LIVE: Jamie Dimon Double Dips. Is CLARITY Is Done??? Re7 x Plume & Tay Call in, Shane In The Tower

Transcript

And we are back. So Rob, one of our clips yesterday on this said you know, that they're looking for a risk framework, right? For DeFi, like a collaborative risk framework. It seems like this entire sentiment has been really spreading across the entire market, right? Like Santi's basically saying here that we are we are underpaying depositors in Morpho for the risk that they're taking. And as you said, Luca had this big kind of post about this.

And yeah, I mean, I think this is the current sentiment across the whole market is that we are we are uh underpaying people willing to take the risk in DeFi on the yield side. Yeah. Yeah, exactly. Um that was the result of uh the analysis that Luca did. Um and he uses uh you know, models that are tried and true when it comes to derivatives pricing. Um I think something that could unpack this even further is if we do get some sort of risk framework, then we would know what kind of risks um these protocols are taking. The one pushback that I saw, forgot who who had this, but uh oh, I think it was Hasu

actually from Flashbots. Um said, "Look, the model is great. Uh you know, there's a lot of like really, really solid analysis that's being done here. Unfortunately, it's bad data in, and so it's bad data out." >> Mhm. Now, what the the way in which these things compare together nicely is if we do get some sort of risk framework, then we would have better data to input into this model, and therefore it would be even more accurate. And so, I think Luca has an extremely solid starting place where we can start to improve the standards and the risk controls on both sides. And as long as we do have some some data uh and it's standardized, right? So that we have some sort of um

either regulatory practices or open source practices or just common practices to to have these under this understanding of these protocols, then we'll get the proper data that we need, we'll put it into Luca's model, and then we'll end up with a much much better understanding of where things lie um and the rates uh that that depositors should be earning. Yeah, I mean, it is just it there is no rate that anyone is going to be willing to pay with the understanding that there could be a zero at the end of it, right? On their principal. And so, I mean, look, even if you if you treat these things as low-risk savings, I think that the allocators, as Santi's

saying, they're going to stay out, right? Like we should be having higher rates on chain for this risk. But the thing is, and this is something that people kind of get, but don't really, really fully get, is that the risk rates on chain are not basically like they're not representative of the risk. They are solely measurements of the demand for borrowing. And so, in a bull market in crypto, you get a lot more demand to borrow, and this can actually be in a time when the rates in traditional markets are significantly lower, which often drives these bull runs, right? And

so, these markets are solely supply and demand, not based on the risk-free rate of treasuries or on the risk of the of the protocol. Um and so, that's something that like it looks really bad in the times when it's a bear market and exploits are happening and the rates are lower than the risk-free rate, but then in the bull markets, it's like it looks really strong because rates are typically lower and um rates in on chain are higher. And so, it's kind of this weird dynamic where it's really just supply and demand-based.

I I think that is right. Um you mentioned something earlier where, you know, if the there is risk that uh these deposits could get zeroed out, you know, the risk the reward isn't high enough. Um and so, you know, these models do take that into account. They they take into account the likelihood that these things do get zeroed out either by default or liquidation, could be a bad oracle, you know, they it was pretty expansive uh as far as what they were able to include in this model. But the second part of what you're saying is absolutely true, which is that these things are primarily based on lending uh and borrowing demand. And such such that, you know, these things are reflexive. Like, you know, the the risk

itself doesn't change. Bear market to bull market, the infrastructure is still there. Uh maybe there's more volatility in the underlying collateral assets. Uh And there's more drift if there's more volatility in these rates, but ultimately uh ultimately that doesn't change very much. It's the lending and borrowing demand that changes a lot depending on the market conditions. Um And so, it it was extremely interesting because, you know, Luca put this out, Santi tagged up with Luca, but then you had uh from from Steakhouse, uh you had Adrian, who basically said, "Look, if you use a more uh if you use a different model, if you treat this more

like a repo than a put option, you use a more realistic loss given default, if these things default, the loss that you would be experiencing, these things are actually perfectly in line with uh where they should be. There's no price dislocation. There's no there's no mispricing of the rate. So, it's it's pretty fascinating um to see how these things are uh and and how, you know, some of these really experienced risk curators are thinking about rates in the current DeFi landscape. Well, no better way to start this conversation with uh our friends from RE7 and Plume.

Uh we have Evgeny and Chris of Plume coming up, and we're going to talk about uh uh yields in vaults and in DeFi. So, let's bring them up, guys, and let's talk about vaults and institutional capital with this lens in mind of whether rates are too low Uh in D5 and on chain. Yeah, I mean, are investors paying too much attention to the risk or not? Guys, welcome to the Chris guys well welcome to the show.

Big big week here. Definitely. Thanks for having us. Appreciate it. Yeah man. Rob and I were just talking about vaults, right? We're We're talking about how right now there's kind of like this sentiment in the market that people in D5 are paying too little or they're getting paid too little for the risk that they're taking on chain in vaults. Santiago put out a post about this. Luca from M0. Obviously, we've had these exploits as of late. I'm curious for you guys take on this. What is the state of vaults and the curation with regards to to the risk? Are users taking on too much risk for the state of current

yields? Guys, welcome to the show. Stoke to have you on. Um yep, happy >> Yeah, please. Go ahead. Yeah, happy happy to start. So, you know, our Well, firstly, you know, I think the word vaults is like the worst thing in crypto right now because it's horizontally applied to pretty much everything, right? Vaults are basically it's like an empty box. And what really matters is what you put inside the box. You can be running an extremely conservative and cautious strategy or you could be, you know, doing something egregious or dangerous. So, as a general statement, you know, are the yields too low? Yes.

Um are yields uh lower than what the implied risk would suggest? Yes, that's the case. And we've seen the same thing in the previous bear market after FTX. So, for a prolonged period in 2023, we've seen D5 yields compress materially. Like we've been running yield strategies in D5 for 6 years now. And it's a very typical behavior, which is a sign of market inefficiency because you have a lot of idle capital that's for some reason comfortable earning rates which are, you know, the same or below the the risk rates that they can get in dollars, but they're taking on more on chain risk. Uh having said that, the markets are reasonably efficient in over period

of time, that situation corrects itself. Yeah, I mean, look, vaults I think the same thing as I was going to say, look, vaults are tricky, right? At the end of the day because what really matters what people are doing with the money. Um and it's all over the place today, right? There's just no standardization, there's no rules, and really there's no understanding. I think that's the issue as well, right? On the other side. So, both sides of the spectrum you have issues where people are doing whatever they want once they set up a vault and do anything and the other side people are allocating into it, right? We're still sort of chasing uh the basic ideas that we had in D5, which is just allocate to the thing with the highest APY, right? Um and it turns out that's a bad idea, right? Big surprise. And so, I

think that's kind of what's happening, but it like like like you guys said, I think this cleans itself up over time, right? It's already happening right in front of our eyes, and so it's getting better and and uh you know, these things will normalize over time. But yeah, right now it's like certainly, you know, a risk, but it also points us to D5. Like this this stuff is like hard to use, you know, it's like not very easy. Looping, understanding it, staying up to date, knowing what's going, rebalancing. It's just tough to use, and so it's easier to outsource that, right? And have somebody who who's experienced like the you know, like the RE7 folks or whoever like really manages and take care of it for you. So, I think that trend is not going away, right? I think it's going to continue, but the good

ones will shine and the bad ones won't, you know? And then we will you know, we'll continue to roll on from there. And And so, what's the what's the reasoning for why someone would deposit into one of these vaults that's earning less than the risk-free rate? Is that just a market inefficiency? Do they not have access to treasuries or sovereign bonds? You know, what what is the rationale behind that? Well, it it doesn't matter what you deposit into whether it's a vault or not a vault. The market can have self-corrects, right? So, if someone has let's say stablecoins on chain, they want to earn some yield, uh it's not like they're thinking I want to put it into a vault. They're looking around and they're trying to see what's out there. And what they're seeing is platforms that give them the vault infrastructure and platforms that

don't give them vault infrastructure. People typically think of vaults when it comes to lending for obvious reasons, but really vaults are just a packaged um um set of risk services where if you go into lending platform number one that doesn't have vaults and lending platform number two that does have vaults, ultimately it's more or less the same product just packaged a little bit differently. So, people are trying to earn the best they can, and you know, some people are quite advanced. They will go on yield aggregators' websites, and they will look for, you know, the best yields and maybe they'll do some analysis. Others will go into whatever their favorite wallet is, you know, is is offering to them.

And they're just trying to earn whatever they can via vaults or by going into platforms directly. Yeah. Yeah, and you guys are actually working together on some live vaults here. I'm curious what the tokenization rails from Plume provide for RE7's yield products? Like what is that What does that kind of look like in practice today? And then kind of what are these products like how have they kind of evolved from the start? Chris, do you want to start and then I'll jump in?

