Black October! What Is Happening to the Internet? | Hari Mulackal & Odysseas Lamtzidis

📣SPOTIFY PREMIUM RSS FEED | USE CODE: SPOTIFY24 https://bankless.cc/spotify-premium --- Is AI turning the entire internet into a dark forest? Security experts Hari Mulackal and Odysseas Lamtzidis join David Hoffman to unpack Black October, why AI-powered hacking is becoming cheaper and more scalable, how defenders are falling behind, and what it means for your crypto and personal data. --- BANKLESS SPONSOR TOOLS: 🔓NEAR | TRADE CONFIDENTIALLY, GET 20% BACK https://bankless.cc/near2026 🌍 RIPIO | LOCAL CURRENCIES, ONCHAIN https://bankless.cc/ripio 🎯THE DEFI REPORT | ONCHAIN INSIGHTS https://thedefireport.io/bankless 👑BANKLESS CONTENT MCP https://www.bankless.com/premium --- TIMESTAMPS 0:00 Intro 0:08 Black October: Cybersecurity’s New Reality 1:01 Why Cyber Incidents Are Surging 4:06 AI Makes Hacking Cheap and Scalable 6:46 The Real-World Cost of Data Breaches 11:00 AI, Personal Data, and Targeted Scams 15:32 Is Mass Data Exposure Inevitable? 18:02 What the CVE Explosion Reveals 20:50 Can AI Defenders Keep Up? 23:22 Why Crypto May Be Better Prepared 27:34 Are Crypto Assets Still Safe? 31:41 A Silver Lining After the Cyber Turbulence 34:18 Practical Security Advice for Individuals 36:05 Redundancy, Self-Custody, and Limiting Risk 38:02 Simple Steps to Protect Your Wallet 40:39 What Crypto Custodians Should Do 41:29 Security Startups and How They Can Help --- RESOURCES Hari Mulackal https://www.linkedin.com/in/hari-mulackal Odysseas Lamtzidis https://www.linkedin.com/in/odysseaslamtzidis --- Not financial or tax advice. See our investment disclosures here: https://www.bankless.com/disclosures

Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.

• 0:04David Hoffman?

  They're calling it Black October, the worst month in cybersecurity of all time. There's Armageddon on the internet. We're going to figure out today whether it's really all that bad or not. Joining me on this stream today, we got Hari, the CEO of Cantina Security. Hari, welcome to the live stream.

• 0:21Speaker 01

  Yeah, thank you, David.

• 0:23David Hoffman?

  And joining Hari is Odysseus, CEO of FileX. Odysseus has been on the podcast before. Every time there's a security conversation, we tap in Odysseus. Odysseus, I would say, good to have you back, but actually, in these circumstances, maybe not. But either way, good to talk to you, my man.

• 0:40Speaker 02

  Yeah, thank you so much.

• 0:43David Hoffman?

  Okay, so I want to learn a little bit about like what your guys' last two days have been like. You guys are both security experts. It's the worst week of cybersecurity, apparently, of all time. Is it, are you guys busy? What is it like to be in the world of security right now? Hari, I'll start with you.

• 1:02Speaker 01

  As I'll give you an answer that you probably aren't expecting, which is,

• 1:07Speaker 01

  I think the public incidents have been like very alarmist. People hear about all this incidents in the public. But the reality is that this has been going on for the last, I would say, 18 months. The number of incidents have been going up by a lot. Many people do not report incidents to the public. It's just that, you know, with the PHP one, with some of the healthcare ones, you know, it's a big story. And so, taking a step back, like, we started seeing that agents and LLMs were starting to get really good at cyber last year. So back in, back in, I would say, February, we started seeing this change. And we started seeing both offensive and defensive actors starting to use this new found capability

• 1:51Speaker 01

  to build products and also to disclose security issues. There was an uplift in cyberability around January, where the model started getting very good, where the economics was cheap, where now you can blast it on many companies and make disclosures. We did that a lot, starting this year. This year, it's just that, right now, it's just a tipping point, where many companies are starting to show up in news. This is nothing new for us. Last few days, like, we alerted a few of our customers with the PHP incidents, because we had products that would enable them to scan their service area. So nothing new to us, just because we have been seeing this for the last 18 months.

• 2:35David Hoffman?

  Nothing new to you guys, but nonetheless, something just feels different in the last week. Maybe it's a little bit of what you said, Hari, of just the Twitter phenomenon of casting doom upon something, of like inciting doom is very viral, so maybe that's what's different. Odysseus, what would you have to add to like, why this week feels so different than the ones previous?

