You Can't Scale Web3 w/o Better Onchain Security | Ido Ben-Natan, Nadav Hollander & Taylor Monahan

hey everyone uh I'm EO I'm one of the co-founders and CEO at blockade cool Taylor let's go longer okay I'll go a little bit longer uh out Blockhead we work with some of the biggest uh companies in the space to protect their users from wait wait hold that much closer to your mouth okay this this better yeah even closer like this yes that's okay like an ice cream cone so I'm EO I'm one of the co-founders and CEO at blockade at blockade we work with some of the biggest companies in the space protect their users from fraud fishing hacks some of the greats uh like nadav and Taylor here as well um excited to be here thank you um I'm Taylor monan uh I work for metamask I've been building wallets in the space since uh since ethereum launched um and uh I've always really been focused on like user safety and figuring out how we can actually help our users be safe and not get completely wrecked um and so at metamask I kind of sit in between the product teams the security teams the customer support teams and really do like a lot of research and threat Intel um so that we can like use the intelligence we have to translate that into improvements to our products that actually provide a good user experience for you know our very diverse and everg growing user base all righty um my name's nadav uh I'm the CTO over at openc um I've been in the ethereum space for a good like seven years now um prior to openc I ran a company called Dharma which among other things at one point in time uh ran a fairly popular smart wallet um and so across the Dharma experience and then also obviously openc more recently um I've been very very exposed from multiple angles to um various web 3 security and kind of user experience concerns uh and I've had the pleasure of getting to work with Taylor and do as a result quite a bit so um yeah fun to be here okay so before we talk about Security Solutions I think we need to quantify just how bad the problem is because I feel like people don't fully appreciate just how widespread certain schemes are uh can you guys just like help set the scene share some anecdotes some more stories of just how bad it is out there dude it's so bad um I think that it's really easy to lose sight of like um for an individual user to come into the space even if they've been around or they're previously around you know they're venturing out into the web 3 world there's like these a lot of touch points that are very web to like Twitter um and it's like they're uh they're just like constantly bombarded with scams and you know I think a lot of times we think about like the rug poles or the defi exploits but your average person um is also like confronted with like uh account takeovers where they're doing like a fake airdrop um you're like really average person who may not be in crypto at all uh is actually still confronted with crypto scams via like Pig butchering and these large scale operations that essentially onboard individuals to crypto in order to steal their money um and because of the diversity of scams and the evolution of the scammers um and just how uh I guess like the new technology has not quite evolved to uh whack-a-mole all the different things if you're not really paranoid and really skeptical all the time you can very easily end up getting wrecked in one way or another um and so that's what you know when I think about things it's it's how do we how do we like get better across the board um and the numbers are are huge I don't know if do you have numbers we can drop some numbers in a second yeah um maybe our our take here is the way we look at it is I don't know I think we're early days of crypto the do's been here for seven years but uh but we're still early days um ask Taylor how long she's been in dude I've been in this space a decade now and it blew my mind when someone told me that the other day so um but I think like like the early days of the internet uh you know where anything you clicked could install some nasty malware adwar or toolbars and users had more toolbars than browser if anyone here has like an elderly grandparent or something you probably have seen some um and so I think web 3 is similarly like that right where anything you click can drain your funds it's just much much much worse because you know here you're you know in the past people were stealing data here they're actually stealing people's money uh quick question for you and then I I want to go over to the dove in terms of War Stories yesterday the coinbase uh outage people seeing their accounts go to zero obviously blockade one of the things you guys do is integrate into like metamask and and I think that correct me if I'm wrong but like you're you know also integrated into coinbase wallet do you have any insight into cuz like rumors abound in terms of what actually happened what coinbase is saying is that it was an outage and they're dealing with it but any any thoughts on what we saw yesterday so I think it's no surprise to people that you know as numbers go up uh volumes go up um I don't want to comment on anything that has to do with coinbase um or anything like that but I would assume um that you know they like us are seeing insane volumes Taylor Maybe can comment on what metamask is seeing we can comment on what we're seeing through our customers um and uh you know uh the price of Bitcoin isn't the only thing that's Rising so yeah um I think that we just released like numbers and we're basically we just like reh hit 30 million monthly active users um and so uh yeah we're back but with the I'm so scared um but with that it's like you know a lot of times when people come flooding back it's it's really this on slot of traffic and if you have not uh kept your servers at like full you know like open empty capacity for the entire bare Market when they come flooding back in in that volume it can be really