Zen & the Art of Wallet Security: How to Not Get Hacked | Daniel Chong - Harpie

since about 2017 2018 um when the Ico bubble came out I started coding on ethereum um I won eth Denver 2021 um with my team uh we built a anti-hack software and we ended up making that into a startup and into a company so I left Duke to start that company follow my you know startup dream of college so still living the dream hope to keep living the dream um we raised around $4.5 million from dragonfly coinbase Ventures openc to build um one of the top security tools out there for consumers right now um but I won't really get into that during this presentation it's mostly just going to be educational and my claim to fame is that me and my brother who's also my co-founder debated vitalic on stage at eth Denver 2021 22 I forget but we were up there that's our picture um I post that everywhere so um let's just get into it so for most people security is a state of mind and not a state of being so what does that really mean uh when when I talk about security and when Security Professionals talk about security it's usually pretty discreet it's measurable um you'll go through a checklist and you'll see like am I Iman to this okay check um am I vulnerable to this okay check but for most people that's not the way that we think about it uh the way that we think about it is you know do I feel secure does the marketing language that the companies that are selling to me make me feel happy and wholesome um do the pictures that they're using have smiling people that look secure and ultimately you know it's not a discrete measurement it's more like a Vibe check feeling that people have so the goal of my presentation is to kind of you know break that Dynamic make security a more measurable and discreet thing for you um and essentially give you a quick easy checklist of three points to say am I secure or am I vulnerable and just go from there so I would say the biggest feeling when it comes to you know how secure am I how am I feeling about security most people think you know I'm not going to be the next person to be attacked by a hacker by a scammer the protocols that I'm using aren't going to be the next ones that get attacked by um high-f funded hackers um essentially it ain't going to be me and that kind of causes a lot of issues that's a big reason why that whole kind of vibe check of do I feel secure versus am I actually secure comes from that's where the kind of Paradigm Shift occurs and I just want to get into you know who are we kind of fighting against as end users who are the people that are actually trying to steal your crypto um and I want to paint them in a way that that kind of visualizes the threat versus the stereotypes that we kind of see so most people assume that crypto scammers and just scammers in general are just like in this weird call center um or like in a sweat shop in the developing world they're calling everybody messaging everybody making Bots uh and to be honest with you that couldn't be further from the truth the truth is that the entire economy that causes wallets to be drained protocols to be hacked um causes this over I think over a trillion at this point um crypto theft issue is because of an economy that starts from the developed world with big Bank rollers um and moves across the world how does that system work uh there's three pieces just like any company there's investors there's managers and then there's developers so these Bank rollers are spending hundreds of millions to tens of Millions on projects um where team leads are hiring developers to attack certain protocols attack end users uh so it's in their benefit to make themselves seem like this you know call center in the developing world but what they actually are are corporations built to steal your money uh and the reason I kind of stress that point is because it back to like the The Original Point of security being this kind of mindset for most people instead of something concrete this illusion that hackers are are not educated are not smart are not good enough to take your money that's a big reason why people feel secure but are not actually secure so moving from there how I I guess like the big question is probably how do you know if you're safe there's a lot of conflicting security advice out there I'm sure there's going to be a lot of panels or a lot of talks here talking about you know here are the top 10 security tips for you know metamask users or whatever this is not going to be that kind of talk I want to create a way to definitively measure your wallet security um and actually you know give yourself an honest perspective like am I secure or not how can I be attacked where can I be attacked Etc so here are the three categories there's private key security there's transaction security and then there's action uh access management and I'll be going a bit in depth onto each of these so just giving a quick summary private key how do you steal your how do you store your keys transactions how open are you to fishing attacks and access management how many people have infinite access to your crypto um which is something that happens in crypto so getting into it for most people the security Journey stops at private Keys um stops at Hardware wallets so the uh and I I respect these companies a lot companies like treaser Ledger keep key um but it's it's and I don't think their marketing is misleading in any way I think customers are frequently misled to believe that a hardware wallet is the end all be all for the wallet security and I think that's just uh perpetuated by just kind of a community myth uh in reality private keys I would say are about like private key security is about 5 to 10% of an entire wallet security so what is private key security it's making sure that your the access to your wallet the master access to your wallet is not stored on like Google Drive I I know there's some people in the audience right now that that might be exposed right now but Google Drive screenshots I know screenshots are a big thing the notes app uh those are all really awful because those are stored in the cloud um they people might