• 3:00Speaker 02

  I think it's, the tipping point is, as Hari said, in the capabilities. Like, probably, we saw last year with a lot of social engineering attacks, where the deepfakes was the first, like, big change in capabilities. But that was like more targeted, I would say. And crypto obviously was a great target for that. And now we're actually seeing that it's actually very cheap to like blast that on the internet and just scan everything. So, security through obscurity is like breaking down in, you know, real time right now. And that's what we're seeing.

• 3:35David Hoffman?

  I've got this tweet from somebody who works at Anthropic, Anthropic Security Researcher Person, who says, "As bad as things have gotten in the past four days, they are going to get a lot worse before they get better. Security leaders, never let a crisis go to waste. Please go to your boards and ask for help right now." Is it going to get worse? Is this just kind of just like the first time this has emerged in the public zeitgeist? And actually, this is going to escalate? So next week or next month will be worse than October? Hari, what do you think?

• 4:06Speaker 01

  Oh, absolutely. So, with, with a lot of the AI capabilities, it's like, there is this exponential, where either the capability or the cost keeps going down. So every time you have a, the capabilities are already there. It's now the economics. How do we do this at a scale where, you know, it's so cheap to like 100 on every website? It's starting to, this is like starting to inflate, where the same thing that we could do, like, in January, it's like now 15 times cheaper, like 15x cheaper, like, that's our internal, like, efficiency gain. And this will continue to like get 10x cheaper in every six to 12 months.

• 4:46Speaker 01

  So, the way to think about it is that the scope has gone up, where hacking in the past was a bespoke skill. So to hack a company, you are, you needed to have like a lot of talented people that would then, you know, spend weeks, months, maybe years, trying to hack a company. And then, you need to have profit at the end to hack it. So it was never scalable. Hacking has now become scalable, where you can build a factory, where you can give it a website, you can give it bankless.com, and we'll go hack it. You don't even have to, you don't have to think about costs, because it will cost like $10, as opposed to like, you know, two weeks of human time, where now you need to think about ROI. You know, what do I get from hacking Bankless?

• 5:31Speaker 01

  And so, right now, you know, the unfortunate reality is that you can build a factory that will like churn and exploits, and no humans needed, and the economics is falling to zero.

• 5:43Speaker 02

  Yeah. And I think this is also why now the attention is turning away from, you know, crypto, and like just in, you know, broad web two. Because before, in crypto, it was a very clear target, right? If you had something, it was a very clear money to be made at the end, right? So the economics made sense there, and in web two, it was like more difficult, right? It was not clear how you would monetize. But now that it's actually so cheap, you don't need to answer that question. You just do it, and you'll figure it out at the end.

• 6:15David Hoffman?

  Well, you guys aren't really reassuring me in any particular way. This kind of sounds bad. Maybe we can start trying to talk about the scope of the actual harm being caused here? Because there's, it's a little bit confounded. There are a ton of vulnerabilities being found and disclosed. That's not inherently bad. There are some exploits actually happening. That's bad, but they're not exploits like crypto, where if like a crypto exploit happens, people lose money. So that's, that's also not necessarily what's happening. There's, it's kind of muddy as to what's going on. How do we understand or measure the actual harm that's happening right now?

• 6:56Speaker 01

  I mean, at the end of the day, like, like, what is the value of data? What is the value of reputation? What is the value of money? And all of them are getting targeted today. So, if you have valuable data in an application you're using, like, maybe you're a dentist. Maybe your dentist has information about you that you don't want to be on the internet. Or maybe the dentist doesn't want to leak their customer data, because it's liability. So what's happening is, it has become so cheap to hack these companies, that people would just do it. And the way to make money is often by threatening these companies. Hey, I will breach your database if you don't pay me XYZ money. And that's a very, that has become a scalable cybercrime motion today.

• 7:41Speaker 01

  So in the past, you have to think about cybercrime as a business. Like, you know, these criminals need to make money. And these criminals need to, to make money, you need to have scalable unit economics. So in the past, while crypto was a big target, because the money at the end was very high, like, North Korea funded their missile program, nuclear missile program, with crypto hacks, because there was a lot of money to be made. But if you hack a dentist, like, there's not much money to be made. And you have, the resources that you need to hack a doctor or a healthcare company was so high that the ROI wasn't there. And the highest ROI in the past was phishing. So, you find a way to get past your email filter, your, you know, message filter, and you just

• 8:24Speaker 01

  blast millions of emails, millions of messages, and out of the million people, maybe 1,000 will click at it, and maybe a thousand, out of the thousand, like, 100 of them would give you data that is now worth threatening them. Now, the same threat actors are now shifting to hacking, or they are using zero days, they find zero days that are out there that are not getting fixed by companies, which is scalable hack, and now they have data. And with that data, they can challenge the companies. I will breach this if you don't pay me XYZ money. You've seen that across the board, that is going to keep increasing. So there is economic value to it.

