Why Circle Won’t Freeze $285M in Stolen Funds

Transcript

Just on the topic of Drift and just like since we're going down this rabbit hole I I appreciate you bringing me to school here. But like for example, I have a lot of money in Jupe in Jupe land, you know, Jupe Solana DeFi. Obviously, had money in Drift actually. I just hated the UX. Like the interface is so annoying. Uh and so I moved it out. So thankfully I'm like not directly compromised. But in the spirit of contagion, obviously I saw some JLP, $50 million of JLP. Does that affect me as somebody who's on Jupe land? Like am I going to log into my account and see less money's in that account? Like how how how does contagion work here? And and is there contagion?

But I mean the risk the risk with these sorts of things uh typically is that they're going to try to get whatever funds they can into something that they can launder, right? Um so, you know, the the the risk would be that they've got a token, you know, a large amount of a token that they're going to dump. And then the token drops in price, right? Um probably less likely that they have a token that's like being used as collateral for a bunch of things. They dump that, the collateral Like this is possible, right? Like the the the nightmare scenario is like they compromise one thing, they get a bunch of tokens, they dump it. That causes uh you know, a bunch of positions that were

otherwise solvent to become insolvent. So like this, you know, composability is a brutal thing. Um but it doesn't look like on the face of it that that like Jupe Jupe JLP Jupe land, like I think from like a liquidity perspective, I think they'll be fine. They've got a lot of liquidity there. So. >> [snorts] >> Yeah, that's mine. I think it's and I everyone's working really hard to contain it further. And I will say that for as bad as like Solana is generally at key management type stuff, they actually do have a lot of policies and controls on the like liquidity mechanisms. Don't know why this is. Like But okay, I'll take it. So, um they I

don't I I was reading some stuff earlier today on or or like an hour ago on the different things that they were doing. Like it does seem like there's some like liquidity stuff and they're taking action. So, hopefully they can contain it. Um USDC has to be super ass moved here. I mean in a world where you have a Solana coin that can freeze, I feel like Jeremy and crew just need like 20 guys lost >> Yeah, the prob- the problem is that like um USCC is just not it. Like they just don't >> They're not going to. They just don't they like I and I haven't really heard a good explanation for why

uh they're so hesitant to freeze things. I mean it's to the point where >> They've just delegated it. They They are They say instead of having internal policies and making up our own mind and controlling our protocol, we're going to just you have to make the US government force us to do that. And personally, I think that's the stupid the stupidest position that you can take. You're begging the government to enter your stuff. You've deliberately given up the sanctity of your protocol to the US government. But most importantly, um just because a judge signs a warrant doesn't mean that it's true because this is crypto tracing.

Okay, you can convince a judge to sign this up because it's crypto tracing. There's very few experts in this. When we're talking about like complex stuff like this and emergency orders, it doesn't go together. So, you have two approaches. One is you do it like Tether does and you actually have a team of people who like they have very like the thresholds that they require to freeze are high. It's not like they just run around freezing stuff. But they decide their policy. Circle, their policy is if a judge tells us to freeze it, we'll freeze it. So, in instances like this, it's a low most minuscule risk, right? Big hack, known, very very public, hasn't moved yet. It's in the address. It's in the

direct theft address. It's all over It's everywhere. If you can act quickly enough and freeze it, there is almost no risk because there there's just like so few places where it could like somehow get into a legitimate person's hand. And you know what? If somehow this like wasn't a hack or something, you can remediate it pretty quickly. >> you can unfreeze things. Like we're not saying like nuke nuke it from space and like burn the money that's in the vault. Like it's it's kind of crazy. Um the whole the whole position of Circle here reminds me a little bit of like early DeFi. Like code is law, bro. Like there except they're like law is law.

