Billion Dollar Breaches: Navigating the Evolving Crypto Threat Landscape - TOKEN2049 Dubai 2025

Good morning everyone. I hope everyone has had a great start to the conference so far and thank you all for joining myself and Demetro on stage today. Um I think this is always such a big topic. We talk about regulation but I think security in itself has just become a growing uh challenge just given that the industry is growing. I think we're at 3 trillion now, maybe a little bit more over that.

And the larger this space gets, the bigger the vectors for attack take place because ultimately there's just more economic interest to pursue that. So before we jump into this topic today, uh quick intro, I'm co-founder of Drift, one of the largest DeFi exchanges. Uh today we have 1.5 billion in deposits and uh represent the largest platform on Salana. So that's just quick spill on me but maybe Demetri quickly on yourself a quick intro on who you are what you do.

Yeah, thank you. Uh hello everyone. Um so first of all, glad to see here everyone and uh so I'm Dimitro. I'm from Ukraine and we actually leading one of the biggest security company uh not only in the web three world. Uh miss actually I'm hacking proof which is one of the biggest bug bounty in web three and web two world.

So we working with companies like Ethereum Foundation up to Sui, Celestia, OKX, uh, Kcoin and many many other players and yeah for those eight years you have lots of stories they're happening right now and I would happy to share those details with you. Fantastic. I think you know just even taking this year alone uh in the first quarter I think we've observed close to two billion worth of hacks. the largest obviously being by bit very very recently. Maybe just for some of the audience who might not be familiar with sort of what took place.

Obviously a huge event which I thought was very well crisis managed. Um help maybe us understand what went wrong there and what were some of the attack vectors that took place. So first of all you have to understand that uh we quite often do some reports and you can find it hacken website where we analyze how many data or what actually was happening under some attack and of course as a bug bounty platform just to understand what is bug bounty. It's when you as a company can get a report from any researcher and verify whether this report is valid or not and then pay uh researcher for this report. So what we can see so far that actually we don't have more attacks we have very wellplanned attacks and uh this is was one of key re reason what happening with bitbe yes it's more about how other could actually use your approach or your management of company and get something so previously let's say someone could find issue in a in a API or actually in a smart contracts and use this uh issue to do some bad stuff or I don't know like steal something or uh put network down so nowadays they do as maximum as they can actually so they understand what you do when you do what kind of people work with you where they can meet these people they they actually can visit side events with you give you a drink and even copy some data or have access uh so that is why nowadays is those attacks are bigger because they well planned and this is attack was planned actually with one of famous uh bad hackers and uh yes this is what happened with bit so they found the way how in multise can we actually use those bad approach of management and steal those 1.

3 billion and uh this is something that happening with other stuff so let's say I have one case this this case is actual right now. So one of exchange uh they actually know about issue in multi which is $253 million right now and they don't want to deal with researcher to pay this at least $200 to fix this issue. So sometimes companies know about issue but about having those centralization in management they don't want to to solve the problem. So here just to summarize what happening. So first of all one bad guys just doing their job.

Yes. What they do they just organize well they monitoring they just uh try to see what happening in at your company. they talk with people everywhere to understand where like bad organized things in in company etc. Second stuff what happening it's about having something extra control or extra rights in multisec or actually in some system so and as general we have those losses. Yes.

So it sounds to me like and one thing we were talking about backstage was you know do you think multisigs are sufficient these days? Are they good enough? Uh it's very hard question. So from my experience of course sometimes it's very hard even uh to understand how you should divide management uh of assets by multisc. So my advice multisc is good enough but it's more about who have access how many people sign by multisc uh transaction like one two three four who actually has access to those multis generally and the most important things let's say you have I don't know 500 billions as a deex I believe you have and uh you actually have only one multi which is operates those assets Yes.

Uh under one control. Of course, it's a huge target for bad guys to to to deal and try to do as much as possible and um it's this is the issue. So if you use multi-seeking assets, try to divide them as many as possible uh way and control of course like how other can deal with those multi. So generally it's enough uh but you have to have another stuff. Uh for example monitoring yes you can put some alerts for transactions that dealing there is there are actually lots of uh transaction monitoring tools which is actually help you to put alerts for low medium or high issue but for critical you can even block transaction.

