Panel | Security Is Everyone’s Problem. So Why Are We Still Getting Hacked? | Common S3nse - 2026

[music]

Uh thanks Common Sense Crypto Canal, Ali, everybody for having us. Um and uh Justice, Noah, thanks for joining us. I'm Don. Um can we do some quick intros before we get into this? You guys want to

Sounds good. I am Justice Hannah, CEO of Grego AI. We find bugs on the blockchain using the power of AI.

Hello. I'm Noah Elich. I'm uh a security researcher and currently a functional analyst at EPAM or rather DBG. Uh so, yeah. I I do a lot of corporate stuff right now.

And I'm Don. I'm the founder of Glossify. We're We built a decentralized marketplace for coordinating swarms of agents that are attacking security problems. Um And um yeah. Okay.

So, let's get into it. The topic Security is everybody's problem. So, why are we still getting hacked? Just vague feelings, guys. Do we feel We're in this moment?

We have all these new AI tools. You know, um things are getting better, things are getting worse. How do we feel about the state of security in software in general and blockchain at this moment?

I'll go first. I think it's terrible, to be honest. Unfortunately, running a security company, uh we have more than There's too many bugs to address. I think we're We're in 2026 and yet we see the same bugs that were in DeFi summer um 6 years ago. And uh why?

Why is that? And there's a It's a twofold thing. So, right now we have AI, which is amazing. Used the right way, it can help locate edge case vulnerabilities. It's extremely beneficial.

But, on the flip side, it can also provide you with false confidence. It can vibe code your product. It can introduce just as many bugs as it could find. And it can also provide a lot of noise going with any sort of bug that's supposedly identified. So, developers have been inundated with a bunch of false positives.

And so, the real bugs don't get identified, gets overlooked. So, it's kind of a dual sword here with security. In in one way, we have a great amazing tool that's able to help us secure our projects. But, on the other hand, it's being misused or not used correctly or or being used against us unwittingly. So, that's that's kind of where we're at now.

And and kind of I wouldn't say security is better than it was six years ago, unfortunately.

Yeah, I agree. I feel like we are actually at a sort of tricky point where on the production side of code, so the development we have more and more people simply having a top-down review approach to the code that was generated, never really going terribly into detail, which as a hackathon judge here I also saw in the projects submitted. While from the other side, as you mentioned, there is a lot of false positives, but we do have more advanced bug finding tools. So, that is leading to a lot of the projects that are willing to be sloppy, which happens, of course, during budget cuts to every single project. Um a lower code quality, lower management of code, potentially.

Yeah, I mean There's There's just so many problems. And one is one is a bear market, too. As far as token prices and just security space in general, projects are literally going out of business and shuttering. And security doesn't drive revenue. It's often just used as a stamp, and we we have this tendency to If you're running a business, you're going to run the cheapest audit you could find.

And get a stamp, and then you'll try to attract more capital, etc., etc. I understand that. But at the same time, one bug can wreck your whole business. And everyone thinks it won't happen to them until it does.

So, we say up on the screen here, "Security is everybody's problem." Um if that's true, if security is everybody's responsibility, does that kind of mean it's nobody's at the same time? Like

Mm. I I think it's a different problem in practice. I think it's the fact that security is everybody's problem. Um but also the losses when it comes to hacks do tend to flow one way, which is towards the actual users. While any any revenue fees, etc.

, do stay with the project. So, as long as the project is running, as long as it doesn't break, you know, you can you can run a car for quite a quite quite a while before it does break without changing the oil. Then suddenly does, but you still did run the car. So.

Have you noticed a different And you guys were in DeFi summer years ago, right? All right, there's a different kind of incentive mechanism. Like back then, uh it was expected that the project, the protocol, if there's a lot of money flowing, that they would compensate users if something was hacked. I don't think that's the case nowadays. I I think you're seeing And And you would just expect it.

You'd say, "Okay, look, I'm taking outsized risk. I'm going to to go in two pool, three pool, and leverage that position and the protocols I It was unspoken, but it was like, "We got you if something goes wrong." Nowadays, I feel like users are kind of on their own. I haven't seen that same kind of thing happening. So, like it Is it everyone's problem?

Now, I'd say I'd say yeah, but you know, there's 10 different angles I can go here, but one of the angles is like no one understands uh if what they're investing into what they're actually using is actually safe or not. They could have five audits. It doesn't mean you're secure. I mean, they Do they have a bug bounty? Like, there's so many questions you could ask, but the average investor the average technician doesn't understand uh if it's secure or not is is one of the biggest problems, I think.