hard to keep everything online um it's just yeah uh it's basically like a Dos except it's all legit people most is legit and naav if you have anything to add and I also just kind of want to get into some of the nuances of who these attackers are I mean like Taylor you you've talked about the skites um as one way to describe these Bad actors and I wonder like I like I you I leave it to you too I'd love to kind of like break apart like who who are your biggest threat vectors right now and then I want you to tell me about the skites I'll talk about the skies so yeah I mean uh little story time here is like a lot a lot of the reason why I ended up working so closely with these two is because um open SE is in many ways like there's probably like two or three applications that are at the mouth of the funnel of like almost everybody who enters web 3 and those are probably metamask Unis Swap and opy basically like if if you look at it in terms of just sheer like traffic and like Normie users coming in right um so um as a result like um we're one of their first touch points um and what's really really common in the nft world um are these things called drainers right and so basically like um there's this whole sort of illicit Black Market out there that I think like Taylor or do can tell you a lot more about um where people essentially buy these like um you know they'll buy pieces of code essentially that are like this is your gold or your platinum drainer or something like that um and then they'll go and just spin up like thousands of different scam links and scam websites and they will find every which creative way possible to get normal users with wallets installed to click these links and then get all of their nfts drained um it can happen through Twitter Twitter it can happen through Discord it can happen through email it can happen through you name it um and the fun thing is is that um often these users are relatively inexperienced they'll have their nft stolen um and they will immediately think oh I got to reach out to openc support because they'll help me get my nfts back of course we don't have the ability to do that because we don't control the blockchain that's that's kind of the whole point of this right so anyways um it it specifically during like the last Bull Run um this became like a hair on fire problem for open um just because of like the sheer numbers were insane uh like it wasn't it wasn't that people were getting their nft stolen on openc or even like even getting their nft stolen by like clicking a link from openc um it's just that they would assume that we had some sort of ability to either like rectify the situation or um or help it out and so it was a major support load problem um and so um and so as a result like I ended up having to learn a lot about this weird crazy economy um and um that's how I ended up actually meeting Ido um because they had a very novel and interesting solution um and then and then we got the team together and we were like we need to stop these these Bad actors um I don't know Taylor Maybe maybe you can tell them a bit about the the skites and where they come from yeah so we call them the skites it's like an evolution of the script kitties it's basically um they're usually young they're usually like in the west english- speaking um and they they hang out on like the forums um and they have their own distinct culture there's like overlaps with like the Sim swapping groups as well um and the reason that we call them script kites is that they're not necessarily like Advanced hackers with deep code knowledge right but what they are able to do is they are able to take um like a kit so like a package or a set of software they're able to buy this kit that an actual development team built they take that and then they basically just sort of like retrofit like a logo on it the name um and so what they'll do is they'll like take over a Twitter account say for a new hot project that's doing something like legit maybe they're launching maybe they're doing an airdrop whatever it is they'll take over that account Twitter or they'll spin up like a bunch of fake impersonation twitters and then they'll basically spam these fake airdrop links so it'll be like a giveaway scam it'll be like claim your airdrop it'll be like get your free nft those sorts of things um and but what the skites themselves are actually doing is they're just like slapping a logo on this website and setting up like um yeah like a thousand Cloud flare accounts and then just like Mass spamming it on you know social media on Discord however they can get it out to you um and then if you click the link and visit the site it'll look like a legit site like most sites that you visit where it's like a landing page a big button in the Middle where it's asking to take this fun action and if you take this this action you're going to get something free but in reality when you click that button um it drains your wallet and this is why we call them wallet drainers because it literally drains your wallet it'll take all your assets um whatever assets that you approve it'll just sweep them all out so whether that's all your nfts whether that's specific tokens they have a bunch of different like technical mechanisms that they use um and if you like uh yeah if you click approve on that on that transaction it's over your stuff is is is being swept out um and a lot of people just because they don't fundamentally understand the inner workings of the signature um and because the website promised them free money free nft free whatever uh people click these links like really fast a lot um and it's it's a really big problem um because they are they are these like young like weird it's a weird uh culture that they have going on and so they also evolve very very quickly like they're kind of crazy they're very loud um but they will rapidly innovate their drainer kits so like if we Implement something to