Like we only respond to the law. Like we have no ability to respond to anything other than the law. It's like the absolute like antithesis of crypto that's like we don't believe in the law, we only have code, and so there's nothing we can do. But like both of them are just not defensible positions. They're not. >> practical or pragmatic positions that you can really hold. They're like insensible. And you know, at least the DeFi people have been like, okay, we kind of realized we were [ __ ] Like Circle's still like, nope, nope, law is law. That's it. Um all right, let's let's quickly dive in cuz we have some details here now of of what's happened. Um let's dive into the actual

mechanics of this thing. So, um it seems like uh there was an admin key um that was compromised that then locked Drift out of the admin functions um so they couldn't freeze the contract. Um that in and of itself feels a bit strange because my my assumption here is it's not a single sig situation unless unless and you know, this is um this is something that actually uh hasn't come up for a long time. But like um and

we used to have these like single sig freezing contracts. Like lock like one person um like back in the back in the olden days, right? Like one person had the ability to pause the contracts for a period of time or freeze the contracts for a period of time. Um this was like a uh you know, like if you can't raise everyone on the multi-sig quickly enough, you can pause the contracts and then you can unpause them. Um we ended up walking that back cuz it was like too risky um for for reasons. But like there was a long period of time where like on the Synthetix multi-sig, um any one of the multi-sig holders could freeze the contract for like 3 hours or something.

And then if they did, if they were compromised, it three more people could come in and unfreeze it. Um could like override it. Um so, maybe there's something like that going on where like they have some like emergency freezing function here. Um so, the the admin state um uh in the core program got updated. They created a new market for CVT. Um they increased the withdrawals, began draining all the pools. Obviously, once they they presumably pumped that token and then they bridged out.

Um so, the the admin signer was compromised um or or someone intentionally did that. Um that feels like just a a like vanilla key compromise realistically. I mean, I know it was a There was it's definitely a multi-sig for what it's worth. I don't know what the thresholds are for sure. But like it's definitely a multi-sig. It's interesting that So, they compromised the the compromised the admin.

And then they had to do these things. But it wasn't as simple as just taking the money out or sending the money like Bybit situation. They Yeah. So, you have this new market. And then remember when I was talking about Solana has all these policies? That's what I'm talking about, right? So, they had to update They They have a threshold. They have like a a limit on how much money can move at any given time. However, that limit can be changed by the multi-sig. And so, the attackers had to compromise the keys, figure out what they were going to do, and then change create this new market and then like what? Create this new market, update the thresholds.

>> Update the parameters, yeah. Yeah. >> Otherwise, they were going to be limited by what they could get out. And then I guess actually execute it, right? Actually get pull the money out. I mean, I'll say this. As far as key compromise hacks go, they had to do more work than normal. So, >> Yeah. >> [laughter] >> I'll I'll give them that. It feels unusual. It's not like there's not like a one-shot like this [clears throat] is um Yeah. So, that's that's my optimistic take. It's like this is this feels like progress, guys. Like we're progre- like we're evolving. We just need, you know, we need to iterate a bit more. And

especially, I'm going to just say it again like the number one risk, no matter who you are, the number one risk is your device getting malware on it. Because once it's on it, like they can do anything. And I don't know if this is malware 100%, but like it is certainly looking like that's going to be what, you know, sort of at the root of this. I guess. >> So, so this is this is the second time that Drift has been hacked as well? I think uh there was there was um uh like a 2022 um uh vault draining like similar vault draining um issue where uh collateral was inflated and and money

was taken out. So, um yeah. It's not not amazing. Um not amazing. I think the interesting thing this definitely doesn't feel like a vibe coding. Like it is not like a hack. There's a key compromise, right? Like they didn't find some exploit in the programs that allowed them to like they've just changed parameters and made a thing and and you know, um had had uh admin um uh control. Yeah. Is isn't DPRK the typical process though would be like logically the the hacker if it was me and I did this, right? Like I wouldn't you know, most of the time guys take the

10% and like are stoked, right? Usually how that goes. Yeah. Okay. they'll try to offer a bounty, but you know. Yeah. And they should and they should um I mean they should secure everything first. That's how all these things work. Secure first secure, prevent loss, limit, right? Then sort of collect your wits about you, then you know, figure out um what you're willing to offer and what you know, if if it's even a zero approach here. Just offer 20 million bucks if you have the money if it's this. Like if the whole you know, if there's a compromise that can ruin your entire business and draw it down to zero, take 80% of the balance sheet and throw it off as a bounty, bro.