• 9:03Speaker 01

  And even at a, you know, bigger political level, you know, if you, just think about if the database of like JP Morgan is getting leaked. I'm not saying it will, just think about it at a political level. That is going to be a political catastrophic, like, if the entire, like, if some of the largest banks in the world have their, you know, records leaked. You know, you can think about the second and third order effects, like, that would change the politics of that country, because, you know, that is exposing people's finances. So, there is true economic damage to these incidents.

• 9:42Speaker 02

  Yeah, and I think a very easy to grog example is how leaking databases like that of Ledger back, I think, in 2021.

• 9:55Speaker 02

  Or other databases were actually linked to the RENTS attacks, right? Where you identify who are the high net worth individuals and then you go after them personally, right? And I think that's like part of why it's hard to quantify. Because the second and third order effects is not always obvious, the connection. That they found this data and then they connected with other data and then they were able to perform a personal attack to exfiltrate millions, either in crypto or some other valuables.

• 10:25David Hoffman?

  So the main thing I'm hearing from you guys is that data is going to be exposed. And honestly, if you asked me about, like, if you asked me before all of this, if you asked if my personal data was out and available on the internet, I would probably say, yeah, it probably is, like statistically speaking. So I'm not, me as an individual, I don't know if I'm more worried about even more of my personal data being on the internet. Cause it was already like that. I take the point that like JP Morgan doesn't want its data out there and it's a company that it needs to protect. So its concern is to protect its data and then, you know, most companies' concerns are about its data. But me personally, the individual, I'm careless. Does that resonate with you guys? How would you respond to that, Hari?

• 11:09Speaker 01

  I mean, that's a great question. I've heard this objection from other people, but I do think like there are multiple things happening at the same time. That this time it's truly different. And we built an AI product, we built an AI security product. And one of our AI engineers, he did this demo to somebody in the office, which is, he asks JGPT, tell me everything it knows about him, his personal JGPT. And then it listed out information about his compensation and their, you know, who their romantic partners are. A lot of deeply personal information about, you know, this individual that when he read that, he was like shocked

• 11:54Speaker 01

  how much his AI agent knew about him. So I think this is like truly different where people are giving up a lot of data to the new products. And agents will then use all this data together to do malicious things for you. Like, you know, if, if an agent had access to David, all of your data, like it can now do things that it couldn't do in the past. You know, in the past, somebody still had to like, look at all this leaked data, understand like what can, how can they like, you know, do something to David with that data? And that was too expensive. Now it's like prompts, like, hey, here's David's data.

• 12:32Speaker 01

  I want you to write this precise email that will make him, you know, do something that, you know, he otherwise wouldn't do. And you can now scale that to millions of people.

• 12:46Speaker 02

  Yeah, like, I think, yeah, like a very, I think we've seen recently is the elder scams, right? Where they call elder people and they say that, you know, your son or a relative is like in police custody or,

• 13:03Speaker 02

  you know, they owe money in taxes or whatever, and then they convince them to give them money. But that's something we're seeing, right? So now imagine that they can do that in a way that is a hundred percent believable because they have all this information about you. And they can convince millions of people, billions of people who are not aware of what AI is capable. So they're more gullible and they can convince them to, you know, exfiltrate money from them, right? At a scale that is industrial for the first time.

• 13:34David Hoffman?

  I've been trading crypto for almost a decade and I've used so many different wallets, exchanges, aggregators or front ends. And I'm basically always looking for the same thing, just one interface with a deep liquidity across a bunch of chains and assets. Where I can access markets like perps, earn yield, trade confidentially and still control all of my funds. And I've never really found it and I'm just always switching wallets, juggling gas fees or getting eaten by slippage. But near.com feels fundamentally different to me. I can do anything I want from any chain and keep all of my activity confidential. Crypto, tokenized assets, perps, payments, I can even earn yield confidentially. One account over 30 chains confidential by default. It's the way that crypto ought to work and it's powered by near, which has moved over $30 billion cross-chain,

• 14:18David Hoffman?

  uses post-quantum signatures and has run over five years on mainnet with zero downtime. Near.com is the best way to be on-chain and be in control. Get 20% of your trading fees back on near.com using the bankless link in the show notes, not investment advice. Dollar stablecoins taught Latin America how to store value on-chain. Ripio is taking that same idea and bringing it to the currencies people actually use every day. With wrapped fiat, Ripio is putting more than a decade of experience powering crypto infrastructure for leading companies across Latin America behind a suite of six local currency stablecoins, covering Argentina, Brazil, Mexico, Colombia, Chile and Peru. Each is pegged one-to-one to its local currency and fully backed by reserves held in regulated financial institutions with independent attestations published for each token. But wrapped fiat is not just designed to sit there, it's built to move.