block some of the things that they're using to steal from people um they will in their telegram groups basically run around yelling and getting like very upset um and then they'll push an update to their own drainer kit and then they will like Market it to their buyers and they'll be like we evaded the metamask blockade thing no more red screen by now $50 upgrade guys and then all the skites will be like oh cool they evaded the metamask blockade thing cool and then they'll buy it again and then it continues on most of the time when they're screaming about this stuff it's like it's like classic crypto sales it's it's like an empty promise but sometimes they do actually innovate enough to get around some of our stuff and then we have to push updates to our own app in order to continue blocking them and it's just like uh it's a total game of cat and mouse uh and they're very yeah they're vulgar little kids and like you said that like in some cases they're more successful than nation state sponsored actors like something like an80 million a year run rate business yeah yeah so they did um last year specifically the wallet drainers I think uh the number is they sold 330 million dollar and that's all from these websites and that's all from like individual retail users so like the average loss size is actually relatively low right North Korea state sponsored act actors will go after like um like say like htx poniac like these big name things and they'll steal $100 million the skinnies on the other hand are stealing $330 million over the course of a year but they're doing it in like $1,000 here $2,000 here and that should give you an idea of how um broad the scope is right in order to steal $330 million $1,000 at a time like that is a a delug of scam sites um okay so shifting to Solutions nadav this kind of goes to a point that you're were making earlier like who owns the problem of users getting wrecked and so you mentioned this uh you know like if if somebody has their nft drain they're coming to you even though it's not happening on the openc platform and I guess I just wanted to like put this question to all of you like how do you navigate like owning the problem because I feel like you guys do on stage not not everyone feels the same way so I kind of wonder what people are saying like on a zoom meeting behind closed doors about uh where the onus lies and and and how you're navigating that as well I think it's a full stack problem right so I think um basically everybody has a role to play um people who design protocols have to be aware of like how those protocols will be fished and how people will use them maliciously um applications that have large Footprints in terms of users like openc um we play like an enormous role in either educating or evangelizing certain Solutions um and then obviously like making sure that um you know scammy links or fraud doesn't occur on our website um wallets um are kind of like the first line of defense um and that's why companies like like blockade are so important in terms of being able to kind of give them the sort of tools to um to beat the skites quote unquote um and then I think there's just like a broader Community aspect of it right like it's like there's there's also just generally uh an onus on the broader Community to um make sure that like there's there's a certain level of like social education that happens for people who are entering the space to like that people know that they need to be you know cautious when they're like navigating web 3 they need to be aware of the existence of these sorts of drainer links and whatnot so um I do think it's a CommunityWide thing that needs to be tackled and I mean the the thinking has evolved right like whereas like a year ago it was firmly the blame was being placed on users that mindset has changed and and why is that what what what's what's evolved in the thinking there yeah I think that's a great point you know um we started blockade because of this problem uh with nadav with Taylor with everybody else you know that we work with um and when we had had initial conversations with a lot of these companies the blame was set on users right you signed it it's on you um I think that ultimately has changed over the course of this past year um companies in the space you know primarily the leading companies in the space like openc like metamask understand that the products people use need to protect them and need to be safe um I think there are still companies in the space that don't think that way but there are a lot more that do now um and uh and and I think you know Taylor talked about this game of cat and mouse where we improve they improve we improve they improve at the end of the day it's you know a financially motivated game uh once it doesn't make Financial sense anymore they'll leave and we've seen them leave platforms that you know we've deployed solutions to um and I I think the game has started um you know this game of cat Mouse has started and uh uh I'm really excited for this year to see you know what the skites do also what the nation state actors do um you know uh and uh and go from there I think we've seen you know also nation state actors sponsor these trainers um you know and and over over the course of time and so um you know the the same tools that these skites are using or the same methods I would say um are are similar to some of these nation state actors as well and like Taylor you sit between the product team and the end users who are getting wrecked you're navigating that issue of urgency like what is and and of going to that larger point that Ido just brought up the arms race that exists like how do you keep up team morale is like you solve one problem only to just play a game of whack-a-mole yeah it's really it's really tough it's really tough especially when um I think this space historically has had a put a huge amount of emphasis on things like user privacy and like the