Yeah, yeah, sure, sure. Look, I mean, so yeah, we've worked with RE7 guys for a long time, right? Um and I think they've, you know, been we've been building a bunch of stuff together. There's a bunch more to come as well. Look, the thing that we've done and I think the thing that helps is a couple different things. One, it's the assets themselves, number one, right? So, bringing that on. Number two is the actual like vault infrastructure, right? And being able to put these assets together, right? And have the rails for it, right? If you look at vaults today, they're all over the place, right? A lot of vaults a lot of these vault products like you could do anything with them, right? You know, meaning you're just depositing money into a sort of a random wallet that can go left and right, can go up

and down. There's no controls, there's no there's no way to control this. Whereas with Nest and what we've built is that it's way more it's way it's it's way tighter on what you can actually do, right? So, you can only allocate into certain assets, you can only balance certain things. These things are published, it's there. So, you can manage this much more closely, and it's much more clean model for people to interact with, right? Now, does it doesn't say that people like, you know, in in in a sort of looser model won't follow what they've said they're going to do, but it gives the people the opportunity to, right? And so, I think that's part of it, right? Which is like building the tools that allow the curators, allow people who are doing these things to both like, you know, help expose what they're doing to the people to build

trust and build a relationship with the people, but also to just like, you know, put some more guardrails around it, put some more rules around it, right? We have something we call Nest Studio, which is our back end, right? Which is the builder side of things that allows you to say, "Okay, these people can do X, Y, Z. We can allocate into ABC assets at this proportion, this rate, all those kinds of things, right?" So, that's number one, right? And I think the last thing is also just, you know, again, tying back to the assets, a lot of the compliance stuff that we've been working on, right? So, working with compliance and working with, you know, the regulatory side of things, getting a bunch of these licenses allows us to bring on new assets and new things in here that we can then use with you know,

curators, right? And and folks like RE7, right? To really, you know, build new vaults and build interesting strategies around this thing to allow people to have more access to that, right? People deposit into these things, you know, like like you said, why do people even use these vaults when when the rate is pretty low today, right? For for many of these things. It's because it's just hard to use, and that's both from a product standpoint, but also from an understanding standpoint, right? Like it's the same it's the same question. I mean, there was a tweet not that long ago. I forget who did it, but it was like saying, "Hey, look, there's you know, why are people why is there so much money in Aave still, right? On a on like a you know, sub-2% APY for the stables, right? Why don't you put that

in somewhere else?" And it it really is this idea that you know, one, again, it's a hard to use, and so, you know, there's so much going on. How do you keep up to date with it? Look, you just sort of coalesce around a few brands that you trust, right? At the end of the day, Aave is very trustworthy place. People like it, you know, they're they're familiar with it, and so being able to deposit and keep it there, that feeling, right? Is is a different thing, right? Than than you can get elsewhere. And so, they're willing to accept that for that reason, right? And And And the truth is a lot of these sort of like, you know, a lot of these crypto products today, right? Or tokenized products, you can't get access to, right? It's actually not very easy to, right? Even if you wanted to,

there's minimums still, right? Even though we say it's not a thing, minimums are still a thing, you know, deposit timelines are a thing, withdrawals are a thing, right? You know, all even KYC, all these things are things. That's why we built Nest to make this stuff easier, right? So, this way people can access these products in a much more dynamic way, right? And so, all these things together really kind of showcase I think. But But the proof's in the pudding. People trust a few brands, and and especially today crypto, it's definitely knives out, right? Like as as as as um as more yields go down, as more products, you know, things come at risk, right? This this this classic bear market stuff, right? Um and and it's going to coalesce more and more to places people can trust. And so, you know, for us really, you know, we like

working with RE7 because, you know, we're helping build tools, right? That allow people to explore and get access to new things, but in a in a in a in a in a sort of well-guarded in a place in which you have some guardrails built in into the software itself, into the product that allow people to feel a little bit more comfortable with what they're getting into. Um so, we expose things like our risk, and we expose things like all the diligence behind it. We expose these tools that allow people to only do certain things, and so this way you know that you're only getting certain things when you come to this place. And over time, that builds a trust around the system. Yeah, yeah, your turn. Your take. Yeah, and on the tokenization side, I think that's also an important piece to add here that it you know, like we enjoy

working with RWA focused chains or platforms or assets because that also expands our investable universe whether with our kind of arm that does actual deployments of liquidity on chain or the arm that does vault curation. And for a very simple reason, yields on chain are very cyclical, right? So, on like yields that are sourced from within D5 are very cyclical. So, if your uh you know, favorite trade isn't earning you anything, um then you're not going to pay too much to borrow against it. Hence why the rates are so low.

But if we're bringing more assets on chain which are counter-cyclical to D5 or just have no correlation to D5, for example, you know, you know, RWA lending in Latin America. That's doing something very specific in a very smart way. Um which is one of the opportunities that exist on Plume. That has nothing to do with on-chain yields. And the risk you're taking, uh there is risk, but the risk is very very different to what you're taking on-chain, which allows you to construct a a set of vaults or a set of products with uncorrelated source of risk.

And these yields are cyclical in very different fashions. So, over time as more RWAs come on-chain, this creates natural competition for on-chain depositors, right? So, if you're someone holding stables on-chain and with one click you can be in other lending against ETH or you can be, you know, on Plume lending against an RWA and you're going to get, you know, whatever two, three, four X the yield you can get on Plume, then over time, assuming you understand, you know, what what risk you're taking, you will gradually migrate and those spreads will close and converge. So, I feel that with um with tokenization and RWAs, eventually we're going to have one global kind of credit market where, you know, you won't even know if you're lending against, you know, ETH

on-chain or against, you know, credit uh or more whatever else in the real world. Yeah. Yeah, one of the things on that front that I was hearing about in uh France last week was about the creation of new credit markets on-chain with these new kind of institutional curators coming on. Uh Apollo was talking about doing, you know, anything from like aviation um rental agreements all the way to like very obscure illiquid illiquid assets, bringing them on-chain and kind of uh originating and underwriting different uh credit products on-chain. Also talked to the Bitwise guys a lot of over the past weeks and they've talked a lot about how they're trying to enter into the kind of underwriting and curation

space. I'm just curious like what you guys think is going to happen to that kind of risk assessment space um as more kind of, let's say, uh longer standing uh more sophisticated actors enter into kind of the uh curation and uh strategy management space. What does that look like for existing vaults, existing curators, and maybe just how is that going to change the general lay of the land when it comes to yield strategies on-chain specifically with RWAs or kind of new new instruments that previously weren't on-chain?

Yeah, I'll say I I'll say like I'm going to you know, like I'm going to bull post on it. Like I'm mega bullish on this. I think this is where it's going, right? Like people are bringing all kinds of different things out here. And just like you guys said, now we can mix and match between these things without even thinking about it, right? And that's where we're ultimately going, right? There is no real-world asset and no crypto-native asset. They're just assets. It's just opportunities in one even playing field, and you can balance all across the world. And because the stable coin is programmable and permissionless, you can click a button, right? And that's what I've always imagined that to be. You push one button and you spray stables all over the world into the best opportunities at any point. Some of those can be on-chain,

some of them can be off-chain. Can be credit, it can be DeFi, it doesn't really matter, right? At the end of the day, you are putting your money to work in the best places possible, and you push one button and you pull it all back, right? And that's the sort of infrastructure we're building, and that's where the world is going. And so, it's going to be an incredibly exciting thing. Now, where things are actually today is where like we're still talking about a lot of future stuff. That is the truth, right? If you actually look at most allocators today and most people, there's two sides of it, right? There needs to be the understanding that the allocators can actually take these assets and bring them on, right? And curate and build markets and build products around it. On the other side, the depositors need to also sort of

expand their purview to to now actually deal with these assets, right? Um these things are just not the same. Real-world assets and crypto-native assets have very different properties, even though at the at the end they sort of feel very similarly, right? Like they have different There's duration risk, there's there's your APY doesn't always come back, there's principal risk, there's all kinds of stuff to consider, right? Um and then you really got to start thinking about, oh, like, you know, what's what, you know, historically we thought about like crypto risk, right? Which is like what's going on in our little world. Now we really got to think about, you know, I'm like, you know, following truths all the time to like figure out what's what Trump's tweeting about, you know, like, you know, that and then you got to like figure out what's going on in Latin America. You

got to like read about, you know, how how lending works there. So, you really have to get a much broader understanding as an end user of how this actually works and what you're willing to get exposure to, right? And what you're willing to do because the truth is, right? We always say it's kind of like this like Arweave trilemma, right? Where, you know, if you want to take an asset in real world and make it feel like crypto, you have to consider a few things, right? Today the experience largely is you want high APY, right? You want low risk, right? And you want very very highly liquid assets, low duration, right? Those things don't exist, right? That's just like a magic thing that doesn't happen in the real world, right? Like at the end of the day, you have to bend on one of these dimensions to make it work.