So here the same let's say with buy bit they could actually use these monitoring tools for critical issue and transaction and those transaction could be blocked and those hacks actually wouldn't happen. Of course you might know that there was some uh discussion in uh Twitter about uh that hey they had bounty for uh just for 4K as a critical that might be issue. I will tell you might be but I believe it's more about uh final target. Uh if some companies or some group of people they have target to get money as much as possible and their targets was to have 1.3 billion and they could earn even 1 million from bounty they would actually hack anyway and they live in North Korea.

Yeah. Yeah. I mean that that makes sense, right? I mean, why why get a 1 million bounty when you get a lot more? So, it sounds to me like the failure of these systems are largely like people and processes rather than the technology like you know all these groups that are getting sophisticated are not going after the the wallet itself but rather the people behaviors patterns of behaviors and you know studying that seems to be like the preventative measure is what I'm hearing.

Um just to understand the yeah you you're right you're right but also it's about technology. So let's say nowadays we as a company we have lots of uh smart contracts and programs and protocols based on move rust and etc or mix of those languages and what I see from my company at the moment that actually the biggest rewards related exactly to rust moo and last week we paid out 1 million uh three 300,000 for for actually uh for move and rasbased project they are good they they really nice languages to develop something fast I see future uh for them as well in this niche but nowadays it's more about technology as well so people who actually smart enough or they have enough experience they see those problems in the technology and they just use them and of course um what I should say positive related to rust and move company they actually have very good rewards in terms of bug bounty and uh they do lots of audits as well. So they try to do their best in terms of uh um behavior and actually Yeah. So I believe it's good in terms of success for for them actually the issue that they see is about they have lots of competitors. Yes.

Of course. And u still I thought probably four years ago that we will have maybe 10 times market bigger than right now. And they fight for these end users. they also to have some uh spending money for even token itself as yes they pay for for stands for etc for merch so I believe they just try to criticize their task and for technologies and security their priority is not on the first stage and this is changes right now because due unfortunately due to such approaches that just had by bit etc now they focusing on proof of reserve they focusing on monitoring. They have compliance stuff like mika or viral license and etc.

So we have those here. Uh but actually I believe that the security should be in the top three list of of business. So that is why uh we have those players uh like bounty platforms, auditors, contest uh players and etc. monitoring players. Uh because you cannot hire 100 people in a company.

Uh but is that enough like to all the people in this room today who are users of you know whether it's decentralized exchanges, centralized exchanges or any other platform. Um you know is that enough to keep these users safe? Uh I have a good and bad news for you guys. Uh so let's start from bad news. Yes.

Um I don't like personally even to go through some process even to fulfill some survey you know and u sometimes even like I have a daughter she like hey could you bring me some toy and etc and I come through survey do as as usually also try to take it and I feel like I it's something I don't want to waste time yeah and we as end users we actually don't want uh to deal with technologies or actually other stuff which For us it's like complicated. Yeah. So we try to just login with Google or etc. Not set up to factor in certification, not to have in hard wallet because like come on I just came here with I don't know with smartphone that's all why I need a bag or etc. And uh this is what happening.

So we just try to be as simple as it is and that's a problem. So um even I was telling you story before. So even we have a case where actually one company one guy has issue with telegram and they were talking with his wife they keeping uh like about financial stuff for one week they live together etc and one of guy make a copy with provider of sim card and they actually just use a right moment where was the ch like request to pay money they just send their details instead of uh husband to to wife and actually she just moved quite a big sum to to these guys and then he just deleted a chat. So this is about something he missed of course in uh in those settings but you as end users of course you you should be definitely set up two factor certification e WhatsApp, LinkedIn, Twitter, telegram whatever you use it's very important. Uh also if you if you a part of company and you have access to Twitter but you don't use it please just say to your like team members could you cut me from this permission etc.