• 15:03David Hoffman?

  The suite is live across 10 EVM chains with liquidity and integrations already spanning platforms like Morpho, Uniswap and Chainlink. Users can move between local payment rails like Pix and Spey and matching wrapped fiat one-to-one in real time with zero fees on both on-ramps and off-ramps and no FX conversion. Local rails in, on-chain in the middle. And for builders, Ripio offers APIs, webhooks, widgets and a sandbox just from day one. Start building with wrapped fiat today at platform.ripo.com.

• 15:33David Hoffman?

  So it sounds like the default scenario moving forward is that everyone's records, individual records, my health records, I don't even know where my health records are, who has them, but they're going to be made, you know, exploited and made accessible to the internet. And that's kind of the default for just data broadly. It sounds like the default path, the assumption that in a short order here, most data will be made exploitable, vulnerable and accessible by like open weight models. Because the internet has been built on sticks and duct tape. And now we have AI breaking all of those things down. And so data is now just free on the internet. Is that kind of the default future that we have?

• 16:17Speaker 01

  That is a worst case, like that's what.

• 16:19David Hoffman?

  That's the worst case.

• 16:20Speaker 01

  To prevent, like, look, I don't want that to happen. I want your data to, you know, be only with the people that you want to have access to.

• 16:29David Hoffman?

  Okay, so we're not there yet. So the Armageddon on the internet has not created that environment. That is the trajectory that we are going towards if we do nothing.

• 16:36Speaker 01

  Correct.

• 16:38David Hoffman?

  Okay, okay, okay. How much time do we have before that happens?

• 16:46Speaker 01

  So there is this, you know, fun way to think about the time. It's often called like zero day clock. So how long do you have until you need to fix zero days in your environments? And in the past, it would be like months, years. So you had time to fix these issues. These days, the zero day clock is negative days. So that's what it's.

• 17:10David Hoffman?

  The clock has hit zero and you are on borrowed time in this present moment.

• 17:13Speaker 01

  Correct, so you, if you are a company that has customer data, you know, repetition worth protecting, money worth protecting, you need to act today. You needed to have acted like six months ago, but the best time to act is today. So you are living on borrowed time. Otherwise, like, it's almost irresponsible. Like you have a duty to your customers to protect their data.

• 17:44Speaker 02

  Yeah, there was a tweet from Miquita Beer that I liked that says that even your company, your engineers are mentioned as IT department. You don't have to worry about, you know, security incidents because they have already happened.

• 18:02David Hoffman?

  We're, I'm looking at a chart here from a ZeroX Ospere. Can you guys just kind of walk me through what we're looking here on this chart and why it's significant today?

• 18:11Speaker 01

  So this is a great chart to showcase like what we're dealing with. So if you have a software, there is a way to disclose to the public that, hey, there is a vulnerability in the system. So anyone using the software or asset dependency, they can fix it. So these are called CVEs. So like vulnerabilities in your system that people are disclosing. And oftentimes the next step is, oh, upgrade your packages. Because, you know, we have the CVE in the system in this version.

• 18:41Speaker 01

  This is a chart of like the accumulating, well, the CVEs that are getting published, like I think every day. And there are databases that publish this. Oftentimes it's very common in open source projects. For closed source projects, it's a lot limited. They don't necessarily always talk about it. But companies like Apple will always assign a CVE for important fixes in their software. So this is a chart and as you can see, it's becoming exponential lately. You can see that there was a jump a year ago. That's when like the capability started emerging. Right now, there is clearly like a delay in disclosures.

• 19:22Speaker 01

  So like a lot of the changes we're seeing, those were initiatives that started like six months ago that are now showing up in the public. But what's really happening is that the cost is going down. So the, yeah, security has become an economics problem. And like you can convert a lot of cyber risk into what is the cost of doing this hacking? And that is going to zero, which means like number of hacks are going to, you know, infinity.

• 19:52Speaker 02

  And also, I think we're, because of the speed of like, how is this identify vulnerabilities in the past? You would say, okay, you know, we found something and then you would give time for people to upgrade and then you would disclose it. But now the moment you say something exists and somebody can just point their agent to, you know, PHP and say, find me the vulnerability. And now they can, right? So

• 20:18Speaker 02

  it's, you don't have the space to allow people to upgrade. The moment that people are informed that something is possible, they can immediately like go after it.

• 20:30David Hoffman?