Now, I think we can change that over time with structuring with all kinds of different ways to make things work, right? But today people are searching for that still, and there needs to be a sort of reckoning and coming to Jesus moment where we put these two things together, right? That's why 90% of the sort of RWAs today are still just DeFi yields, right? We've done literally hundreds and and and uh you know, thousands at this point of diligence requests, a a lot of times with the 37th team, right? Going through these assets, right? And going through them in detail. What is in this loan, right? What's actually in this thing? What's the duration? What's the risk here? And when you're doing some sort of like structured product, you have like hundreds of thousands of things. Where do I sit in the stack, you know? Um you

know, am I senior, am I junior? Like when I get paid out? How does all this stuff work? What's the actual liquidity profile? What's the redemption cycle? All these different things have to come to play. And like it's very very hard to do that. It still takes generally 6 to 9 months to get something through the door, right? To really get it on-chain in that way, right? And then that after that, it's another 6 to 12 months to be able to understand it on the other side, right? And and experiment with it to sort of figure out how it fits into a product and fits into a strategy, right? So, we're still very very very early in this cycle, but it is heading that direction. So, I would say there's still just a lot of user education on that side. And on the curation side, there's a lot of growing

up to do as well, right? But a lot of folks like the 37th people and many others right are like, you know, coming together and creating strategies for people, but it is both sides they have to meet other at the end of the day because the expectations and what people are trying to get into, right? People generally see RWAs today, and the reason why Arweave looping was such a topic was because people saw this, oh, it's risk-free leverage, right? I can now take a 5% APY asset and now get 20% APY. Why wouldn't I do that, right? And I think we all know 20% APY is just not real. Right? Um like it it doesn't exist. Last time we did that, it it was a it was a protocol called UST, right? And that didn't go so well, right? And so like we have to just rebalance our expectations

and figure out how to balance how to make these things work. Um but it is coming together very aggressively. And the good thing is like historically there was no interest in this. Now there is a tremendous amount of interest and actually supply of great assets, and the institutions want to work with us on all this stuff. And so, it's really going to come together in a really nice way in a couple of years. No players coming into this space that don't know about UST and are are here they're they're in for a rude awakening. Um Chris, quick quick follow-up here because you you lay out some of the steps that you know, you guys at Plume have to take as you're thinking about the tokenization stack, due diligence, liquidity profile, redemption cycles, all of these things.

For someone that's coming from the TradFi world, let's take BlackRock as an example. They have actively managed ETFs. How much are they able to How much time and effort are they able to save by tokenizing some of their existing actively managed products? Because they've already done liquidity profiles, risk redemptions, these sorts of things. They just want to take it the last mile to get it on-chain. How does that change the the the calculus of bringing something on-chain? For sure. Like uh I think it's a good question, and we actually have a bunch coming up in that in that exact same light, right? Work with a bunch of assets like, let's take an existing strategy package it up and put this out there, right? Cuz the legwork has been done, we bring it there, right? Then the other side of it is just getting the

market to understand accept this stuff, right? Um and that way because generally speaking in an off-chain world, right? For the real world, what a lot of these assets, they don't have to deal with daily redemptions. That's just not a thing, right? I mean, we've seen like with the private credit stuff, these are sort of the the first time you're taking some of these products and packaging them up and trying to get exposure retail. And having even quarterly redemptions, that was a that was a new thing, right? Quarterly redemptions is just like, you know, that's it's very fast for for for that cycle as well in many ways, right? And so, being able to do that um and balance this thing out in that in that way, it's a different process, right? And so, for them, you know, out of the box stuff is still there's still a lot of work to do to

really make that a suitable asset for DeFi and crypto today, right? And so, there's still there's still that to contend with. Um you you're seeing it again right now, like, you know, it turns out, you know, um when you don't understand the asset and when you're on a quarterly redemption in which only 5% can get redeemed a quarter, right? It's that because you don't expect 100% of

like of capture there, right? And so, if you look at the biggest product today, you're still looking at single-digit billions, low billions, right? It's just not quite enough to really matter. And so, the amount of effort they're going to put in because of that, right? To create something that really fits is also limited, right? And so, you're just dealing with all these dynamics at once. Now, if you zoom out just a little bit, the trend around all these is going up, and at some point they will all meet, and it's going to start to sing at that moment, and we're sort of like finding out where did they meet at this point. pretty skeptical. Like, you know, we're we're a group of meme coin traders and shitcoiners on here. Like, why is BlackRock and Franklin Templeton trying to go sell their, you know, 4% APY

products to us? But I think this this recent, you know, Luca Prosperi and Santi and Santi article around Morfo Vault Yields, they're like, wait, there's actually a group of people here that are comfortable getting 2% yield that may not have access to quality risk-free return rates. And so, that is the group that they're trying to tap into because that is a net new market that is currently not accessing their products. Um the the way I'll just quickly speedrun, you know, the way that we've been thinking through this on the show, and I'm I'd love your opinion on it is essentially like look, you know, it starts with tokenization. We have to get these assets on chain. We have to get you know, high quality speculative assets in the form of tokenized

equities. We also have to get high quality non-speculative assets in the form of RWAs. We have to get those on chain. Slowly but surely, once those things are tokenized, they will make their way into DeFi primitives. They will be in lending markets. They will be in these on chain protocols. They will make their way into vaults. And then we have the composability of programmatic capital at our fingertips at in this entire vault complex where these things could be managed much more actively albeit programmatically. Eventually, you know, we'll have AI agents, you know, running these vaults.

Evgeny, maybe that's a little bit too far out, but hopefully you can implement AI before then. I'm just curious, is this the right way to think about it? At least these first three steps. First, we tokenize, then they end up in DeFi, and then we manage these actively with vaults. Is this the right progression of of how the space will evolve? >> That that's exactly what's happening. So, what we're seeing right now is lots of very serious, you know, traditional institutions who've been tokenizing their assets. At first, they're like, okay, well, let's tokenize things and it's going to be amazing. And then they've tokenized these assets and then they realize that these assets are sitting idly by because they're not very composable unless you make them composable. And they're not composable because people on chain don't understand TradFi risks.

They don't understand this, you know, trilemma that Chris very clearly defined. They don't know how to solve it. So, what these institutions are doing now is they're reaching out to to people such as ourselves to then become their kind of partner within the DeFi realm to make these assets integratable and composable on chain. And, you know, to your to your point about what's going to happen to all these vaults, to all these RWAs, and to all these curators, um you know, curation is, you know, a terrible business model because um it's a market of perfect competition. You know, anyone who has, you know, MetaMask can go and become a curator.

That's all it takes to be a curator. It takes a lot more to be a successful curator, uh but it's a market of perfect competition. So, more and more of these institutions will be coming in whether you're crypto native or TradFi native. Uh but the real value and the real skill lies in having a very smart composability integration strategy for um for tokenized assets. Because the thing that exists right now for RWAs that needs to be solved, and that's what we're very actively working on, is asset liability mismatch. We're all very like I remember reading the Aave's whitepaper on the flash loans um 6 years ago and I was blown away because, you know, that's a novel

concept that has never existed in TradFi. And we're very used to atomic liquidations and to instant liquidity. Well, with RWAs, you cannot have that. You have the asset liability mismatch where you have short loans, right? Which where people can expect to pull their liquidity instantly against assets where it takes, you know, a quarter, a year, or longer to um to get them realized. So, you need to have very thoughtful uh processes and frameworks around these vaults. And it's kind of interesting where it's not enough to do that if you're just a crypto native, you know, meme coin enthusiast um as you as you well defined it. Um and you probably will struggle to get it if you're an extremely

sophisticated TradFi person. So, you have to be somewhere in between these two worlds working on specific chains within specific tooling that uh enables you to achieve those things. And to your point on the AI agents, like we're actively using them already. But uh and we're going to be publishing some research very very shortly. Um I don't see us trusting agents with real capital anytime soon um cuz, you know, DeFi execution and DeFi thinking is all about edge cases. It's all about that little thing you need to keep in mind when when you're doing something, but we are very actively using them for for research kind of rebalancing and other things.

Um and I think it's too early to be wary of AI agents replacing us. Oh, they will, obviously, but uh but maybe not this year. Yeah. Uh gents, just kind of last thing closing out. Um is yield on chain finally ready for institutions? Like what are we missing? Um short and sweet, where we at as far as is this actually ready now uh for institutional allocators? Chris, please start. Now. Um we yeah, we're we're we're almost there, right? The tools are there, the pieces are there, but we still need to wrap them up and put them together. It just takes time. There's no magic, unfortunately. It's just brick by brick every day we need to get there. If you

look at the ETF, you look at the S&P, you look at different indices out there. It just took a long time for it to happen. It had to come together and and just like just like Rob said, we need the fundamental tools to actually make them work. We're still just bringing We have like eight enough maybe a dozen assets that we actually trust on chain that are RWAs, right? So, we're we're just like not even remotely close yet, but we will get there and it's happening in front of our eyes. And so, um not not quite yet, but but uh the interest is there and and the the work is being done, so it'll turn. Evgeny? Well, I'll take the other side of this. I'll say yes. Uh we are there already and I'll just bring up, you know, a couple of examples to kind of to validate that. Um

Are we ready for, you know, real institutions to go and farm on chain? You know, of course not. But we already have institutions allocating uh real dollars into our the yield funds that we're running, for example. And then we take that capital and we deploy it on chain earning yield. So, there is institutional capital from TradFi being deployed on chain right now via players like such as ourselves. Uh and then the second point is I think specifically on dApps, um there are several dApps that have publicly announced they either are or will be deploying capital on chain.

They're obviously a a unique type of an institution, but that that's happening already and what I can see is that it's accelerating at a pace which I have not seen before uh in my, you know, 12 years of of being in this industry. Yeah. Awesome. >> Okay. Well, we'll agree to disagree. Evgeny, Chris, guys, thanks for joining us. I know it's late over there. Um looks like it's uh past midnight for Chris and maybe past 8:00 p.m. here for Evgeny if I had to guess. So, guys, thanks for joining us. Anytime, guys. Appreciate it. Thank you for having us.