idea of like security being sort of limited to like your stack like your specific app or your specific protocol and like the second that some external Force comes into play or the second it's like oh well that would have never happened if the Twitter account hadn't been compromised it's much easier for product teams in general to be like oh well maybe Twitter should fix that problem and and you know just sort of like push off responsibility I think it's a really natural thing when you're confronted with the fact that like your users are losing money it's a really natural thing to not want to like uh internalize that fully right uh you don't want to think that like what you're building is harming people um and so the way that like I think about it the way that a lot of our product leads think about it is that um user safety is part of user experience they have to be safe in order to have a good user experience in fact if they're not safe it's a critically bad like you lose that user forever they don't come back to crypto after you're when they lose all their money they don't come back um and so when you think about that it's like okay well let's do this to improve the user experience let's do this to protect people and it's less about like oh well is it our product's fault or is it this product's fault it's more about like we're trying to build the best product for people we're trying to provide the best experience for people how do we do that and reality check making sure that like um different threat actors can't take uh advantage of your product or abuse your product's feature set to get at users is a really really important one um and like nadav said earlier like this really is something that has to happen at every layer of the stack the wallet obviously is a big one but daps can do more and should do more to educate their users and also set the right example right like the reality is is like if um if everyone's doing free airdrops and then the Skies start doing free airdrops everyone who did an airdrop everyone who said click this button and sign this transaction and get your air drop every single person who did that trained those users to think that that's how the world worked and that this is acceptable and now everyone is like cool like free money let's go except that they that gets their wallet drained and so I think that like we really have to be consider like what are you training people to do um and and what is your end goal and personally like the aird drop people like stop airdropping people stop having people sign transactions to get an airdrop like I can't even tell the legit sites from the scam sites at this point often times the skites have more polished sites than people who are legit doing claim aird drops sorry but it's true I I will say really quickly though on on a note of optimism though I I I I think it's important to acknowledge where we are today is like literally orders of magnitude better than we were like a year ago like like I I like I think like where where we were like a year ago was like basically like it was ridiculously easy to be one of these kitties like it was like it was just free money on the table was just like waiting for you if you like if you got into that little business now there's like now you know in the cat and mouse game now there is actually like an adversary like there is like there is now like a significantly higher barrier of entry and so like that doesn't mean that it's not going to keep evolving and that you don't have to keep up with it but it's like I think EO mentioned this earlier right it's like these these scammers like they're not for the most part they're not that sophisticated and they are fairly short attention span and are trying to do the thing that is easiest there the lowest barrier to entry for them to like make some money and so often even imperfect amounts of friction are like 90% of what you need um and so what I'm really curious to see especially now that we're in a place where like it seems like we are quote unquote back it seems like you know it seems like the the Topline volume numbers in general are probably about to go up um I'm excited to see like what's what's the updated metric going to be like on on that theft loss right I'm I'm willing to bet it's going to be a lot lower I mean is that in what you've seen Ido like through your work at blockade is the problem getting better like to nad's point like have you seen numerical improvements in terms of like how people are being I don't know protected against some of some of these schemes yeah we we monitor these things very closely and we see measurable improvements right I think uh you know through our work with metamask over the course of uh these past couple of months as we're rolling out we've been able to protect users from you know over $100 million worth of assets from being stolen um you know we see measurable improvements inside of Open Sea right I think since we started rolling out with open SE we had we had seen you know uh thousands sometimes even a day of these kind of malicious links go down to zero um and so you can see that friction even if imp perfect is substantial enough to to move these attackers off platform uh we see measurable amounts of money being protected like vast amounts of money you know that number that Taylor quoted that could be a lot higher we've done a lot this year um and and and we're going to continue do a lot next year I mean Taylor just made the point that you know wallets and deps have really put themselves on the front lines of making it harder for these Bad actors to be successful um outside of that like outside of that sphere and and maybe in ad do you can talk about this what about like n like nfts for digital Identity or protecting information like what other Solutions are you guys looking into sorry could you clarify the question yeah like I mean are is open see looking into using nfts to mitigate