Yeah. Yeah. Better We tried to So, I think one thing that that people I guess don't quite understand is like there's two type of of hackers in the world. Like those who are going to negotiate and like that it's even possible and those who just cannot. Um if if the hacker is someone who is like willing to negotiate, then everything's on the table. In most cases, like they're just not. And so like in the case of DPRK, it's not because DPRK is like special. Like no, they're humans, too. Like you can totally try to negotiate with them.

The difference is that DPRK operates as like an organizational unit with hierarchy. And so the people that you need to approve the returning of the funds are not necessarily the people that you're speaking to and are not necessarily even like looking. Whereas with like a DeFi hacker, it's all one in the same. So, if you can convince your hacker, right? Um then you can maybe get the money back. So, it'll be interesting it'll be interesting to see what comes here.

Um With these hackers though, I'm sorry I'm just I'm sorry for keeping this >> [laughter] >> Hackers like a choose your champion like Kane. Do you have a hacker that's just better than anyone else? So, if this guy came and and he and he hit you, you know, let's say just theoretically, let's say let's say Infinex got popped. God. Right? Do you have a guy that you can call and be like, "Look, man, millions on the table, find this guy." >> [laughter] >> So, so uh so, I've got a few uh I've got a few people that I would probably call in that situation. And again, you know, I don't have any paratroopers that are going to be willing to like air drop

themselves [laughter] into North Korea, unfortunately. So, if it's DPRK, then like I might be going behind enemy lines depending on how big it is. Um uh which like, you know, if it was big enough, I probably would. You probably find me like sneaking across uh North Korean lines and uh trying to get these guys. I My friend who's over there, I think I could probably compromise him. And uh he he wants to become a life coach. I'm like, that's my angle, right? Is is compromising that guy and and [snorts] and saying, "I'll I'll smuggle you out, but you got to get me in first."

Um so, >> By the way, I would I would love to see like the Kane the Kane DPRK guy's life coach business arc play out. Like that would be like >> be amazing, right? >> of my [ __ ] life, bro. >> Yeah. Yeah. So, so yeah, that's my that's my angle. I would I would definitely reach out to him and be like, "All right, let's let's figure out like I'll get you out of there. We can do this." Um so, um but yeah, I think that you know, there there definitely people who help in these sorts of situations, for sure.

Um Yeah. Yeah. That's that's what I do, guys. That's why I'm in a freaking hoodie right now looking like a mess. >> [laughter] >> Literally. So, if you come to SEAL I'll just show it. SEAL 911, it's literally it's like 50 people who are just like super experienced in all different things. I'm one of them. I'm not on every incident and I'm not capable of being on every incident. But some incidents, I'm so on cuz I'm good at that. But then if it's like smart contract stuff, like we have like like Sam CZ Sun is he just like knows smart contracts so good. We have a whole bunch of them.

Like all the guys that they do super good stuff. >> Are you a part of the infamous SEAL Team 911 or Yes. No. >> Yeah. Hey, we're on the we're on we have a podcast with a name with a SEAL. Yeah. >> [laughter] >> Yeah. Yeah, no, of course she's Of course she's in there. This is amazing. Yeah, I spend way too much of my time in there. >> Okay, so tell the girl I'm calling if something happens. But also like we have like if you get just get like fished, you get drained, something sus is happening. Like dude, there we have so many different people in there. It's not just like the smart contract guys or the malware guys. It's like we have tracing people, we have the fishing people, the people that are like deep on the drainers. There's so many

different people. And so if you ever literally anyone listening this, if you ever like need help with anything that's like slightly security plus crypto, like you need guidance on where to go or something bad happened and you don't know what to do, SEAL 911 is literally it's like just a group of people that that Yeah. The odds that you have anyone better than SEAL 911 is zero. You just don't, like even if you think you you're like, "Oh, I've got a guy who really knows secure." You don't have that guy. We're donating to base. So, you have to donate to us. Otherwise we have to get real jobs. Wait, do you guys have donations or is this like a >> Yeah. Yeah. I have I'll link it. There's there's like there's a donation address.