have access to it through other means other than um you know a lot of other means when you store your wallet and your recovery keys on paper or in a hardware wallet um it makes it a lot more harder to get that Master access to your wallet people would have to you know do the the the path of getting a private key from someone that owns a hardware wallet is a lot more difficult than other methods of theft so as long as you have a private key you should be um you know that's kind of the first step but it's not where your security Journey should end I I would say the biggest um there's two biggest portions and that's the transaction and access management portion so for transactions it's the the the key idea is am I protected against fishing attacks if if I was to click a link um and believe that it was something else what am I liable to lose all of my crypto assets so there's services and browsers that that protect you from fishing attacks um you know Google Chrome there's other companies like us that that help with this but for the most part um transaction security is kind of the most vague it's really hard because uh you're you're never going to know from so I I I guess I can illustrate this point with a story um one of my best friends um he's a developer he's been developing on crypto longer than me he's an OG Bitcoin Dev from around 2014 2015 and he fell victim to an nft mint scam which is like for most people that's kind of like an elementary level scam but just because he's exposed to a con constantly he's always on crypto Twitter he's always on telegram um just a hit rate of one caused him to lose all of a certain asset in his wallet um so is there a way to be truly protected against all fishing attacks I would say yes it's a combination of both separating your assets across multiple wallets and also using tools that make sure that you're not signing anything that you're not supposed to be I finally want to talk about access management uh and the question here is how many people have access to my crypto how many and when I talk about access to my crypto it's it's uh a very strong term and a lot of people don't realize that when you use a new app like this uh this example image is talking about pancake swap or if you're using a or openc or or any other Marketplace or service you are giving that company full access to all of that asset in your wallet so that means that at any time they can transfer the entire quantity of a certain certain token out of your wallet and into theirs for the most part a lot of companies use that power very safely um actually I I'll scratch that maybe about 25% of companies use that access very safely 75% of them suck uh they they get audits that that aren't useful um and what happens is that when those smart contracts get hacked when those protocols get hacked all of the customers lose all of the money in their wallets it's it's awful so when I talk about how many people have access to my crypto um reducing that amount is essential and I want to talk about a specific case and this is this is something that really was popular um last year but it's still continuing now if you guys have heard of the monkey drainer hack um this is this is similar so gasless nft theft what does that mean it means that people are losing all of the nfts all of the tokens in their wallet without even sending a transaction to the blockchain and the question is you know how does that happen why why are people losing money without even sending a transaction to the blockchain and it's because um nft marketplaces like X2 Y2 open C blur what they're doing is they have full access to your tokens of course because they're letting you buy and sell tokens but there's this weird feature on these exchanges that let you sign a signature like a login signature if you're familiar if you've ever used a web 3 protocol it's like that gasa signature by using a gasa signature you can sell all of your assets to another person in a private auction for zero eth meaning that if you sign that if you sign that gasless signature you've just given somebody else access to your entire Wallet balance for zero e they can buy it off of openc or they can buy it off of X2 Y2 this is one thing that gets solved super easily by just revoking that nft Marketplace access to to your assets so um what we what I've done for a lot of people is I kind of go through their wallet and see you know what protocols have access to your crypto and if you've been using crypto since like 2017 2018 it's probably around 50 to 75 protocols have access to your tokens if any of those guys get hacked you're done you're you're losing all of your money um so I would say that when it comes to the ranking of importance of actual Security in crypto I would rate hard wallets and just like private key security at the bottom and when it comes to scams and access um access management I would put those on top um and I just want to go into kind of you know the the logic of an attacker and why these routes are are the most like lucrative so if if I'm a hacker and I'm trying to steal people's money I'm not going to it's the hardest route for me to try to steal someone's private key at this point people know not to put their private key in like a website or anything like like that it's way easier for me to just get you to sign a gasa signature on on uh some nft Marketplace and sell all your assets to me it's so easy and it's mass-producible and that's why these last two points of kind of um transaction security and action access management are the most important to me so um I guess when it comes to actually solving those problems just going back to my slides for private keys get a hardwo wallet even though I kind of talk trash about them I have one I have every wallet that I have is a hardwo wallet you need one even if it's 10% you need one and get your private keys off of your notes app please and if you actually did put your notes app private key maybe make a new wallet uh for transaction security make sure that it it it doesn't matter what service you use to um prevent fishing um but your eye is not the only one like your eye is not trained