risks associated with identity theft or data manipulation like is that is that one thing that is it all being talked about so I mean there's there's there's definitely a certain amount of people in there there's a subset of the nft industry that is interested in a lot of this kind of like own your own data and like soulbound nfts being sort of like a proxy for um either exposing that data or exposing some sort of um element of that data that could thereafter be proven with like a zero knowledge proof or something like that um so I think it's it's something that there is like a niche in the community that's interested in in it and it it might have some pretty cool implications for like um traditional web 2 kind of like data security um but um it's not something that I would say like open see the company right now is like very actively like um working on in any capacity I mean what about like um and I put this to to any of you like I just don't know how much it is a part of the conversation when you think about you know forward-looking moves with security but you know privacy preserving Tech like ZK proofs are they being leveraged to fortify web 3 against data breaches and privacy violations is that less a part of the conversation right now I think that um I think there's like a lot of like amazing teams out there who are doing the like upfront deep work on these things I think that because like open SE and metamask like we have so many users today we don't get to play those fun long-term research games and so um like for us what we do is like we watch these spaces and and the things that are happening the research that's being done uh we watch it really really closely and like we support everyone who does that um but until it's like you know can provide like real substantial value to our users it's not something that we personally invest like a ton of time into um that said like I'm personally really excited for some of the opportunities around like the zero knowledge stuff um and identity because if we can nail that if we can get that right it adds a whole another layer to this this ecosystem um Beyond just that financially motivated stuff and I think that that's really interesting um I am also concerned though if we cannot protect users from getting their nfts rugged uh how can we protect them from getting their identity rugged right like that's that's my biggest that's my biggest question right um is you know how how uh that intersection like how do we use the the the tools that we're building today the experience that we were having today to make sure that in the future when there's a much more uh intangible set of like value like people's data right people's identity how do we make sure that users actually stay in full control because again if you just tie the user's data or identity to an nft um like it might get stolen if we haven't completely solved that problem um you know I feel like in the post FTX era you started to see a lot of people shift into self- custody for the first time it is a very difficult thing to navigate even for the best of us who have been in the space for a while um I I know like Taylor with the work that you're doing as as people move away from centralized exchanges into self- custody wallets uh how is metamask looking to help people through that you know even something like tackling seed phrase recovery yeah it's it's that's like where a lot of our effort is is is helping improve the like a lot of people think about it as like the onboarding flow and and they often like think of that as like the first two steps in your application like ooh like let's get some fun illustrations in the onboarding flow but the way that we think about it is like the holistic users experience that person's actual experience from going someone that has no crypto is like crypto curious we call them right and they're like hm what's that what's that over there what is their experience like from being that crypto curious person to learning about it to deciding which exchange to use which on-ramp to use which wallet to use what where like what what what's the value propositions that are actually um converting them and then how do they actually go about like from point A to point C to point d right they have to get their Fiat money on ramp whether that's through centralized exchange or like metamask we have like on ramps um Partners where you can basically directly onramp from Fiat directly into your metamask um and then what do people do from there right like when a person installs metamask does that mean that they actually have uh like any actual money in their metamask or are they just like installing it and looking at the fox and being like cool like you know what are people actually doing with this um and I think that we have a lot of uh a lot of room to improve here um especially with people the flow I think a lot of people are like um seeing on social media seeing uh number go up yay um and it's very very financial and so they're sort of like sprinting in in that way right like ooh money let's go um but I I hope I've been hoping for the last decade um that you know the the applications right and the value props of these applications are going to like attract users and the user is going to have a better onboard experience from those specific applications right so they want to achieve something they want to do something this this application is going to solve their problem in some way and then that flow they like onboard via the application and come around to metamask that way rather than like sprinting into metamask like running for money um and it's going to be you know it's it's a journey it's an endless Journey but I'm really excited to see where like this year and and the the next cycle in general I'm really excited to see how we evolve in in that time period you know I feel like there's also this like philosophical question of permissionless and privacy and