a lending protocol. Ultimately a an AMM or an exchange is is very self-contained. It means it doesn't care about the outside world. It just it just looks at what's in inside and it you know it's it has to try to to balance a single invariant uh in the in the pool. If you look at a credit market or lending market, there are all sorts of dependencies and the credit markets really care about the outside environment that they that they sit in. So they care about the volatility of the assets. They need to know the prices of those. The prices aren't intrinsic to the assets. So then you have to have some kind of third

party report on those prices. Liquidity is a massive massive issue. You know, a DEX doesn't care what the liquid environment is outside of the DEX, right? It's you can it can operate with $10,000 or $10 billion. It's it doesn't matter, but lending protocols as we've seen, you know, with this you know, with the the liquidity crisis we're in now, very very heavily dependent on what's what else is going on. And I think that's the that's what makes it so difficult to build a you know, fully truly immutable Uniswap like lending protocol. We've tried we've tried to get as close to that as possible. You know, Morpho also with similar sort of mindset trying to trying to keep as much of that as you can while still offering a viable capital efficient lending market. It's

it's just I I think but at this point I'm I'm resigned to say that it's just not possible for credit really. We've had seen many teams come up with all sorts of interesting ideas on how to do this and I just don't think it's it's possible. So then we have to accept uh this is the state of the world now. This is how it has to be. How do we what's the minimum amount of centralizing force that we can add back to these systems to make them uh not collapse so so spectacularly when they do um whilst maintaining the core principles of D5 and disintermediation, composability and all the rest of it.

I mean if you So we saw Go ahead, Chris. >> We we saw we saw Drift partner up with Tether. And I don't know, is it a centralization force that's going to restore security or is it just the resourcing that you need to have just to go through like an inordinate amount of audits, bring in the AI? Like clearly for this industry to move forward we need to provide confidence in whatever protocol you design. So I guess is centralization the only option or can, you know, like we're seeing this partnership between Tether and Drift, don't know all the details yet, but is it more of a resourcing issue? It's really hard for a startup to compete. I I really don't think it is. I think you know, we we we talked earlier about Mythos, right? Finding bugs and flaws in 26-year-old operating systems.

You know, the amount of the amount of man-hours spent on that, you know, is just more than anybody can afford to ever spend building a a D5 protocol and yet there were still bugs that could be you know, teased out there. So I don't think it's just a I don't think it's purely a resource issue. Everybody is really really cognizant of the the importance of security and they really really are trying. It's it's very very it's just a very very hard problem. I I I sort I think it's sort of unsolvable at the at the code level. Uh so we need we need other we need other fail-safes. We need other mechanisms that are introduced I I I think at this point to to help safeguard things a little bit more than just relying purely on on on code

code alone. So working backwards, right? Like what if this is me putting on my business school professor hat, but looking at some of the lessons from history, I feel like there are two paths that we can go down here. One is exactly what you said which is looking at TradFi lending markets and starting to build in a lot of the fail-safes in modern markets. Like great example, you know, if you have call it $200 million of supply and somebody deposits $500 million not making all of that available for borrow immediately, right? Like allowing that only to increase by call it 10% per day or something like that gives you a very long runway to interdict these things. And yes, it obviously makes that

protocol somewhat less efficient from like a I can't take a $300 million flash loan or you know, immediately deposit something in size, but it might also be fair to say maybe that's a problem not a feature and there why why are you so intent on doing this like literally right now at 3:00 a.m. on a Sunday becomes a valid question along with many of the other redundancies you build in. The other one though to go the other way on like a lending protocol is I know this makes it less liquid, but there's no reason you can't structure it like an AMM if all of these are essentially bilateral offers for lend and borrow.

And then you don't have this contagion risk, right? Like I will lend $100,000 of USDT at this price and I will accept the following things as collateral and that's that. You can have like these prepackaged boxes where each person can do their own like lending in terms. The problem you run into there which I think, you know, you've spoken to this in your earlier answer is that's less efficient than it might otherwise be. Like I I if I recall I think there was an early version of like SushiSwap's lend protocol that was similar to that way back in the day. Exactly. It's been tried.

Yeah, it just didn't it just didn't it just didn't attract enough um enough users. It was so clunky, so almost peer-to-peer like and and when you're competing against a pool model which is, you know, I can just deposit and withdraw whenever I like and there's so much liquidity that you know, people think it's about the technology. It's really not what Aave and other like really large lending protocols are selling is liquidity. It's that ability to go in and take out those huge loans and repay them whenever you like. That's the main product. When you've got liquidity, that's that's king above all else. And so when you have these isolated, you know, almost peer-to-peer like lending systems, much much more secure as you said. You don't need all these external dependencies and all the rest of it. You just need to trust that the code a very

simple piece of code works for that particular loan. >> [gasps] >> But then it it's just how do people find each other? That's the problem that I think Compound originally solved and that the Aave, you know, heavily modeled on the Compound system you know, followed on with and it's it worked so tremendously well that it scaled up to billions and billions of dollars, but with it has come this, you know, you know, other challenge which is when things go wrong, they they sort of tend to cause contagion in in a way that those isolated models don't. So Yeah, we we we've we've experimented a lot in D5 at this point and I'm I'm I'm sort of resigned to the fact that maybe it's just not possible to to to get the best of all worlds and that we're going to have to sacrifice something somewhere along the line.

Well I will say as a closing remark here as we are hitting time that I have resigned myself to the belief that I think you are probably correct about that that we are not going to be able to have our cake and eat it, too, and we're going to have to figure out which by the way, there are multiple paths to trade-offs, but we're going to have to tolerate some of them cuz one thing I think all of us agree on is the current paradigm is not sustainable. I'll give you one other concluding thought. When the Pentagon finally releases information on non-human intelligence and UAPs, we can encounter these, we're going to ask them who is your leader?

What are your intentions? And the third question will be how do you manage money? Who do you trust? How do you exchange over vast distances? How do you represent value? Just give us the answer. And is there quantum money? That's question number four. >> [laughter] >> All right. On that note, thank you everyone for joining us for this episode of Bits and Bips. Um next up, Laura moderates a debate {slash} allegedly fist fight on Canton between uh Yuval uh Hasib of Dragonfly and Alex Gluchowski of Matter Labs. It was pre-recorded and I have been whispered to that it got quite heated, so be sure to stick around for that one. Thank you.