  Yeah, yeah. So if the listeners who are listening to this on the RSS feed, we're just basically looking at a chart that is mostly flat. And then it slowly slopes upward and then it goes vertical. And I, and I think what Odysseus is Harry and Harry are saying is like, it's also vertical, but it's vertical but lagging. So today it's even more vertical than the vertical that we see on the screen. The only, humans can't keep up with this. The only way to combat this is with AI. And so our AI defense has to go, it has to be faster than AI offense. So the defenders have to be moving as quickly as or faster than the attackers. Is that feasible? Can we, can we do that? Where is the balance of power between offense and defense these days?

• 21:16Speaker 01

  That's a, that's a great question. And unfortunately for the next, I would say 12 to 18 months, it's going to be largely dominated by offense. So the best way to understand what you need to do is to attack yourself. And so in a, in a safe way, attack yourself from the external surface as if like an attacker were to attack yourself. And now we have a product that does that. So we, we have a product called Apex. It's an offensive security agent. It can take in your websites. It can take in your source code. It can take in any information that you have. And it will simulate an attack. So it will try to attack you, show you like all the ways it want to breach you. And the best thing you can do is fix all the ways that it finds to breach you.

• 22:00Speaker 01

  So that's gonna be a lot of the work next 12 months. Attack yourself, fix the things that it finds. But I think there is a silver lining here where you can now, you know, what's happening with software engineering is software engineering is becoming almost like a, you know, industrial where people talk about software factories now as opposed to like people, you know, writing software in a, in an office. Software is getting built in factories today. What's gonna happen in the next, I would say, two years would be, security will also make a similar shift. Like we will have security factory for every company. So it's constantly looking out for ways to breach you, but also like proactively finding ways to fix the breaches.

• 22:45Speaker 01

  But yeah, next few months, next 12 months, attack, attack, attack, fix all the things that it finds. Make it extremely expensive for the attackers to attack you by attacking first and fixing all the findings. If the cost to attack you is like a dollar, like you will get attacked, like make it like, make it like $10,000. And most people like would not attack you. Most people are not gonna spend $10,000 scalability to attack a random company. They will spend a dollar. That is a given.

• 23:15David Hoffman?

  Interesting.

• 23:15Speaker 02

  Yeah. Yeah. Amazing product. We were using it at Filet as well. We're very happy. It's very impressive. But I think this highlights also something that, you know, why I think it will be, you know, 12 months as Harry is saying or more. It's not because the capabilities don't exist, like products like Apex exist. You know, and we're, you know, we're a startup, we're using it, we don't have any bureaucracy. But in big organizations where humans and bureaucracy is the bottleneck, it will take a lot of time to adapt to that. And I think that is why it will take so much time to be, for all these things to be fixed. Because suddenly, you know, crypto was always the dark forest.

• 23:55Speaker 02

  And we were, you know, grew up in that environment. We evolved in that and we understand that. But the internet was never a dark forest, like security through obscurity worked. Laziness is a human attribute. And suddenly, you know, within a few months, now the whole internet is a dark forest. And organizations and people are not used to that. And suddenly they have to, you know, it's, you have a tanker, a huge ship, and you have to turn it while you're being attacked by small speedboats. No bureaucracy, right?

• 24:31Speaker 01

  I would say like, that's a great point, probably like a very fast and drawn, very cheap drone. That's like the way to think about it, you know? You have this machine and the swarms of agents that are cheap are coming for you. And I wanted to, I think, I think Odysseus touched a very important point with just like, most people remember like the crypto hacks from the 2020, the 2021 era where every, every week there is a big incident. Somebody lost $100,000. And people would always like make fun of the industry for being insecure. And the reality was that, like, the entire software industry was insecure. It's just that crypto had very high incentives for people to hack.

• 25:17David Hoffman?

  It was the economic variable that was different.

• 25:19Speaker 01

  The economic.

• 25:20Speaker 02

  And also everything was public.

• 25:21Speaker 01

  Yeah, you're correct. And now the economics have changed and, you know, you're welcome to the 2020 crypto where you see like a big incident every week. That is, that is a new reality for the real world. And in some way like, you know, you have lived through this in a different era.

• 25:41David Hoffman?

  My, my, my spinal reflex is to like, look at crypto and be like, yeah, this is bullish. Because this is the environment that crypto was born in, like this is, we are home here. Like you guys, you know, non crypto securities, like you are in the room with us now. And we were, we were raised in the darkness, you know, something, something to that effect. I don't know if that actually means like crypto prices go up, but it does make me feel some sort of comfort that like blockchain systems were born in adversarial environments. And now the world is an adversarial environment. Is there, is there some more bullish take than that? Or is that about as bullish as it gets?

