#897 Keeping Your Crypto Assets Secure w/ Adam Healy

Adam Healy is the Chief Security Officer at BlockFi In this conversation, we discuss security breaches in DeFi protocols and how Adam and his team at BlockFi work to prevent hackers from invading institutions. ======================= Fundrise is the largest direct-to-investor real estate investment platform out there, giving you the opportunity to achieve upside of an asset class previously reserved for institutions and high net worth individuals. That’s right, Fundrise is making high-end private market real estate investing accessible to everyone via an easy-to-use, automated platform. See for yourself how over 190,000 investors have built a better portfolio with private real estate. It takes just a few minutes to get started with as little as $10. Go to http://Fundrise.com/Pomp today and, for a limited time, get $10 when you place your first investment. That’s Fundrise.com/Pomp ======================= Compass Mining is the world's first online marketplace for bitcoin mining hardware and hosting. Compass was founded with the goal of making it easy for everyone to mine bitcoin. Visit http://compassmining.io to start mining bit ======================= This episode is sponsored by my favorite place to buy, trade, and stake crypto, Okcoin. They're the fastest growing US based exchange, serving over 190 countries globally with the easy onboarding and low fees. If you haven't tried them out yet, you should. They're on a mission to make learning about and buying crypto easier than ever, and they're all about bringing more financial literacy to everyone, something we can always use more of. From being the only exchange to integrate Lightning to contributing over $1M for Bitcoin core devs, they're doing incredible work to further the bitcoin ecosystem and they offer lots of other vetted utility assets from gaming to defi. With Okcoin, I feel confident that the future really will be ok. To get started, go to http://okcoin.com/pomp for some free bitcoin when you sign up. =======================

Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.

• 0:02Anthony Pompliano?

  What's up everyone, this is Anthony Pompliano. Most of you know me as Pomp. You're listening to the Pomp Podcast, simply the best podcast out there. Now let's kick this thing off. Adam Healy is the Chief Security Officer at BlockFi. In this conversation, we talk about the things that BlockFi is doing to secure crypto assets on their platform, also how they deal with security issues at their vendors, and then he gives a bunch of advice for you at home on how you can protect your own crypto assets, and also how to think about things like physical security. I really enjoyed this conversation with Adam, and I hope you do as well. Before we get into this episode, though, I want to quickly talk about our sponsors. Today's episode is brought to you by Fundrise. You all know I believe that the best investors both understand and seek out extreme asymmetry. Fundrise is here to

• 0:46Anthony Pompliano?

  help you do just that. It's the largest direct-to-investor real estate investment platform out there, giving you the opportunity to achieve upside of an asset class previously reserved for institutions and high net worth individuals. That's right, Fundrise is making high-end, private market, real estate investing accessible to everyone via an easy-to-use automated platform. Its 1 million users already know that the investment with Fundrise is capable of producing strong appreciation returns and income generation while helping to stabilize a diversified portfolio. That's more important now than ever in our inflationary environment. See for yourself how over 190,000 other investors have built a better portfolio with private real estate. It takes just a few minutes to get started with as little as $10. Go to fundrise.com/pomp today, and for a limited time, you'll get $10 when you place

• 1:31Anthony Pompliano?

  your first investment. Again, that's fundrise.com/pomp. Go check it out, and when you make your first investment, they'll give you $10 on top of it. Fundrise.com/pomp. Next up is Compass Mining. Compass Mining is the world's largest marketplace for mining hardware and hosting. With Compass, everyone can mine Bitcoin. Their team makes it easy to start mining wherever you want, at home or in one of their 23 hosting facilities around the world. Through the Compass Marketplace, retail miners can access mining hardware with similar prices and purchase plans as the world's largest mining companies. Compass miners own their machines, they choose whatever mining pool they want. And they mine directly to their own wallets.

• 2:12Anthony Pompliano?

  Miners who don't want to host their machines can order ASICs directly to their doorstep. Simple and low-cost hosting agreements, coupled with best-in-class customer service, are the reasons why Compass is the simplest and most popular way to mine Bitcoin. Start mining your own Bitcoin today by visiting compassmining.io. Again, compassmining.io. Go check them out and let me know what you think. This episode is brought to you by OKCoin. They are my favorite place to buy, trade, and stake crypto. They're the fastest-growing US-based exchange, serving over 190 countries globally, with the easy onboarding and low fees. If you haven't tried them out yet, you should. They're on a mission to make learning about and buying crypto easier than ever,

• 2:55Anthony Pompliano?

  and they're all about bringing more financial literacy to everyone, something we can always use more of. From being the only exchange to integrate Lightning, to contributing over $1 million for Bitcoin core developers, they're doing incredible work to further the Bitcoin ecosystem. And they offer lots of other vetted utility assets, from gaming to DeFi. With OKCoin, I feel confident that the future really will be OK. To get started, go to okcoin.com/pomp for some free Bitcoin when you sign up. Again, if you want free Bitcoin, go to okcoin.com/pomp today. All right, let's get into this episode. I hope you guys enjoy this one.