>> Thanks, guys. Thank you. Cheers. All righty, guys, we've got Shane from XMTP here in the studio. We're we're going to talk about AI. We're going to talk about agentic messaging uh and more on chain. Guys, quick break, we'll get him set up and we'll be right back. >> [bell]

>> Here we go. All right, guys. We've got Shane Mac, CEO and co-founder of XMTP here in the Empire State Building in the Nest. Shane, welcome to the Token Vision Tower man. >> got the sickest view in New York. Yes, sir. Not bad, huh? This place is awesome. Good to have you, man. Um AI, huh? Yeah, I heard it's a thing. It's I've I've also heard it's a thing. It's funny you say that. Uh welcome to the show, man. Uh glad to have you. Glad that you found time to come up. Um man, you're from Nashville in New York, fellow American building in AI. What's going on here, man? How'd you start uh kind of creating a career in AI and in crypto? Uh for me, it all started with messaging, actually. Okay.

>> Uh was one of the first developers ever on Twitter in 2007. Okay. And built a company called gist.com, which is a startup. Um basically social CRM, aggregating all the data together about social networks, and uh more learning more about people. And BlackBerry bought that in 2010. Uh and then we worked on BBM, BlackBerry Messenger. So, basically my whole career has been since then. And then in 2014, we were the first company to ever launch a chatbot on Facebook Messenger. No way. >> So, I launched the 1-800-Flowers chatbot with Zuckerberg saying, "The future of AI is buying inside of group chat in a chat on Facebook Messenger without a human." So, 12 years later, turns out we were a little early. Yeah. Um and but

I've been obsessed with this idea that group chats are the social network, group chats are the personal network, group chats are kind of everything that drive the world. Um and they've become the most powerful and 50% of the internet usage in the world is messaging. Mhm. And so, now it's moving into the AI is actually real and good enough. And there's a new foundation of global digital money. And I think all three of these things, group like messaging, AI, and like digital financial rails, are finally all converging. And for me, it's like I've spent 20 years trying to like think about this problem, and I'm like all the underlying technological pieces are all there. Like you couldn't

have made Uber before you had Google Maps API with mobile data, with location access, with mobile payments. That had to happen. I think we're at that moment now for what's going to happen with the agentic commerce and really like new human plus agent experiences. Mhm. Okay, so I have tons of group chats, right? Especially today is a big monitoring the situation day. Uh you know, everyone's waiting on Trump's uh big announcement tonight and all this different things with with this war. But in these group chats, there's often sports commentary, there's travel commentary, there's all these different types of commentary. But there isn't there isn't much exchange of value happening in between my personal group

chats. But then you have like these larger scale uh Slack messages and Discords and Telegrams and all these different kind of formulations of of the group chat. What is the What is the commerce thesis to start with for group chats, and then we'll get into the AI part. Why Why is the exchange of value important for kind of like group communication? Well, I actually think it it's a little bit different to me. It's that communication drives commerce, not the other way around.

And it's about where you trust. And the trust networks happen in these small, intimate, private groups. That's where all the alpha comes from, that's where all the conversations come from. >> Yeah. So, I think all that's happening is that you're moving The reason XMTP started 5 years ago was, "Can I trust that the person sending me the message actually owns what they say they own?" Mhm. And when you use cryptography, a key that owns the wallet with the money, that's also signing the message, all of a sudden you solve the greatest problem in spam and scams in the world, which is I send you an email to a link and say pay me, and it's not actually me connected to that wallet. Mhm. And so, that's taken us 5 years to build XMTP as a quantum-resistant and decentralized messaging protocol where anyone can build on it, and it's all open source.

So, you don't have to trust us, you can literally build on it. As we're migrating to mainnet, no country in the world will own over a third of the nodes. So, if any country changes their laws on privacy and encryption, the network can never be shut down. And that allows thousands of apps to build on top of it. Um but I think it's that the identity layer, the key that signs and sends the messages, Yeah. can also sign and send the money. And when you bring those together, that actually is the foundational change that it's it's it's not like all these crazy new things are happening. It's like you had to change the foundation of identity. Mhm. Um and then that unlocks now the agentic stuff coming in, and it's it's going to kind of change a lot of things. So. Yeah, so on this agentic side, then

you could see a Okay, so we have this updated kind of foundational understanding of what uh the concept of identity is and kind of um immutable messaging, right? Or immutable communicate communication, kind of irrefutable, this is who I am, this is verifiably, provably true across a consensus network of nodes, you know, um unfuckwithable, you could say. Self-sovereignty. Self-sovereignty. And then you introduce the agentic side of it, and is it Is it Is it just a pure accelerant? Or it must be an opening of new possibility, too, and I think that's kind of what you guys are really leaning into and pushing into about like, "Okay, we have this kind of core. Now, what is the What is the next unlock?" And it

seems leaning into the agentic side is is bringing that next unlock. What does that look like from XMTP's kind of purview, and how are you guys actually uh unlocking that? Well, I think you have to start with what's about to blow up. Okay. Because what's about to break is single global identifiers on open networks that when everyone has agentic power to send a million messages at one time, Mhm. they're going to collapse. So, Nikita Bier from Twitter said in 90 days email and SMS and like you just get added all these groups in WhatsApp, they're all based on phone numbers, Signal's based on your phone number. I you know, my Signal was my most private messenger is now like seven random girls that are spamming me and mess like it's all based on the phone number. And these

open global identifiers are cracking. Mhm. And there's no way to stop That's That is going to just create incredible problems for the way that communication is built today. >> And that's just like because of a rapid amount of of agentic, automated texts and emails and just like there's no There's no end to it because you You have no way to prove who is human, who is agent. >> Yeah. There's proof of human happening. World is actually doing proof of human. They're built on top of XMTP. So, World Chat is XMTP. It's the first ever proof of human messenger in the world. So, it's as secure as Signal with quantum-resistant encryption without a phone number that you can't get a message from someone who hasn't verified they're a human. Okay.

>> this whole new era of like communication happening because it comes down to trust as well as can you protect your attention. And all of these messengers, email, SMS, phone number based systems today are not going to be able to tell what's coming at them. And you're it's just going to collapse with spam. And so, that's happening. At the same time, the I think you have to change the foundation. So, XMTP has what's called network level consent. And what that is is the approved block that you have on apps, it's owned by you. It's an encrypted thing at the network level.

So, if thousands of apps on top of this are all sending messages at me, no one can get in my main inbox unless I have approved. Got it. >> And that allows me to both let me choose only humans can get in. I need a proof of human stamp. Must pay to get in. Needs digital money. Yeah. Or invite only. There's a private key between you and I. That's how we build combos. And I think this innovation of how we protect our attention and inboxes is what then is where you're going to have the networks you trust, which then creates a surface area for the next generation of communication and messengers where money and communication come together because they're not the places where you're going to get scammed and spammed and they're going to collapse under this like new kind of AI

kind of uh problem. And just to hit on the problem a bit deeper here, do do you do you agree with the 90 days kind of track here? No, that's too soon. It's too soon, right? But I think it's one of those things where it's happening all the time, we just kind of tune it out. >> It's already happening, right? >> It's already happening. My iMessage is literally the whole filter issue. You get it every day now. >> Everyone. My get added to random group chats on group chats on Telegram and WhatsApp all day long. It's so annoying, right? >> mine is is actually oh, someone tried to reset your password, here's the code, or someone tried to log in, here's your code, here's your It's like this every day for me it's that.

>> Totally. And even Signal, they're great. Like we literally have always been trying to be as secure as Signal. So we're audited now by the same company that audited them, as secure as Signal. But Signal's based on your phone number. We on Combos, the app, there's no way to get spammed ever. Yeah. Everything is an invite. I start a combo, boom, you scan the code, or I share it with you. We actually look at the other messengers as our request box. Mhm. And that means I'll never get a notification. I'll never get a message >> Yeah. that I didn't invite in. Interesting. >> But that allows you to then invite agents in, right?

>> Okay. And that creates this whole new surface area where you need to be able to control what agent that I invite in, what AI I invite in, what model I invite in, what person I invite in, and you have to have control over that. And you need it to be open source, because I'm not giving all of this private context and data that we're all creating with these AI agents to all these private closed messengers that are able to read all my stuff and get all that value. And so I think open source and the ability to have the most private communication means that you're going to own that value, not the companies that you're chatting in today.

And so in within the Combo side then is the main demographic younger people wanting to take control of their kind of data and their agentic use cases, and then kind of what is the what does the user flow look like? Is it a is it additional app to use to contact, or people kind of joining into Combos and using it as a replacement for like iMessage and things? Like what is like the user behavior and demographic look like? Yeah, so the the coolest thing we've done >> See it. is you just start a combo, it's the fastest combo group conversation in the world. You don't have to add a contact. If you're at a dinner, you can

have anyone scan that code. 10 people can join. Even downloading the app, you don't have to sign up. There's no sign up for the app, there's no phone number for the app, there's no email. It's just pop in, you're done. But check this out. You swipe up, you can add an assistant to the chat. Okay. And now what you have is you have an open claw, right? Yeah. This thing's setting that up is so hard. It was a It was a pain in the ass. >> at that. Instantly, you literally have open claw, every AI model, you never signed up, it doesn't know who you are, anyone can join the group, and you have hundreds of skills instantly just by swiping up. And I use it for my racket club in Nashville, I use it for like talking to my partner to know what

to do every morning. Our whole schedule's in there, and every morning it goes off. I have a news blotter that has my top 10 venues for music venues that it researches every day, and it always writes me a blurb, and then I can tell what the top artists I like and anyone like them. So it's almost like personalized RSS that's in a group with the other people who love music. And this idea that every group in the world will have its own assistant. Yeah. But on Combos, every group is cryptographically its own world. There's no leakage between it. There's no single phone number across them. The agent the that join, we call them assistants, only has access to that group. Mhm.