• 26:21Speaker 01

  I think you hit an interesting point where, and I always tell people like, like, you know, we're a security company and our job in the past was to secure money. And securing money is the hottest thing in the world. It's like fucking insane. With the, maybe the sole exception of like government to government cyber, which is a, you know, all, all different industry. And if you are in the, if you are in this like circle of like protecting money, like this is like easy. And yeah, so it's now a lot of the job is a scale. So how do you make sure that every single company on the internet can have the same level of like protection that some of the largest like crypto companies have?

• 27:05Speaker 01

  But that's like one way to think about it, but also the large companies in crypto, they also need to invest. Nobody's, only the paranoid survive and like you need to invest in cyber today across the board. But I do think there is a, like philosophically and from an operation perspective, like there is an embedded advantage to companies that were built in this like really offensive environment that has become commonplace.

• 27:35David Hoffman?

  So that was gonna be one of the questions I have is like, what about my crypto that I have stored in Coinbase? Like is Coinbase vulnerable here? And I guess interpreting your answer is like, well, they are vulnerable in the sense that like the cost to attack has gone down. That's true for Coinbase, like the economics of that doesn't change. But the Coinbase incentive to defend has been way higher for a lot longer. And so yes, Coinbase should be concerned, but their starting point is fundamentally different. And so my money in Coinbase is probably not any weaker today than it was a week ago or a month ago. But also nonetheless, it is still up to Coinbase to be very on the ball with advances in security practices.

• 28:16Speaker 01

  Yeah, I would lean, lean into that. Like if you look at, let's say Coinbase and JP Morgan or like a large financial institution. In some way Coinbase is better prepared to defend than your bank. And people often assume that, you know, the traditional financial institutions don't have to worry about cyber risk because you can always like pull back money. That's not the case. Like, like, you know, you,

• 28:47Speaker 01

  people build payment rails and abusing the payment rails are like, there's real risk at place. And if you study North Korea, before, before there was a internet banking, they have found exploits in ATMs and they found, use that ATM exploits to withdraw money. Somebody gave this example where they found a way to exploit target gift cards. And then they were able to use the gift cards to like, you know, get money out of the system. So.

• 29:19Speaker 01

  In some way, like the legacy companies that never had to worry about this intense cyber pressure, they are more at risk than the Coinbase. And I know the Coinbase team pretty well. They are preparing. They need to keep investing in cyber. But your money is safer in Coinbase than, you know, target gift cards as of now.

• 29:42David Hoffman?

  I hope that was always true. Bankless Nation, we've built something for you. Introducing the Bankless MCP. ChatGPT and Claude are great at a lot of things, but ask them anything beyond the basics of crypto about protocol mechanics, tokenomics, or just what happened last week in crypto, and the gaps will start to show. The problem is context. Bankless, on the other hand, has spent almost a decade building one of the deepest archives of crypto data anywhere. More than 2,000 podcast transcripts, 10,000 articles, and countless conversations with the people actually building this industry. And now we've structured all of that data into the Bankless MCP. So you can go and connect it to your Claude or ChatGPT, and suddenly your AI can answer your crypto queries with the entire Bankless archive behind

• 30:23David Hoffman?

  it. And every new Bankless article or episode gets added automatically, so the context keeps staying up to date. The Bankless MCP is exclusively available to Bankless premium subscribers. So you can go to bankless.com, upgrade to premium, and connect the MCP in just a few minutes. And all of a sudden, your crypto queries to your AI LLM, whatever you use, will get 1,000 times better. So go check it out. There is a link in the show notes. And once you become a Bankless premium member, you can hop into the Bankless Discord and let me know how you like it. Cheers. Some exciting news. We are launching a new podcast to help people figure out the crypto cycle, how to navigate it. The best crypto cycle investor I know, his name is Michael NATO. He runs the DeFi Report. This is the guy that sent me a sell alert before the 1010 price drop happened. His cycle analysis has been absolutely on point. I've been following

• 31:07David Hoffman?

  him for years. And this year, we started recording weekly podcast episodes. Each one, we get into his portfolio, what he's holding, the market structure, entry targets, fair market value of Bitcoin, Ether, and where we are in the cycle. There's new episodes that are released every Wednesday. They're 30 minutes. They're short. They're punchy. I think this crypto cycle is harder to navigate than most, so let's do it together. Go subscribe to this podcast. Search The DeFi Report wherever you get your podcasts, YouTube, Apple, Spotify, or find a link in the show notes. There's a new episode waiting for you now. Is there like a silver lining in the fullness of time here? Because we've known that in like modern day software that's built by humans, that runs on the internet, it has been full of holes forever. Like, the internet is built with sticks and duct tape

• 31:52David Hoffman?

  and like paper mache, because humans wrote it. And as Odysseus mentioned earlier, humans are lazy. And so therefore, the internet has been built in a lazy way. And we've only really needed to secure it on an as-needed basis. And that's not the environment that we are in anymore. So like, say, we get through this period, call it, I don't know, 18 months, I think, how are you said 18 months of turbulence in terms of internet cybersecurity. But then on the end of it, doesn't that mean we have like completely secure software for the first time ever? And if once we get to that point, what do we get? Is there like silver lining there? Or is it just like, oh, we just, no, we just get to be back in a normal environment and we get to proceed forward? I don't know. Is there some sort of silver lining in the fullness of time here?