Yeah, I agree. So, like we have audits, we have bug bounties, disclosure programs, monitoring, threat intelligence, researchers, security firms. We have millions of signals everywhere. Why do Do you guys get the sense that they're just falling through the cracks and people are not

I mean

finding them or

Open Zeppelin Defender was uh huge thing that they were doing as a let's say flagship product for continuous threat intelligence, and they did sort of close up shop for that particular thing like a month ago, right? So, I feel like generally it takes an extreme I I Right now, I work for more or less a huge stock market organization, right? So, um

[sighs]

when you think about it, for these big things to implement any migration from one standard to another, from one approach to security, for all these trainings, it took them years, up to a decade, because they needed to create all these processes, internally train people, etc. Um what happened in crypto was that some tools were created. They were generally somewhat deployed, but they never became a part of good policy for for 90% of companies. Just a few companies in practice did implement proper security posture, and that's that's more or less it. It's uh it's not locking the door.

Yeah, now a huge problem. It's it's it's a permissionless platform, which we all know and love, but Joe from back alley DeFi project number 600 fork of whatever can push out something, and then he can attract TVL, and he can claim the same audits that uh the original protocol had. He can make some tweaks, and usually no one's checking. No one's verifying it, and uh our security standards are really nonexistent in Web3. We joke that we don't have the level of security that Web2 has had for a long time.

We don't have certifications, this and that. I think slowly these are coming out, but uh in reality, it's just it's not taken seriously. It's This industry is has such a long way to go with as far as prioritizing security and and understanding like what is true security for a protocol.

So, maybe you guys would agree with me that it's kind of a cultural problem, and it's an incentive problem. Um we have this kind of cowboy yolo culture in crypto. Is that Is that fair?

Unfortunately, I I think it's it's All right, when when have you had an asset? So, picture you're an investor, and you're trying to purchase X asset in protocol Y, and you're you're saying, "Okay, from a financial standpoint, this makes sense. The returns look good. Okay, and now I have to become a security engineer and say, well, what is my is is the level of return I'm getting? Is this associated with the the amount of risk that I'm taking on?

And you can't assess that. I can't assess that properly as an expert in the field. I look at the Kelp DAO thing, for example. So many people have taken a look at Aave. Um and it caught so many people blindsided.

And the the follow-on effects of that. And it's like, well, why? Well, because you need AI to be performing this on a continuous security basis. Like that's our platform. That's what we're doing going forward because humans miss things, right?

If you're an investor or a security engineer, and you Oh, you didn't miss the onboarding of this collateral in a DAO post, uh you weren't paying attention. You weren't on chain 24/7. You're going to miss things in this environment of 24/7. Everyone's online. It's permissionless.

And so things get under the cracks. I think like AI is the angle to fix these things uh as long as we don't have AI on the other angle screwing things up as we go. It seems like we've made an industry that pays a lot better for discovering those initial vulnerabilities than for continuously exercising good judgment about risk. Would you guys agree with that?

Isn't that the entire world, honestly? Like

[laughter]

Yeah, we fix that. You know, I mean

We have to honestly, I think I think about this a lot and I think the way we we fix security is you align incentives. You can't offer a million-dollar bounty and then the guy reports it and then you um you you lowball him or you don't award him the amount and then you get more and guy more guys going black hat and they they'll get 10x that reward amount. And no KYC, no taxes. Like the incentives are there for that, right? You need to re-align those.

But then you also need to re-align the incentives from a protocol developer's standpoint, the company, and the user/investor. And I think that's solved by some sort of insurance product, to be honest. I think there should be a backstop that you could buy into that's baked into the yield, or whatever it is, but and we've tried this before, and it hasn't worked out exactly. There's many reasons it could be gamed, but it is a start, and I think someone can build it and do it right. Maybe that's me, but I think I think that could be a solution to this issue.

Do you think the problem is like architectural at all within the apps themselves? Like, could we you know, I I see a lot of apps that use bridges, oracles, front ends, um multi-sigs, libraries, whatever else, um insecure governance. Like, should we be focused on forcing better specific patterns you guys can think of, or is it more just, you know, something else?

Yeah, I think you can you could do it actually DeFi. You could do DeFi pretty safely. You you don't roll your own crypto. You don't need to flex on other devs and create a new way of doing a bridge. Like, all this has been solved for the most part.

But it's permissionless. Anyone can do what they want. You're not getting a 100% perfect protocol out there. Uh but these these guarantees uh the tech is here. It's been there.

It's just about building it on your protocol, using that stack correctly. Um that's that's a good question. Like, how to get people to do that consistently? It's it's a very difficult thing in practice.

Like, not forcing a bunch of apps together? Like, do we migrate towards more of like super app kind of approach or

How about just no one-click How about some some speed bumps? Like, why can you still do one transaction full protocol drain? Who needs to pull out 200 million in one transaction? I'm all about permissionless this and that, but however, I don't think it breaks the whole thing, you know, composability aside, but just a limit like, "Hey, this withdrawal, maybe there should be a check here after withdrawing X amount of TVL." Just maybe.