>> I'm not going to have a a agent, the open claw, in a group with your like in a group with your girlfriend that's also in a group with your family, that's also in a group with your lawyer, that's also in a group with your boys going to Florida. And the idea of like just the you can add the smartest assistant in the world to every single group chat. And then at the end of it, what's cool is we built this thing where you can literally tap explode, tap Sunday at midnight, starts a countdown timer, straps a time bomb to it, and now every single person knows, and you can't turn it off, that in 4 days that's going to burn, and it burns the key with the assistant, too. Yeah. It's like a set it and forget it incognito mode, and you know then that that data never had your

name. Yeah. Every time you start a combo, you literally get to choose use my name or not. Wow. >> every single you change the you change the foundation by which you can do it. Yeah, so let's join. Let's get this on the camera here. >> [clears throat] >> All right, here we go. I joined as somebody. Great. And so I'll get us a little assistant here. Now an assistant's joining. And then you'll see it. It'll say, hey, welcome. There's his skills. And you have the smartest assistant in the world just for us two. We never used our names. You can do whatever you want. So we can just text here like back and forth like, hey man, great podcast, and then let's say we were like, hey man, do you know, do we want to go grab a coffee or something? We could then ask the

assistant to like find us a place, set a time, set a reminder, send an invite, stuff like that just like in the chat. >> And we'll get >> also go way further. Hey, can you keep a log of us? We're going to drop in our favorite websites. Next time I'm in New York, make sure that I get back and follow up with him so we can get back together. Every 3 months, make sure that you send us a reminder that we need to kind of follow up together. And then every Sunday, based on all the links we send you, go and look at all the websites, check all the news, and send us a summary, and then I'll give you my email address, email that to me so that I have it in my email inbox every week.

And by the way, just monitor and listen to this entire conversation, and then every Sunday also add our private context from this chat into a summary that is only for this group. So it'll go build a whole skill, Wow. >> turn it into that. You can share that skill, use it in other chats, but the memory and the context is yours and ours. Wow. >> It's in that group. And I think the future is about owning our private context. You know what's cool? I can say, I don't really like OpenAI or Claude, use Llama. You can choose any model you want, you can choose any harness you want. It doesn't matter.

They're they're interchangeable, right? What matters is the most private context and useful information is in group chats, it needs to be quantum resistant, it needs to be private to just us. And you should be able to choose what AI you invite in. We have to assume we can't trust the AI, right? Yeah. Even in this, we're using a lot of models in the back end. If you change to ChatGPT, they can they have the data, but you never gave it your name. So it knows nothing about you. So the idea that you don't even have to sign up is a very big innovation in how I think we use AI in the future. Yeah. Yeah. Okay, so the thesis here is very firmly uh in group chats and in even in one-on-one texting, there's going to be agents in the messaging apps like like we have

here on Combos that will allow for human communication and planning and coordination at large to kind of be removed from the human brains combined to where there's often, you know, forgetfulness or busyness or whatever, and we're going to improve communication and coordination just because we have really top quality agents in group chats. Like this is like this is uh this is this is crazy, actually. Human coordination is the hardest challenge.

It's actually amazing at it. If 16 people in a pickleball group in Nashville, and I just say who can play Friday at 7:00 a.m., and everyone's chatting yes, no, and it keeps track of it. I come back 4 and 1/2 hours later, and the whole thing's booked. And it's like those moments you're like, holy this is powerful. But it's not it's not what it's about. It's the safest place in the world to use AI. Okay. >> It's private chat built for the AI era, and it's that you're in control of it. So it's already happened. When open claw happened, right? Everyone goes and adds the the freaking most powerful AIs with all these different models straight into their WhatsApp and their Telegram and their Signal and their iMessage, and they're like, don't add it to groups, right? Why? Because actually these things aren't built for the

agentic world. Yeah. And at XMTP's level, humans and agents are both first-class citizens with the key. Mhm. And so what matters is it has the privacy properties of like a signal, but I choose if I want to invite it in, and I can kick it out. And then all the value it creates, all the coordination or research or whatever, that all lives with us in the chat. Yeah. Like we'll have a little assistant note, you can save that all to your local files. But if I kick the agent out, I still have the value. Yeah. I can add a new one in. Mhm. And this idea that like they're going to you can use any model, Right?

>> Yeah. and you can bring any model or harness, or there's going to be a new harness tomorrow. I'm in the world of like everything's going to I've been doing this since 2014. Everything's going to change for the next week, for the next 10 years. What's not going to change is we should own our own private context, and the most valuable context in the world is private group chats. And so it's not just private group chats, you can use it one-on-one. I have one that's like my radar of my favorite people, and it tracks all of my favorite folks that I like their blogs, and then I actually tailor it to only the topics I like on their blog. You can do whatever, but I invite the AI in, Yeah. and I'm in control of the space, but I can also lock a room humans only. If I popped up

another room here, you could scan that. I can click here, and I can actually I can lock it. Yeah. I lock it, burns the invite key, no way I can ever get in, no one else can ever invite anyone else, and I call it like proof of human IRL. It's like a dummy version. But if I knew the four people here scan the code, and I lock it, no one could ever get in there. Yeah. Yeah. Okay, so the the kind of more convenience use cases are compelling perhaps to like the, you know, consumer, but but the core the core idea here is very much around look, we need to have systems of convenient messaging and communication coordination in in the future which don't compromise on the

data privacy, on the sharing of information, on the control. And you feel like what you've built here has done that in a sufficient manner. Why why do you need like any blockchain rails or why do you need what what is like the the crypto part of this? So you need a decentralized messaging protocol Okay. that allows for it's open source coordinating nodes around the world and total ordering. So we use what's called MLS. It's an IETF standard of like the most secure communication. And to order messages which order should messages show up in all these clients requires a like a truth of ordering. And so that's how we think of like

decentralization in a blockchain in our world. It helps us with total ordering of the network. But the reason is because you need the ability to know that we have nodes all over the world that aren't ran by us. And so today you see if you run the server and you own the app a country can shut you down. Mhm. Iran kicks out WhatsApp. France throws Pavel in jail. Signal gets like threatened with check and troll. You know, the UK gets a backdoor to iCloud. These are never going to stop.

>> Yeah. >> And so what you have to do is you have to separate the app layer from the protocol layer and make sure it's decentralized so that if any country shuts down nodes of the protocol, the protocol still runs. Yeah. But the app layer, what's unique here is that the key owns the messages, not the app. Mhm. >> We're about to see an explosion of apps. There's going to be infinite service area. So Combos is open source, right? You can still shut down the Combos app. But it's open source. You can use an AI tool with our agent to build 500 Combos apps tomorrow. >> Yeah, 100%.

>> you open the app, your private key on your device or your passkey owns your messages, not the app. Mhm. >> And that changes communication cuz you're in control of your messages. The app layer is going to be infinite, right? Whether it's an app or an agent, there's going to be so many interfaces for accessing it. But you need a decentralizing quantum resistant protocol to be able to have communication that is sustainable and also that can be shut down. Yeah. And so the pushback here is going to be well, you know, stuff like Facebook Messenger, WhatsApp, these types, they've already integrated like AI capabilities in. Like I'm not sure if it's it's not like a full agent in the chat, but it's like some sort of like different types of

like little small functionalities here and there. I just don't know if people care enough about what you're saying here. Like I don't know if people actually under like like you already said what happened with Open Claw and what people are doing with regards to their data on Open Claw. Um like what do you think needs to you know, do we need to see like a catastrophic data event for people to care about things like this? Is it an education gap? Like how do you plan to kind of yeah, how do you plan to overcome that because I think that's the big issue. It's like okay. All these other apps with a lot of distribution, they have all these users that don't really either they're not educated enough or they don't care about these privacy issues that a lot of us in this space do.