You can just like send money to the address or we there's like a page I'll find it. There's a page somewhere that you can donate to like in, you know, I'm going to send a donation. Send me the send me the link. All right. Deal. Let's go. Yeah. And then I'll save it I'll save your butt, Luca, when when something bad happens. I'll be here for you. God willing it never happens, but I will say to this point, Kay, I'll give you guys your flowers. I mean, to to Kane's point, you guys are spoken about through the dev circles extremely highly. So, kudos to you guys for saving the space. Yeah, I mean we are so lucky uh that this is like such an interesting coordination problem, right? Like there was a period of time where, you know, I

would end up in war rooms, right? And like I was not the guy that you wanted in a war room. Like what the [ __ ] am I going to do, right? But people would be panicking like when BZ X got hacked for like the seventh time or whatever, I was in there like I've been in so many of these and like, you know, what would happen is you would be lucky if there was like one person who had some idea what was going on. Like, you know, when when Sam CZ Sun sort of stepped up and started to like, you know, save the world basically, like you'd be lucky if if he landed in there and then the goal was like know someone who knew him to be able to pull him in quickly enough to kind of try and help you. Like that was like the early

approach to this. Um and then I remember um Madi from Sigma Prime was like, "Hey, we're like getting a posse together." And I was like, "Oh, that's a good that seems like a good idea." Um and um and yeah, it's pretty crazy um that that this even exists. Like as a coordination problem, like it was really hard to know who to talk to when you're panicking and the world is on fire. And now it's like at least there's like a very obvious Yeah. thing. Like go and hit these guys up and they will they will almost definitely be able to help you.

>> And there's a business out of this, Kay. You guys need to create like a security engine. I feel like as these cases build like a Now, I'm serious. This is like a whole SaaS business for you guys that I feel like is super proprietary to like this skill set and then just be like the security engine. They're all too rich, Luca. That's the thing. >> [laughter] >> I am I am I First of all, I There are there are people in SEAL 911 though that like I'm like, you should like I'm not going to say this cuz like they should be there cuz like they they help people.

Yeah. Yeah. They are not like OG crypto like I am. So, Yeah. Um yeah, definitely the donations are definitely appreciated and it helps It mostly helps because you have to find the balance, right? You have to find the balance. Like this is it's 100% volunteer. Um even those people who have like jobs that they're working, they're dedicating like they're pulling themselves out of that job to like do like 3-hour shifts or 4-hour shifts every day or every night or whatever or to just be on call for emergencies. Um and that's in addition to their work. And so, they're you know, it's it's it's it's a huge amount of effort and

stress. Like there's only like certain types of people that that do it. and I'm one reason I'm so grateful Seal 911 exists though is that it used to be that if I got put in a war room, I did not have a choice. Like I it was like, okay, drop everything. Right? Drop everything and help these people because like who else is in this room? I don't trust anyone in here. I don't know anyone in here. They're a mess. They need help. Now when they come to Seal 911, if I'm like if I'm like literally driving or like with my daughter, I don't have to respond because there's so many other people who will. Yeah. But then in return when I, you know, like I was sitting outside enjoying the sun and then the drift thing happened, I I'm going to join that room, right?

And so that's how that's sort of how the uh like scheduling works is like you all you'll do it when you can, but you don't have to do it when you can't. Is there like a Yeah, I mean, like do I have to pass a test to become a seal? You have to be certifiably insane, Luka. You're not there yet. I'll be the negotiator on behalf of the seals if you needed somebody to go in. All right. Next time next time we need a negotiator, let me I'll try to pull you in this [ __ ] Penguin guy a little disarming the penguin guy.

>> Yeah, 100%. Yeah, like get Luka in here. They'd probably be they'd probably be flattered. If it's not TPIRK, they'd be like, "Oh, I get to speak to Luka. That's That's a good deal." Luka comes in and he's like, "Yo, deal here." I got you, but you got to give the 200 million back. Yeah. We'll get you some uh we'll get you some Pudgy uh merch if we can close this deal. Let's Let's Let's Let's do a deal here, guys. Let's Let's close this out. >> [laughter] >> I love it. I'm confident someone will take 20 instead of 200. I'm very confident.

All right. I'm serious. Next time there's an opportunity, Luka, I'll >> Oh, I swear. Plug me in. You have my phone number. Like I would love to do it. All right. >> [laughter] >> Okay, let's go to ads and then when we come back we're going to talk about Cloud Code source leak.