I think like very tiny safeguards would prevent a massive amount of hacks.

Yeah, and they they generally do not exist. If I may mention like from from the hackathon, there was a very interesting small uh project called Ripcord. Uh And the guy was trying to more or less detect, let's say, where there are safeguard, whether there's ways that they can be bypassed. So, for example, if you have a structure um where you do have a time time lock for decisions by governance, is there maybe another like super admin that could switch that off? Is there maybe a situation where this could be bypassed in some other way?

Like, some other function that is not behind time lock and does a similar thing when combined, etc. So, like I feel like one, okay, nobody's really implementing the safeguards, and two, we don't even have the the frameworks for whether the safeguards are correctly implemented because there's so few people implementing them in practice, right?

I think we know what to do. I think there's as many people not doing what they should be doing. You can You can look at the code all you want. You can look at all the the right libraries. Everything's been battle-tested.

You can put all that in practice, and then you could have all the trust assumptions flagged as usual where uh these are just like, "Okay, well, the multi-sig's all here at the conference." Or this guy is applying for jobs with North Korean fake employers, and he's on your he's as your employer key as well. I mean, there's so many screw-ups that, like I was saying before, hard to evaluate that risk as an investor because you don't know what's going on in the back end. Like, you don't know how the devs are are handling opsec and everything else. So, I I hate to complain about it, but I'm like, all this stuff should is is out there and it to do men, like basic security, and people just don't follow it, and unfortunately, the market doesn't penalize them for it.

Yeah, I mean, we do have a little bit of an audience here, like everyone here presumably works in crypto. Who here is a BYOD? Who is bringing their own device without, like, MDM like without company-based device management? Is there anyone here who has proper controls on their laptop governed by their company right now? I don't believe so.

No, of course not. No, no one does it.

So, the most basic measures.

So, you guys would probably agree if I said the governance angle is like the biggest risk factor rather than maybe the code bases themselves at this point.

Yeah, I think you should have this be true DeFi, right? Have it be immutable. Have it be no ownership, none of those vectors. And if there's a bug in your contract, okay, fix that and deploy V2. Like, I love Uniswap's model, immutable V1, immutable V2, immutable great.

Like, it's good. Yeah, there's latent bugs. But are they protocol-destroying bugs? Hopefully not. Like, that gets flushed out.

If there is, no one uses it, you deploy a new version. But like, this whole upgradeability proxy thing started out as, you know, not to be as widely used as what it is now. And it's like, this isn't where you just push an update to your favorite video game. This is you dealing with millions of dollars and it's recklessly done so many times that we should really remove that vector from the whole thing entirely. And you just take down one whole level of risk right there.

My project is kind of like the equivalent of making everybody, researchers, developers, kind of walk around with like name tags with their biases attached to them sort of. Do you think reputation and identity for developers and for multi-sig holders would do much to solve the problem? Like do we not have a good enough view into that piece now? Is that maybe part of the issue? Could that help?

Uh I don't I don't know if anyone cares to be honest. Like we can we can look at crypto Twitter, the bubble. But do actual investors, whales, institutions care about the rep of uh a GitHub pseudo anon? You know what his reputation

Seems like we should make them care.

[laughter]

We should We should, but in reality I I just don't think they're going to go into the weeds like that and guys spin up new identities all the time. Um you know, you know who's who in the scene if you're deep into the scene, but you know, the investor doesn't care like who coded this. It's more about hey, has um you know, X security firm looked at it? Whatever checkboxes they have to check on their end. Yeah, I I'd say that's that's where we're at now.

Do we generally reward people for raising uncomfortable concerns or we accuse them of fud more often?

Number two. It's number two.

Follow the money. Right? If If the guy pushing out supposed it fud uh has a lot of detractors with a lot of capital vested in there. Um the truth might not see the light of day, if you can't prove it. We're all about trust but verify.

Um but there's also unfounded fud. Remember the Tether fud guy? Uh you know, Bitfinex or whatever it was. But, um if you do have some stuff that needs to come out, I see it time and time again, and it'll be suppressed. Look at Terra Luna, look at so many different projects that there's just so much there's an ocean of capital behind it, and you're just one voice out there in the x-sphere.

So, yeah. Unfortunately, money money and influence and network effects rules all.

Well, this has been a little negative. Do we have any projects we can think of that are doing things particularly right that we should give a shout-out to at this point? Like, architectural approaches or like, you know, even if it's cultural, whatever the case is.

Silence on the stage.

[laughter]

There are There are

Brutal.

There are a lot.