• 32:40Speaker 01

  This is our, let me go first.

• 32:44Speaker 02

  Intuitively, I would say probably yes. So, you know, probably we will, it will not be better, but it will be back to normal, I guess. So right now, it's, you know, right now, it's full on, you know, scale invasion. And after the bloodbath, it's going to be back to regular, you know, hand-to-hand combat between attackers and defenders on more or less equal grounds. But there's going to be first the bloodbath.

• 33:12Speaker 01

  Yeah. I think for me, I have two conflicted opinion. One, agents doing cyber will make software better, like, period. Like, after like 18 months, like, the software we will be building would be way safer than anything in the past. But people need to think about this new, like, the next attacker is an agent, like, and they are not going away. Like, it's like this alien species that's now living, gonna live among us. So I don't think, I don't think people have really taught enough about like, what does it mean? Like, do you want to live in a world where one mistake and you're done? Because there's always like this persistent pressure on you. I think, I don't think the world was built that way.

• 33:57Speaker 01

  Like, the world is always built for, hey, people are safe. Like, most people are not criminals. But now, you know, highly scalable agents that can attack you at any point if you make one mistake, that's a very different world that we will be living in.

• 34:18David Hoffman?

  All right, guys. I feel sufficiently informed. Do you guys have any just like general advice for just individuals like me or listeners of this podcast who own crypto assets or, or whatever, just have data, or individuals who live in the modern era? Any sort of, what are your, what behaviors or activities are you guys doing as a result of this? Anything that the individual should know and learn from?

• 34:44Speaker 01

  So broadly speaking, this applies to crypto and non-crypto. Think about all the products that you're using today. Reach out to them. Ask them like, hey, what are you doing to protect my data, my money, my reputation? And if you don't like the answer, then you should think about like moving your data, money out of the system. And it is almost irresponsible for companies to not take actions to protect their customers today. And you need to look out for it. Like, if, like, it's also now your responsibility to make sure that your data, your money is living in products that are responsible.

• 35:29Speaker 01

  So that is the number one thing I would say, like, do like a personal audit of what are the products you're using, what are the services you're using, where's your data, where's your money? Potential, reach out to them, look at their public work that they're doing. If they are, if their security program is the same as before, leave. Like, if they haven't changed, like, it's coming for them, unfortunately. So that's what I would recommend as every consumer. Look at, rethink where you put your money.

• 36:04Speaker 01

  Odysseus?

• 36:06Speaker 02

  For me, it's all about redundancies and bluster radius. So you assume you are going to be exposed to an incident, like with railway, for example. So assume that the services you're using are exposed and are going to be infiltrated, and then have a lot of redundancies, such that a lot of organizations have to fail at the same time in order for you to lose money, right? So to give an example, you know, if you have, you know, self custody, for example, maybe you want to use a ledger, but also use an iPhone. So you have like two supply chain attacks that need to happen. And also the

• 36:46Speaker 02

  safe, you know, transaction supply chain has to be infiltrated. And also, you know, maybe add some other measure, right? So it's like building these defenses and assume that any service you're using will probably be infiltrated. And if it does, then how exposed are you going to be?

• 37:06David Hoffman?

  That does feel a little bit daunting, because I just think about like, okay, I have, you know, assets here, I have assets there, I have assets there. That's a lot of things for me to like vet, to kick the tires of. And I'm not technical. I'm not technical. How do I do this?

• 37:30Speaker 02

  I'm not sure there is a good answer for that.

• 37:32David Hoffman?

  Yeah.

• 37:33Speaker 02

  Probably, yeah, in terms of like self custody assets, I think if you have, I think the best setup is if you, yeah, you use like probably something like an iPhone with biometrics to secure the keys. And then if you have multiple of these, then, you know, if there is a supply chain attack on, you know, Apple, there's a lot more to be worried about than your assets.

• 38:00David Hoffman?

  I see.