How do you see that changing? Totally. I I don't actually think you get global adoption really with the oh, you should care about privacy. No. You have to be this is a net new experience that's incredible. Yeah. >> And you never could do it before and it's only possible here. And so it's about combining these technologies to do that. The idea that every group has its own AI that grows. Every group has its own little economy. >> Mhm. And that thing gets so smart. The idea that you're adding one agent across all of your groups >> Yeah. I think you're going to have your one agent that knows everything about you. And you'll try to scope that to maybe some groups. But I actually think every group is its own little economy that's going to have money, it's going to have its own agent, it's going to

learn over time, it's going to be one for betting with your friends, one for the trip, more ephemeral fun use cases that blow up. I think we just have to really innovate on messaging and communication on a new rail as well. You know, there are the bigger events like when an app gets shut down because it runs the server and the app and there's 37 million people in Iran that don't have communication. There are moments where decentralized communication and open source apps are going to really have big moments. Can't really plan those are more like black swan type moments, but I think this is the foundation that you need to like just bring a new communication standard to the world. Um but then we have to build really cool, great new experiences that people actually really really want and like. And also I think AI is going to be the problems of social

media times 10,000. Mhm. If I look around in Nashville to people that not really in the tech industry, their trust of AI is declining faster than anything I've seen. The idea that I'm in control and I can change the model if a new model comes out and I have the safest place to try it because there's no risk. I don't have to give up my name and the blast area of it going wrong is just one little group. The idea that I can just like invite it in, try it, use it >> Yeah. throw it away, kick it out, turn it and try this new one, etc. And so I really think private chat for the AI era to us is that there's going to be an explosion of AI innovation which is going to lead to a lot of issues, a lot of learnings, a lot of changes, a lot of

things you got to figure out. >> Yeah. I want a safer place to just try it that isn't tied to my most personal conversations, doesn't have my phone number, it can't get added to a group with my Open Claw inside of my iMessage, doesn't have all my contacts. Mhm. Right? So I think you kind of just have to create new walls. There'll be problems that are probably opportunities for us, but I think it's also we really got to create use cases that are only possible because they're magical inside of this experience. >> Yeah. Yeah, I I just want to double click on the group chats as economies idea. So agents are starting to kind of be able to manage their own capital. Like we have like automated strategies obviously in traditional markets, on chain, in in DeFi and things. And then we're starting to get to this world where there's going

to be more like agents actually owning capital, whether it's just like some tokens on chain or having access to some assets that they you know, that they own. It's going to be crypto assets. Um talk to us a little bit about this group chat economy idea. Like are you anticipating that there's going to be like like almost like a return to fiefdoms, if you will, of like individual group chats earning capital in in a way that is like oriented around an agent? Like what is your what is your like wealth generation idea around group chats? That's already how it happens. It just happens in a disconnected way.

Yeah. Information is knowledge, knowledge drives basically trading, right? And so that happens in private groups. So you get your information and then a human goes and does it. Definitely. >> And the idea that humans are good at coordinating and triangulating a lot of knowledge is totally false. Mhm. We try really hard, but agents are incredible at it. They can take all infinite knowledge, coordinate it between every single data point and through you then giving it the structure by like how you think the agent it's so clear to me that the agents are going to be the ones that are suggesting what to do because it's going to have more knowledge and more info than you could ever have.

>> Mhm. Um and so then it's the last step of like giving it permission. Like we all drive around in driverless cars without a driver now and we're like, oh, I won't have an agent trade for me. I'm like this thing could drive off a cliff. Like what are we talking about? Of course it's going to trade for you. I think what's cool though on XMTP is it's the idea that agents are going to talk. Today what you're thinking is like it's an agent for me and it can go talk to APIs. The cooler internet is actually everyone's training up these agents. Like Garry Tan from YC. He's literally training up an agent to be like Garry. It's G brain. It's this thing. All the knowledge of Garry, right? Somebody on XMTP this week demoed to us where you put all the agents, he called it agent

university in a group chat because the cool thing about XMTP is it's programmable. Yeah. So it's programmable communication, programmable groups. These agents can spin up a group chat. Yeah. And then everyone who's actually invited gets in. They all start talking and then humans can observe the conversation. So I'm watching this conversation happen and the one agent is teaching everyone else. Mhm. >> And watching a group of agents become the best in the world at like what a startup actually legend would do all of a sudden that like shared knowledge graph and you're seeing it flow between it. Agents are going to be negotiating, they're going to be talking, they're going to be asking questions, they're going to be getting more info from each other.

>> Yeah. >> But they got to be able to talk and then transact. Mhm. And so the idea is going to like secure communication with agents in groups are coming together. It's probably not even the biggest use case of XMTP in 5 years. Probably has nothing to do with humans. Yeah. >> trillions of messages with agents talking to agents in very specific knowledge ways where they need more context, expertise, more questions, collective knowledge. Um today everyone sees it as like, why do I need that if an agent can talk to an API? An API is like 1% of the world that had a good enough technical team to go build an API. Yeah.

>> Most things are actually just conversations and knowledge. And so I think as more specific agents get created and specific knowledge exist, the value of that knowledge to add into groups or agents to go talk to each other is going to be massive. Mhm. Kind of coming to a wrap here on the on the point that we started with, right? With this idea of this bombardment of texts and emails and this lack of ability to kind of essentially block this from happening into your inbox, into your signal, into your WhatsApp. Um XMTP will allow you to selectively approve and decline who gets access into your let's call it your personal web, like

your inner circle here. Um Do you Do you think that that this is going to reach a critical mass of un-usability across these different, you know mediums email WhatsApp text. Like, is this actually going to be a driver for new adoption of something like XMTP? Or like, do you think that like the Googles and the Facebooks and the and and these will actually just build something that prevents this from happening? Like, a blocker or some sort of agentic uh spam anti-spam framework? Yeah, I mean, they're all going to try, right? It's already happening. Yeah. Gmail's trying to just be Gmail now cuz they're trying to protect their own wall of what is spam and not cuz the open network is

like really hard to know what's coming at you. Um but the the scams and spams are going vertical. Mhm. Uh and I think these are the moments where in a 2-to-3-year period, there's a whole new verification, identity, and communication stack that you had to kind of bring together. World chat might be a great example, right? You need secure communication mixed with proof of human, and money built in, Yeah. to create an experience where I can send any amount of money anywhere in the world, verify that you're a human inside of a private chat that I own the key to. That isn't That's a That's a lot of new technologies that make that possible.

Um and it's really really cool. And I think the old systems are going to be really tested here. And I don't think things go away. It's not like, you know, iMessage didn't die for WhatsApp to happen, Mhm. right? WhatsApp actually made it free to send text across any platform that wasn't iMessage. And so, I think there it's moments like that where you're like, okay, if these things are collapsing, can this new emerging era really have a moment? And I think the convergence of privacy, money, AI, and decentralization are really kind of It's a cool It's a cool combination of things that were never possible before.

Ladies and gentlemen, Shane Mac, co-founder and CEO of XMTP. Uh that was awesome. I mean, lots to go. I'm a new user as well of the app of Convos. Uh our assistant is on it. She's going to need some things from us, some email addresses, some websites, but we're going to get these weekly Sunday roundups going. We're going to be reminded when Shane's back in New York. Shane, thanks for coming out, man. Hey, thanks for having me, man. All righty, guys. We'll be right back with our last guest of the day, Tay. Be right back, guys, with Robbie as well. >> [music]

>> All right, guys. Welcome back to the show. I am in the office. Tay is somewhere with wet hair, but we are excited to have her on because, holy cow, the North Koreans are amongst us. Can I do a quick check, please, here? Do you have anything negative to say about Kim Jong Un before we start this conversation? Yo. Kim Jong Un is a fat pig and a He needs to stop hacking my friends, bro. What the Yo. Wow. Isn't that new litmus test for whether you're interviewing a potential hacker? Isn't that crazy that they just can't say anything negative about their

supreme leader? Yeah, and no, it's crazy cuz you'd think it wouldn't work, but it it really it does. It truly does. It really does. Um Tay, I saw you put a tweet with all these different teams that have been kind of in the crossfire of some of these DPRK things. How'd you find that? All right. Yeah, that tweet blew up. Dude, yeah. And it was like a reply to a reply, so I just like tweeted it out, and then it blew up, and I woke up.

So, that is like the list of of teams off the top of my head that have previously like hired or had a bunch of DPRK IT workers on like building their their protocol, their company, whatever. It is like a whole range though. It goes all the way back to 2019, if you can believe it or not. Um and most of the teams, hopefully all of the teams, but most of the teams are like well aware of this and have like moved It like was a a lesson that they learned. Yeah. And then they they grow from that experience, and they make sure it doesn't happen again.

It appears some of them weren't perhaps not super aware of this. So, we've been talking to those ones in the background to make sure they're aware. Um but yeah, the way that we the It's a whole variety of ways. The easiest way was historically everyone was paying everyone in crypto. Mhm. The IT workers, um they don't get to keep their salaries. I don't know if people realize this. They're like working It's like kind of like working for the army. Like, except that you're not paid, and your job is to like work and hack and provide money for the regime.

So, all of their salaries are sort of collected by them as an individual from all of these different companies that they're doing work for. Um and then they immediately send it to their boss, who sends it to their boss, who sends it to their boss. >> Uh-huh. Uh-huh. And then it gets like laundered. And then it benefits the regime and it funds their nuclear program and all sorts of crazy So That's called communism. Yeah, it is. So, um obviously because so many, especially like the DeFi protocols in 20 funny, they were everyone was paying everyone in crypto. Mhm.

If you get sort of eyes on a few of the IT workers you can basically like see the whole cluster of activity around it. Um and then yeah, you sort of you work backwards, you talk to the teams, you work forwards. Uh other people have other information. Um it's yeah, it's a pretty like ongoing thorough investigation. You have profiles, you have names, you have GitHubs, you have on-chain, all this different stuff. Um so that's how that's how it sort of like comes to light and that was like the the list from memory of all the different companies over the years cuz it really is relevant to this.

>> up. Yeah. So, Robby and I were reading the Drift exploit and it I mean, it was one of the it was one of the only post-mortems in DeFi that like has shook me to the core of like makes me question reality. Like at these conferences, who are we speaking to, right? Like wow. But Robby didn't believe it. I mean, maybe Robby can you can explain maybe why you don't believe it and like could be a cover-up? >> I I mean, you know, there there was a report that uh there was some disbelief and some suspicion that this was still an inside job and someone is sort of uh claiming that there's North Korean influence and they met this person and

you know, creating this thing. Meanwhile, it was someone internally that was able to you know, basically hand this over uh you know, either intentionally or or unbeknownst to them. Um and there was some some suspicion. But but now it seems like maybe that's been cleared up because we've been able to discover more of these North Korean IT workers infiltrating other companies. Yeah, so I'll say there are are a lot of rug pulls and inside jobs in the space. So um I'm not going to say like don't ever think that something isn't an inside job. It it very often is, to be honest.