But, um there are some great teams we work with. Uh we try to be, you know, as we're we're trying to find the bugs that humans miss using our AI platform. And uh we we see some teams that prioritize security more than others. Uh usually these teams are dev heavy, very technical founders, they get it, they understand the risk. Uh and then there's other teams that simply won't allocate the capital that they should to security.

And I I hope everything goes great for them, but um based on my experience, it usually does not end well, unfortunately.

Do you think if the protocols or the teams themselves had some idea that eventually some kind of compromise was maybe likely to happen that they would change their approach or that there were specific architectural directions they would take to like, make safeguards, like cut down control of specific areas or I don't know, governance angles for rather than making a responsive security ecosystem, make it proactive more.

That's That's what we're selling is a proactive security approach. Uh that is the only way to go cuz you're dealing with AI black hat attacks 24/7 against your protocol. But, I would say no, this is not the case. People don't do that. It's just like buying car insurance.

People buy uh the very minimum instead of the full coverage or they don't buy life insurance or whatever because they assume most people assume it won't happen to them, whatever it is. And this could be hacks as well. And it's It's It's uh that's human nature. I'd say there's some responsible security-focused teams that do look forward and they do say, "Hey, you know, we understand the risk." Maybe they they had been hacked in the past.

Uh but, it's it's few and far between, unfortunately. I'd say the bigger [clears throat] projects get it and that's probably why they're still here. They've faced incidents in the past. But, uh newcomers, a lot of these guys are new teams and uh I don't know. We need to adjust the incentives so they align and and they focus more on security.

Kind of sounds to me like you have to almost have almost forced the culture that everybody has to align with some kind of like monitoring, insurance, whatever it is, some kind of incentive outside the protocol that uh you know, puts the risk on them more than just on the customer. Would you guys agree with that?

Yeah, and maybe this Maybe this is where DeFi goes, right? Maybe it it becomes and we see TradFi coming in and everything, but maybe the risk becomes borne on the protocol. Maybe Maybe it is. I mean, it's amazing that hasn't happened. Like people just say, "Oh, well, they lost the money."

And they just kind of followed under the rug, but maybe that's what happens. The risk is pushed back to the protocol. And I think then maybe you align incentives and they take it much more seriously.

I would hope for that, but then again, reality seems to go a different way, right? At least in practice, I do not see I I see more of a centralization at the end of the day, right? Like it's going to either become regulated to the point of non-functioning or it's going to stay a wild west, but then it's only for people who are willing to risk it. But I know in a way when you look at crypto yields and for like stablecoin yields, they they do tend to at least at at certain times be much higher than bond yields simply because in a way, if you think about financially, the risk is built into the yield, right? So, maybe there is a

DeFi

In in certain DeFi, yeah.

No, the risk would be you should get a thousand percent return. This the risk is not just a few basis points above the risk-free rate. This is DeFi yield is almost unquantifiable. But I'll tell you right now, unless you're getting DeFi summer 3,000% yields, um even though I'm bullish on DeFi, I think most protocols are uninvestable.

Thank you for the very clear measure of whether one should invest in crypto, the answer being more or less no.

Well, any closing thoughts, guys? Hopefully something hopeful.

[laughter]

Okay, so listen, bullish on DeFi as always. Uh we I got into this uh as a top bug hunter. I've been finding bugs a long time. We developed an AI system to help find bugs and to be this proactive arm of security specifically to help improve the security of the ecosystem. It's terrible now.

But we think that the whole one-off audit approach is a done model. Uh and you need a continuous security approach proactively to protect your protocol. So, that's what we build. That's what we're working to to help clients on. Uh it is it's a war zone out there with AI and um that's just one risk layer, you know?

And then you have all the other ones we discussed. So, we're trying to do our part on that and then other parties are helping to do um like dark and certification standards and and doing more on the human side. So, um I think we'll get there. We'll We'll get there. I'm very bullish about it.

It's just we have to talk about these problems and communicate and just be honest about it that we have a lot of work to do. And but uh we put our minds together and and I think we align incentives and and we can get there.

Yeah, I think there is a golden path that can be reached. But I I think there needs to be a fundamental psychological shift in in what people are willing to put into their body and what they're willing to put into from their wallets in a way. Uh because unless people vote with their wallets and decide not to invest in a very risky protocol, unless they decide to seek collectively better assurances, unless investors also seek collectively better assurances, those insurances will not come about on their own. As long as something is cheap and easily accessible, there is no need to ever change. So, vote in such a way a bear market is good.

Yeah.

Education, I totally agree. Um I think that's our time.

I think education.

Yeah, you're informing the users, right? I mean, that's what you're talking you're describing essentially is putting that information in front of retail, right?

Yeah.

Agree. Thank you.

And monitoring. I think that's it.

All right, thanks.

Thanks.

[applause]