And of course about links I never even when I have uh message from my marketing team etc um on my email I first of all check what is a mail send me uh then actually ask my team should I definitely do what it's saying in a mail and then just do and usually I do like proceed like this so when you even get some mail from your team, you should definitely be sure that this is something that you expect to have. And uh what else? It's more about read you have chat GTP. It's it's a really good uh way right now quickly to get some information. Even previously in order to get some information, I was asking my team to collect information for me then reading at the end of the day or in the morning etc.

Nowadays I just drop some message and details. He's still lying you know I like I was telling Chaj DP that hey that was happening some uh event in Abu Dhabi could you send me link to those registration he was told no nothing happened in Abu Dhabi no event on a Monday etc and of course I found this event I sent to chat DDP say this is event like oh you're right this is event so still you have to check what even AI is saying but yeah so reading try to speak with people who deal with those stuff because we cannot know everything and it's okay if even you come for the call with someone who is doing marketing stuff or someone is doing I don't know selling something because it's about experience you can also listen to others understand what they doing and even they can teach you something so same with security uh people don't ask money if you even set up call with me or someone and say hey could you explain what most or the biggest issue happen or I saw you have a let's a public report. Could you explain what kind of issue was in the smart contract? So, it's okay. You don't pay for that.

Sounds good. I mean, it sounds like a lot of it's like self-preventive. I think in the time we have left and maybe to end on something controversial, um I is North Korea, is Lazarus Group, all those entities something we should be afraid of? And how does it industry as a whole combat and get better at defending against that? Oh, North Korea.

Okay. So, as I mentioned, I'm from Ukraine. Yes. And u nowadays, unfortunately, we have war and um if you actually inside of country and uh country control you everywhere etc. Yes, you should do or you actually will do whatever need.

Yes. Same with with hackers. So, let's say if those hackers who actually stole money from bit I don't know live here. Yes. Or actually I don't know somewhere in Estonia or Poland wherever I believe the police and other guys will found them.

Yes. So it's more about that some country is closed for us and for the world. Yes. And that is why we even don't know maybe those guys already gave all money to government in North Korea. Uh but actually this is something that we should afraid of because this group of people they actually do their job and no and no one can actually get them from this country.

Maybe in a I know 10 years something will happen and we will know those people but there is no guarantee that they will get this money. Mhm. And this is the issue. So I know even let's say BitMart they lost uh 196 million in 2021. Two months ago they ran project uh at hacken proof for bug bounty and ready to pay $58 million to get at least 60% of those losses back and we we actually getting reports with some details about information.

So people still try to help uh and and actually get like send some data to understand what happening. So but here with bit and with North Korea it's more about they isolated from the world and if you don't have access to those isolation probably it not possible to get this money back and especially if this money already spread it right. So you think like shared services like people you know agencies working together you know even countries as well working together because you said it's dispersed quite widely this needs to be like a unified effort. Yeah. Yeah.

Yeah. That's true. But you know actually one one more stuff is about uh they still let's say if they had a chance to get some uh money they need to get this in the cash or maybe somewhere. So it's more about regulation. That is why we have regulation happening everywhere and those regulation goes to payments sexes uh and etc.

But still we have defy which is not under regulation and maybe never will happen there. So that makes me happy that I mean I I'm in DeFi. I feel like that's a growing space and you know we take the view that DeFi will eventually supersede CFI over a certain period of time just given that it's non-custodial and all that. In the 30 seconds we have left, what is something you think that you do as a CEO of a security firm that people in the audience should be doing? Okay, so first of all, as I mentioned is about your personal approach with the security.

So I try to explain team how to deal with something and what we should not to do at all. uh but about generally if you have a project so first of all of course do audits set up monitoring tools go with bounty you have to have those rules how to deal with uh researchers uh and at the moment I believe it's enough because everything else is governed by regula regulations and they will also try to monitor and regulators itself they also want to have monitoring tools to monitor your assets of your company. So this is something that will happen and they will block your transaction as a banks. So this is what I can advise. Fantastic.

So when you get that call from a bank blocking a transaction, it's uh it's not a bad thing. Um I think unfortunately everyone this is all the time we have for today. A big round of applause for Dimmitro for joining me on stage covering security. Thank you very much. Thank you.