• 38:02Speaker 01

  One pragmatic tip I can give in that context is, we have disclosed a lot of, we disclose a lot of security issues on the internet. Many crypto companies do. And based on some of the incidents we have seen, maybe don't click on links that, you know, you feel are a bit sketchy. And that is like the common way to escalate. So careful clicking links. That should like, especially with self custody, you need to have a trigger. You need to like, take an action. It's very rare that without any trigger. Well, it's possible, but it's very, very, much more difficult. So if you're using a wallet somewhere,

• 38:47Speaker 01

  like, you need to drive an action there. So try to minimize that. And more importantly, like, reach out to these companies. Tell them like, hey, what are you doing? Like, at the end of the day, like, they are respond, they have a responsibility too. Like, if every, if every individual is responsible for securing the software that they're using, like, that's, that's not how it works, you know, like that. Most people are not technical. And we need to build products for everyone in the world and make sure that that is secure. So the responsibility lies in the builders. And yeah, maybe for the foreseeable future, like, you know, stop clicking on random links.

• 39:33Speaker 02

  And maybe for the foreseeable future, consider not self custody. Actually, maybe it's worth breaking up your assets into multiple exchanges, where not only you delegate the security to a professional team, but also they have, you know, cyber insurance. So you know that if, if anything happens, they have some kind of liability. Although I think we're going to see a lot of cyber insurance carriers failing over the next few months. There was a very interesting data point where in 2024, Lloyds, which is the biggest carrier in the world, said that LLMs will create more cyber risk. And, you

• 40:15Speaker 02

  know, the premiums of cyber insurance actually have been falling consistently since 2024. So I think actually we'll see a lot of these carriers failing. So that's even not, you know, a silver bullet, but probably not self custody for the next 12 months seems a good idea.

• 40:40David Hoffman?

  It would be good, I think, in that case, to just have productive proactive conversations, proactive statements from anyone who is a custodian. So like Coinbase being the big one, for me personally, Infinix, for example, is a wallet that I use. But anyone who holds customer assets, I would like to see them make a tweet saying, hey, the internet's scary, but we are on it. And there's somebody whose responsibility it is at these companies to think about these things and to protect user assets. I think that would be a very refreshing thing to see from some of our biggest crypto companies and custodians in this space. Odysseus, Hari, thank you. I feel much more informed about this. So thanks to you for coming on this live stream and just informing me and the Bankless audience about exactly what's going on here today.

• 41:28Speaker 02

  Thank you so much.

• 41:29Speaker 01

  Yeah, thanks. Bye bye.

• 41:32David Hoffman?

  Hari, Odysseus, before I let you guys go, you guys are both have security startups. Who are your best clients? And if people are just like looking for extra help, what kind of clients do you guys work with? Both Hari, I'll start with you, and then Odysseus, I'll go after you.

• 41:46Speaker 01

  Yeah, so we work with some of the largest crypto companies. I miss as a customer, like Robinhood Crypto and Maska, they're all our customers. But increasingly, because now the tools to secure companies are the same, there are agents, there are agents that you built and models that you built. It has become very similar. So we now work with healthcare companies. We are securing some healthcare technology companies and their patient healthcare data. We're securing some AI companies that are now increasingly like pulling in a lot of data. Like, remember the ChatGPT example. So yeah, reach out to us. Like, we send disclosures

• 42:30Speaker 01

  to many companies. We have this factory that can, you know, as I mentioned, like can churn out exploits. The best way to defend is to attack yourself and fix everything that it finds. We're very happy to support companies for free. Like, it's very cheap for us to send you disclosures. So reach out to us, reach out to me on Twitter. We'll send over disclosures. And if you're a larger company that feels like stressed, like we have resources that can help you in this terrible era.

• 43:01David Hoffman?

  Odysseus, who do you work with?

• 43:03Speaker 02

  Yeah, so we work with, right now, we work with the lean ecosystem. So we're protecting the ecosystem there, the L2 from Consensys. So you have a protocol there, we'd love to help you set up. And we're about to launch a new network. So follow us on socials and you'll see where we make our technology available. And yeah, it's interesting seeing how redundancies are starting to pop up. And customers are very interested in having like this, you know, completely orthogonal circuit data from a different organization, different code base, protecting their assets. So it's that two systems have to fail at the same time.

• 43:44David Hoffman?

  Odysseus, Hari, thanks for coming on. It's nice to know that crypto has been kind of on the ball on some of this stuff just by necessity. And now it's the rest of the world's turn. I do feel a little bit more prepared, having talked to you guys and also being in the crypto space. So thanks for, thanks for coming on and educating me and everyone else. Bankless, Henshun, you guys know the deal. Crypto is risky. You can lose what you put in. This is the frontier. It's not for everyone, but we're glad you're with us on the Bankless journey. Thanks a lot.