enough to track every single fishing scam out there so please just use a service that's out there there's plenty of them and finally access management make sure that you're revoking your approvals as soon as you put them in um there's a cool website called revoke.us kind of the end of my presentation I know I I talk kind of fast I want to leave the floor open to any questions um I don't want to hammer on these points too hard yeah go ahead so the question was um so there's a new kind of Paradigm in wallets where they're giving you the ability to Define how much of a certain asset you're giving to a certain protocol so for example I have uh well I wish I had 100,000 usdc but imagine I had 100,000 usdc um and then I gave Unis swap access to 10,000 that means that they're only able to access 10,000 and the rest of it and once that 10,000 is kind of used up they don't have access anymore it's more common but it's not it's getting more common but I would say it's like a 10% thing um and I would say even then even if all of your approvals are limited uh there's specific edge cases that cause these um approvals to kind of linger and that's with nfts nfts they're never going to ask you to approve each nft individually when you use an nft Marketplace or when you're trading nfts you are giving access to every nft you own or ever will own of that specific type to a company and they're never going to ask you to do it one by one because it's an awful ux process so I would still recommend going through and you know revoking those approvals because not every one of them can be limited and I guess uh with that um any more questions oh go ahead one Cosmos we're expanding to layer twos side chains um in Q2 so um I I know I didn't talk about it right now but um I'm I'm one of the co-founders at hary we sto people from sending money to scammers and Fishers by essentially sitting between their wallet and the blockchain the question is well right now we work on ethereum the question is when Cosmos Cosmos Q2 so March um anywhere from April to April to June I think delegates are super important so the so for people that are not aware about so the question is what do I think about delegates and for people that are not aware about delegates um it's kind of like a way to prove your ownership of a certain asset without actually connecting the wallet that owns a asset into a certain protocol or anything like that it's just kind of a degree of separation I would say anything that separates um your assets like fragmentized your assets between different wallets or different paradigms is important important um personally um when it comes to my own crypto security I have my asset split between many different wallets um I have my own security system there uh when it comes to your personal security I would just recommend having a threshold I don't know what's comfortable for you maybe it's 1,000 maybe it's 50,000 but whatever you're comfortable to lose on each wallet which is hopefully zero but um as long as you're not losing your entire balance for making one mistake um I support anything of that kind of type so I love delegates I love delegate cash who's kind of the lead of that U who's kind of leading that initiative um and I I hope to see more of them to be honest with you so the question was how do you how do I guess how do we def protect like as a company or just in general Okay cool so the question is how do companies defend against like supply chain issues like Ledger connect kit and stuff like that um and the truth is that there's when it comes to like Hardware wallets that's a big trust Factor when you're using them uh because there's nowhere really there's nowhere else really in the whole like crypto supply chain except you know Hardware wallets and the portals that you use also like software wallets like metamask um you know I would say it's a tough question because those are like the most dangerous attacks and at for like a hacker team it it's super profitable the the prospect of hacking metamask or the prospect of hacking Ledger like connect kit um is is a super profitable idea and it's something that's going to happen um and my recommendation there is I hope nothing like that ever happens because it's going to be bad for I would say a majority of crypto users um or any I don't think the connect kit issue was at the scale of like apocalyptic levels but if there is ever a threat like that I would just make sure that your assets are separate across multiple wallets do do you mind if I come over there I I can't hear you too well awesome okay so last question the the the question is you know I talked about Hardware wallets and how we're supposed like how it's important to have one but I didn't talk about where we're stowing the recovery keys so for contacts that's like the paper and pencil where you store your seed phrase uh honestly there's not really many good ways to do so like I've seen people engrave it on metal so it doesn't like burn if your house burns down um I I I think the best way and the most used way is writing it down on a piece of paper and storing it um in in a place that only you know about uh I wouldn't actually store your seed phasers in a bank security deposit box because it's it's actually dangerous people get hacked that way so I would say storing it in a place that only you know maybe that's digging a hole maybe that's in a cabinet but um just put it on paper and never digitally uh and that was the last question so uh sorry about that you can meet me over there and we can talk about it yeah yeah yeah but thanks so much and have a good [Applause] one thank you to Daniel for that can everybody hear me can everybody hear me good good okay all right all right okay so we're going to move on to our uh first panel of the day we're going to move on to our first panel of the day there we go uh this is uh eth Denver 2024 # eth Denver 2024 please uh post on socials um anything that you like uh remember there are two main venues here uh there's this is the sport Castle we also have the Biddle Hub there are three stages in each there are speakers from 10: a.m. to 600 p.

m. each day so there's a