how you enable users and these decentralized platforms to maintain that ethos like what level of censorship ideologically is acceptable here that that was such like a wordy comers way of wording that but I think you get where I'm going that's that's that's the that's the line that we have to tow right because um I always say that uh if metamask really wants to ensure that no user loses money the easiest most foolproof way to do that is just never let any user send any transaction you can put your money in and you cannot take it out you will never get rugged like we win right but that that actually uh doesn't work at all because then you've lost the whole value the whole point of this industry of what we're building is en enabling both end users right real people in the world to do and interact with whatever they want in this space and we also want to empower Builders to build things that enable people to do whatever they want and so how do you uh accomplish that right how do you actually build a product that empowers people to do whatever they want build whatever they want create new Unthinkable things while also preventing people from sending transactions that they don't want to send right like we're making an assumption on behalf of the user um and so we think a lot about consent we think a lot about um giving users information so they can make the right choice we think less about like um taking active steps to like censor the user we don't want to do that we want to make every single Choice the user should be informed about the outcomes and and what's going to happen with this um and then they won't send that they won't want to send that transaction and they know it I think you know when we look at these things and decentralization and privacy and you know ethoses of the blockchain that that we all stand for um and we look at that on kind of the scale of onboarding and growth and bringing in more users oftentimes these things are put on one end versus the other right they're kind of you know they contradict each other in some way I think you know what we all understand is that like privacy decentralization these things aren't that important until they are and then they're the only thing that and then that's the only thing that matters um and so I think you know you know open and and metamask specifically right these these two these people here up here with me are modest right but they have to tow that line for the whole industry because they have it on their shoulders to onboard users right to actually bring people into the space make them safe um you know make these products usable but then also preserve these these things that are so important to all of us here um and so you know where where often times you know we ccus are complained and some of these things they're misguided in the sense that they don't understand the actual kind of um you know responsibility that you know my peers up here have um in in needing to kind of maintain that that balance uh so in our last two minutes here I want to hear from each of you on this on this last Point um we're going into a bull market uh in adav you brought up the point that this is kind of like when you pressure test the system and yes we've seen measurable improvements during uh this bare Market the last few years but now we're going to see how that plays out when there's a lot more interest and a lot more money like Taylor you talked about being up to 30 million users uh what what keeps you up at night like what are you terrified of but also like what proactive measures can either an end user or a platform take um love to hear from you guys on any one of those points or all of them use blockade yeah it's simple yeah I think that um if you're building in this space um I encourage you to uh be willing to build things that are not perfect do not let perfect be the enemy of good okay iterate quickly experiment and take any measures you can that will have any impact on improving users lives protecting them preventing loss I think that last cycle the biggest mistake that we made as a company was not acting fast enough and not being willing to experiment because we didn't have confidence that the things that we were pushing into the product would have an impact and I think that that slowed us down in a lot of ways that ultimately were not helpful even if the solution is not perfect even if there's ways that the Bad actors can get around the solution it's still necessary to implement those things because adding that friction and adding that cost and protecting that segment of users is worth it every single time so I really encourage you guys especially as the market speeds up take any and all actions even if they're not perfect please nadav final word um I think the thing that keeps me up is the known unknowns um like it's like I think it's if we are going into another bull market and we are about to Grace the precipice of another order of magnitude of growth um I think it's more likely than not that like there will be something new or some new meta or some new pattern that will completely kind of change the way that the the sort of dynamic plays out this time around and I think companies like openc I'm sure metamask could agree as well is like um we' spent a lot of this be Market basically preparing for this eventuality like we've been uho you know Open Sea used to be known as broken sea it took us a long time to um get good at scaling and get good at you know keeping the side up under more traffic and so we'll see how we hold up over the coming months but um uh um but there's only so much you can prepare for right and so I think I think the um I think it'll be interesting to see like what what are missing right like what's what's the X Factor that actually propels us to this next order of magnitude thank you so much to my panelist and to the audience for joining us and eth Denver for putting on this session thank [Applause] you