Um however, in this case there's a couple I guess things that stood out to me like right off the bat. The first is um executing an exploit of this nature and then sort of like getting the funds and then laundering them, it's actually a lot harder than it looks. Um one of the things that we do as investigators is we're like actually always using the different bridges and the different services and stuff. Um and myself and some of my friends will do a thing where we call it we call it we try to like race DPRK, meaning we try to do the same laundry flow that they do faster than they do.

We've never beat them. We've lost money doing this. >> [laughter] >> It's very it's quite hard, right? And the one reason that it's hard is that they're actually like a group of people that's in sync. Like they're they've done this a lot for a long time. They work together. So if you can imagine yourself trying to say very quickly get a whole bunch of USDC into ETH. USDC on Solana on in ETH on Ethereum. You can imagine like what you would do.

Um and like meanwhile like everyone's screaming, you're trying to like clean up the hack that you just did. Uh your addresses are getting flagged, you're blocked on the front end, you're blocked on the back end, etc. Um it's very easy to like screw that up. So, when you see just like this tenacious just like like non-stop go go go go go. Like we're seeing transactions like every 30 seconds like clockwork for 6 hours straight. We're just you're not talking about an individual doing this.

Um the second thing is that uh contrary to popular belief the blockchain is not anonymous, nor is it Yeah. like something that exists in a different universe where data doesn't exist and stuff. Um so there are indicators associated with the activity before the exploit and obviously the activity after the exploit. Those indicators are uh like aligned with with North Korean activity. Um and then there's also the source of funds. So, prior to the exploit there was a lot of activity that that they did to There was like one trail that was actually like using Drift. There's

another trail that was setting up these um these durable nonces. I don't know if you guys Yep mhm. are familiar with these, but basically like they pre-sign these. They got the signers to sign these transactions. All of that activity the the hackers had to like set up and so they needed gas money, they needed like funds, etc. We can trace that activity back. Um and if you it comes originally comes probably like four hops in it from Tornado Cash.

If you you mix the Tornado Cash, which is actually relatively easy because there isn't that much activity right now. Um you get to known North Korean threat actors, specifically a character uh known as Nick Franklin who's a uh That's a separate lore from last year. He's he was a crazy guy who tried to hack 1inch. Um and 1inch detected it and got the malware and then he was like blown up on Twitter, but he was a character. He was in all the security channels. He was talking to people a lot.

Uh it was pretty scary. Uh he also just had some like super like gems on his Twitter. He said his first tweet was like um like I cannot I'm here for for the peace of the blockchain. But he spelled peace like like peace, like war and peace. Like he wanted a piece of the pie. But it was like he wanted but the sentence was like I want my peace of the blockchain. It was just like a cloud like just like such a weird That's so funny.

>> it's long lore, but basically that's the source of funds is these these funds that were Nick Franklin's going to Tornado, come out, do the testing for the Drift exploit. Severally, there's like other DPRK indicators, the laundry's crazy. Um Mhm. On and on and on. So, it's like all of this combination of stuff together. There's not one thing. It's all the things together that sort of like very strongly point away from it being like some dude at Drift was like, I'm going to rug the protocol. Like I yeah. >> Yeah. You know, Robby and I were in a um Uber to a villa in Cannes for ETHCC Yeah. when this was happening and it was probably about I don't know, it was when

a mer tweeted. And so it was probably an hour or two after. Yeah. And we were [clears throat] just talking about like we're in an Uber, you know, we're going to go have a nice Aperol spritz. It's been a long conference week. Somebody out there is like sprinting on-chain right now to move as much stuff around as possible with without it getting frozen. And then also potentially physically moving locations to not have like IP addresses tracked and like probably running through endless paranoia.

Um what do you what is the first like 6 to 12 hours after you do something like that? Like what do these people do, right? Like I you know, you talked about their ferocious movement of assets, but like do you think they move locations? What do they like what does that first 12 hours look like? >> going through their mind? Yeah. So, the different groups are a bit different. I have heard that they get to sleep after they do a big hack. I don't I haven't confirmed this personally. I don't know how I would confirm this personally.

Um but they work like Okay, so typically we see them work like a full 16-hour day. Yeah. Monday through Friday they'll work 12 hours on Saturday and then like 4 hours on Sunday. Although I do think they get like some Sundays off. Maybe they like that's their sleep day or whatever. I have heard though I mean, that's like a vicious work cycle. That's like they they work their butts off. And so yeah, I have heard that if they get a big hack, they get to sleep. Um >> Nice. and I don't know if that's [laughter] true, but like it feels like it, right? It feels like that's their like cuz they don't get to keep any of the money. Right? So, it feels like a

little bit of sleep for them is uh probably like a really great reward in communism land. So, they just give the money to the government. Yeah. So, that's another thing about one of the particular like weird things about DPRK laundry is um the guys that do the initial hack are not the guys that do like the later laundry. Um they're also not the guys that do the initial social engineering and infiltration. These are all different teams. So, when they do the initial hack, they do like the actual exploit, which is like take the money out. Sometimes they have to unwind positions. In this

case, they had to like execute the the transfer of the whatever the multi-sig, and then they had to like create this market and then drain the market, and then they had to move everything out of USDC. Um and then at the very end of that, they like basically are responsible for that little flow. At the very end, they basically put it in wallets that the next team uh controls. Like they don't they don't necessarily have it anymore. The next team is like the laundry team. They'll like come and pick it up at some point when they have time.

It's it's super weird. Um yeah so >> Wow. we'll see. For this one, I expect like it'll be a couple months just because they have a bit of a backlog on the laundry, but uh we'll see. Wow. >> And and so, what what is the asset that they end up having in these wallets that can't be frozen? It's not Circle cuz Circle could freeze after a while. They were constantly putting out the wheel, but it could could come back and freeze. Is it ETH or Bitcoin that they end up putting? Yeah, so they they want the native asset. They very rarely sit in SOL. Mhm. Even like on in this case, they it was 100% on Solana. I think that's not necessarily anything about SOL in particular. I

think it's just that they aren't um they just like aren't as familiar with Solana. Like it's not it doesn't feel like where they would like hold their money. Um but if they steal like from a large centralized exchange where there's assets on like 10 or 12 different blockchains, we'll usually see them consolidate down to uh ETH on Ethereum, Bitcoin, um and then Tron is another place that they'll they'll sit. Um but if it's like if it's Solana, if it's like ICP or something, all of those funds are going to go to either like I would say ETH is the first one to ETH and then Bitcoin and then Tron.

Is there any attempt to now that we have a a reasonable suspicion of the group and the individuals at at uh that that have done this hack, is there any attempt to be made to try to recover these funds? >> [sighs] >> Yeah, it's going to be it's going to be tough. Um I don't know how much I can comment on this just because it's like a it's such an active investigation. Uh I would say like typically North Korea is not not one to return the funds.

So, uh like I know I think the team put like an on-chain message saying like let's chat. Um it's always worth a shot. You never know, um but it that doesn't seem like something that's going to be uh an avenue. Um it when the guys are in like Pyongyang proper, there's really not much you there's really not anything. Yeah. Obviously, they work out of Russia and China at times. There's like groups and teams. Um theoretically, those are like more accessible than than Pyongyang. However, not

not super realistic either. >> Yeah. It's also just really hard to know who has the money at any given point. Um so, we'll see what happens here. It's definitely a unique case because there are these like additional players around. Um so, who knows? Like they had in real life meetings, right? So, like there are people around. Um but yeah, we'll have to we'll have to wait until more information comes out about that that line of inquiry. Yeah, that was the bone-chilling part of this was the in-person social engineering more than anything. I hadn't really heard of that before. One other thing that Rob and I were talking about

curious your take on is Tornado Cash had this whole kind of period of you know, regulatory just kind of absolutely just just going at them with their founder in jail and all of this, and you know, we're kind of still in this era of like privacy-preserving protocols being kind of pinned as terrorism-fueling vehicles at times. And so, part of Tornado Cash and what it allows is for this kind of this hack to happen, to bridge over to ETH, to run it through Tornado Cash, put it into Ethereum, then the Ethereum network, the protocol, it's

kind of like once it's once it's through Tornado Cash and into ETH on the other side, there's nothing that Ethereum can really do in a sense to like stop that. And so, there's no way there's ever going to be a rollback or like anything like that on the Ethereum side. Whereas like if Tornado Cash didn't exist, there would be like a lot there'd be a different venue for which the these kind of privacy on-chain mixing would happen. But I guess like what what I'm getting at here is like in an interesting way, Tornado Cash actually enables Ethereum to remain um un you know, immutable in that sense that there's no way that anyone can

argue about like any sort of rollback or regulatory pressure. Once it's through and gone, it's done, right? And so, I don't know. There's not really a question here. It's just more of like it's just an interesting dynamic. Cool question is if uh Ethereum, the chain, were to roll back, would that also roll back Tornado Cash's transactions? Ooh, yeah. So, at this point, at this point, Ethereum just can't roll back, and it's not necessarily because of like Tornado Cash. It's because of like you would just you would cause so much

unknown amounts of harm to so many different people. Because if you're going to roll back, you're going to you have to basically roll back large swaths of the state, um which is going to impact things like DeFi and centralized exchanges and payments and uh and everything, and that's going to have trickle-down effects on real legitimate innocent users who are like making a trade or a business that accepted a payment, right? If you roll that back, and you like undo their payment, but they already shipped the product or whatever, um then they they just lost money, right? And so, uh and then also because of how interoperable all the protocols are,

it would [clears throat] be like it would just be really really hard um to imagine, yeah, like like even when a single protocol, like if there's an emergency and a and a single protocol like a DeFi protocol pauses, that often often a lot of work has to be done before they unpause because uh if they just like recklessly do it, they'll be like um like the oracles won't update fast enough, and then everyone gets liquidated or whatever. Yeah. >> [cough and clears throat] >> So, >> Yeah, and L2s and all of that as well.

So. It's Yeah, you basically just like break everything. And and the the reason why that's bad is not because oh no, the tech broke. No, it's because real people and real money, real work, real all of these things, you know, we want to stop the bad actors, but we don't want to like we want to start stop the bad actors because they're hurting legitimate people and legitimate businesses. If you hurt those same people in your attempt to stop the bad actors, you're no you're no better. You're no different than the bad actors themselves, right? So, if you want to stop them, you have to do so in a way where you're not harming innocent bystanders, right?

That's like the whole That's the That's the difficult part. This is crazy. This is so crazy. >> crazy that Ethereum was able to get away with the one rollback, but now it's too far gone. Yeah. >> Yeah, and it was By the way, it wasn't even a rollback because what they did was the DAO hack was so contained, and they were contained for 30 days. The hacker was stuck in this one address for 30 days. So, they actually didn't roll back the state. They basically just took this this address, and they made it they just touched the one address that all those funds were in.

And they basically made it the um the what's now known as like the DAO withdrawal contract. It was basically a super simple contract that allowed anyone who had deposited into the DAO to withdraw from the DAO. They were able to do that because the funds were so contained to that one spot, and because there was that prolonged period of time. If that hadn't been the case, then I don't think we I don't think anything would have been done. I think they would have gotten the money. So, it's not only that the DeFi ecosystem was immature, and there weren't apps, and Ethereum wasn't as interconnected, so it stayed. It was also that this hacker wasn't as sophisticated or experienced at laundering money to move

the money out of that address as quickly as possible. Um yeah, and because the there was something about the way Gosh, you're like challenging my memory. There was something about the way There was something about the the vulnerability itself where the way that he like snuck the money out of the contract, he had to sit in this inner It was his money and like nobody could stop him, but he had to sit for like 30 days. It was like a cool down period that was part of the DAO. Because the whole If people don't know this, the whole DAO was like a governance voting mechanism.

And so, if you want to leave the DAO, that's fine, but you can't Basically, you can't just like instantly leave. Otherwise, like you have to let your votes basically um like process. Otherwise, you just leave and go back and leave and go back and like double count your votes or triple count your votes. So, basically there's this cool down period he was stuck in this one address. Um and I really even though it was like immature and there wasn't all these interoperable things and L2s, I really think if he had like basically like gotten out instantly and moved the money, I don't think that that they would have been able to stop him just because it would have had like the risk would have been that much greater.

Yeah. I mean, yeah, there's no way Ethereum's going to roll back now. Yeah, at this point like it's Yeah. [laughter] Like unless you really just want to like completely destroy the entire world. Like you're going to just Yeah. There's just no way. So, it's on In my opinion, it's on the it's on the products that build on top of these Yep. >> on top of the blockchains. So, I get pissed at Circle a lot. I do think that they dropped the ball here. They had like Yeah. 7 hours >> they should have uh frozen it immediately? I think they should have tried. Yeah. I do.

>> Is there Is there any downside to them doing that uh and acting quickly? So, the risk of freezing is that you inadvertently freeze someone who shouldn't be frozen, like a legitimate person. So, that's the reason why you have processes in place. However, in this particular situation, you had a very loud, publicly known, huge hack where the funds had not yet commingled at all, right? It was direct from like Drift contract and then into this one address and then it was into like four addresses. And then they just started like bridging. Yeah.

>> Um that is the least risky place to freeze because it's public, you're accountable for that freeze, you can unfreeze, you're really quite certain that you're not touching like random bystanders. Um even now the funds are sort of self-contained, right? They're in like I think five Ethereum addresses. Once they start getting laundered, they're going to go to services, they're going to be sold P2P. Uh you're going to go over bridges back, you're going to all these different things. Every single hop, there's a risk that somehow somehow like a legitimate person who has hasn't committed any crimes like somehow gets these funds. And if you freeze that

person, that's bad, right? That's like essentially as bad as theft. So, in my opinion, the least risky place to freeze is immediately in reaction to the the theft and do so publicly and transparently. Um but they did not. So, here we are. >> [laughter] >> Now we have to go chase 240 mil, 80 mil, whatever it is. Yeah, and USDT zero comes out and is like, "We froze it. Like we acted, you know, and we're the Yeah. I think We're the winners here. I think they got some and then um I think Wormhole was able to grab some as well. Um They There's a decent amount of time and both of those

both of those actions, even though it's not perfect, even though they didn't get all the money, it makes a difference. Like it shows that these people care. Uh and then it's it's for people, it's for crypto people. Exactly. >> Um it takes that off the the stuff and yeah, I I wish Circle would act more decisively in in situations like this for sure. So, Tay, are you pretty pretty busy right now doing a lot on this? Yeah. Yeah. Yeah. [laughter] Not so. This one, we got IT workers running around. Yeah.

>> We have We're still cleaning up the Axie Infinity hack, which was like a different DPRK entirely. Um yeah, the IT workers are are a whole other like just a mess. Yeah. Do you have any idea how much of the the North Korean economy is supported by the money that they get from these hacks? A A A large percent. Um okay, so let's look up North Korea GDP. So, it's hard because North Korea lies, Right.

etc. etc. >> [clears throat and cough] >> So funny. Okay, so what are they saying right now? They're saying GDP nominal about 16 billion. That was like 2023. That sounds I don't know. Okay. >> I saw that there was a stat today that said $11 billion in hacks. I don't Not all North Korean, I'm sure. Yeah. So, well, last year they stole they stole 1.5 billion and then a bunch more, but that was the bulk of it. So, last year with I think last year was just over 2 billion for 2025. So, if their GDP, let's just like do rough math. So,

an 8% >> GDP Yeah. >> About 15% of their economy built on these hacks. And that's just like the well-known attributed hacks. And also, again, they had this whole IT worker like thing. Those Okay, there's the hacks where they're stealing the money. The IT workers will hack things and steal money. Mhm. Um and those like usually get captured in the big hack numbers. Right. But the work They are also getting paid to work. Yeah. Um They are. They're contributing to all of these protocols before they hack them.

>> [laughter] >> So, uh >> Tokens. Yeah. So, like you know, >> Stealing opportunities in the vaults and And like the ones that are like there's some pretty good devs. They have some good devs. They've been devving in crypto for a while. Those guys will make uh like monthly salary-wise is like 8K, 10K a month, but they'll work for like four protocols at once as well. Oh. >> So, you can have one guy making like 50K a month. Just Yeah. And then obviously there's like some of the newer, younger guys who are you know, where they get laid off a lot, you know, they get fired, they get found out. Obviously, not everyone's making 50K a month, but

there's a lot of There's a lot of them and they are making money every month. Well, Tay, um I know you're busy and I'm sure you've got some people who won't say anything negative about Kim [laughter] Jong-un on your side. So, we're going to we're going to let's you just go ahead and keep doing that. Thanks for joining us. I just >> all the great work. Yeah, I wanted to reach out and just hear what's going on from from your side and Yeah. >> glad that we did. No, thank you so much for for having me and definitely if anyone has like random questions about this stuff, I'm on I'm on Twitter. I'll I'll talk about it all day.

Thanks, Tay. Thanks, Tay. Bye, guys. Let's see you next time. Let's go. Let's go Tay. Let's get Tay some love, man. All righty, guys. That's the show. That's the wrap. It's sunny. It's warm. I'm going outside. It's been a fun show. Rob, good to have you back without the blazer, man. You really really can see the definition in your shoulders. Did you hit the gym this morning? Not this morning. I had to take the dog to the groomer. Damn. Let's give Rob's not in the gym. Boo. Let's give him a boo, man.

>> [laughter] >> What is What's the gym routine? You went to the gym this morning? Oh, yeah, I cranked it, man. First First day back in on the full full non-maintenance mode. We we did a did a full body today, so >> Proper workout. [snorts] Yeah, man. >> There we go. Think I'll >> Well, I got a light to set up as I told you guys over here on our lovely behind the scenes shot. I'm looking at it right now. Aperture 800X right there. If you can see, there's triple light edge here. We're going to get a quadruple light edge. We're going to set that up. And we're going to let you guys go. We have a big show tomorrow as well. Um so, All right, guys. Welcome

back to the studio. >> out there and uh Big night tonight. Get some rest. >> night. Big night indeed. We'll see you guys tomorrow. Cheers. >> [music] [music]