• 3:31Speaker 01

  Anthony Pompliano runs Pomp Investments. All views of him and the guests on his podcast are solely their opinions and do not reflect the opinions of Pomp Investments. You should not treat any opinion expressed by Pomp or his guests as a specific inducement to make a particular investment or follow a particular strategy, but only as an expression of his personal opinion. This podcast is for informational purposes only.

• 3:54Anthony Pompliano?

  All right, ladies and gentlemen, we have Mr. Adam Healy joining us now. Adam, how are you? Doing well. How are you? I'm doing fantastic. I'm super excited to talk about this. Before we get started, maybe a good kind of setting the scene, if you will, would be your role at BlockFi and kind of how you guys think about security and the importance in the industry. And then we can get into both for various platforms and also for individuals. In crypto.

• 4:21Speaker 02

  Great. So my role at BlockFi is pretty broad, a lot more than you'd see at another firm for a traditional head of security or CISO type role. I obviously have all of our security program, our security infrastructure. I also see all of our, anything that really gets us close to on-chain. So cryptography, blockchain engineering, our work with various custodians across the landscape. And then it just so happens that I also manage all of our corporate IT infrastructure, which makes the security job actually a lot easier. You know, in terms of what kind of we think about at BlockFi in terms of security and more broadly across the general industry is it's paramount. A core competency for any firm that is, that has crypto on their platform, whether that be their internal funds or client

• 5:05Speaker 02

  funds, security has to be paramount. It has to be a core competency. And where we've seen issues in the industry, it's usually where those firms are not taking that to heart and they're not treating it as a core competency that they have to develop and go along that journey.

• 5:19Anthony Pompliano?

  Yeah. So when we think about security in crypto, it's a really interesting thing because one, it's a little bit more of a technical industry. There's money involved, right? Which obviously creates a better economic incentive or more kind of honeypot, if you will, for people to do bad things. But also, we're talking about assets that are bearer assets. And so therefore, it almost is like, you know, double incentive for people to look at these as targets. So when you guys think about security, I, as an outsider to kind of the security vertical, if you will, would just think of it as there's things you can do internally for your, both your customers or clients, but also for your employees. And then there's things where you rely on outside service providers and they've got

• 6:01Anthony Pompliano?

  to take care of their security as well. Is that a fair way to kind of create a framework for like how a platform thinks about security, kind of like internal and external security?

• 6:09Speaker 02

  Yeah, I think this is something that I wish I could own that kind of way of thinking about it. But this is something that AWS coined years ago, when cloud became the way that the general world started to compute. AWS said, we'll handle security of the cloud. Clients of AWS, BlockFi being one of them. Many others, I'm sure that are listening are as well, will need to handle security in the cloud. Meaning, we're still responsible for everything that we deploy in the cloud. And AWS, Amazon will handle security of the cloud. So I look at that very similar. You know, we have to protect not only our employees, our employee data, client data, client funds, internal funds for the company. But then also do things to educate and evangelize security, not just with clients,

• 6:53Speaker 02

  but also with regulators and insurance companies and partners and vendors. And making sure that anyone we're trusting, whether it's a vendor or a partner, as part of our day-to-day business, they're meeting our security bar and we're holding them to that.

• 7:07Anthony Pompliano?

  Yeah, and so when you start to think about internally, what are some of the things that you guys think about? And obviously, it's a little bit of a hard conversation because part of security is not telling people what you do from a security standpoint. But, but like, what are the things that end up being kind of core competencies that every crypto company really thinks about in the security realm?

• 7:25Speaker 02

  Sure, so I would push back on that a little bit. I would say people that use obfuscation as part of their security program are generally hiding something.

• 7:32Anthony Pompliano?

  Oh, interesting, okay.

• 7:34Speaker 02

  I was, it's kind of timely. I was on a phone call about two hours ago with a, with another company in the crypto space. And they didn't want to provide us certain transparency into their security program. Obviously, you know, I won't go into too much detail for various reasons. But to me, that's a red flag. Like, you should trust your controls, you should trust your security program, and really aim to be as transparent as you can. Obviously, that's a tough needle to thread, but I think we do a pretty good job of that. I've penned a few blog posts. We regularly are out talking to clients on webinars. I did a Reddit AMA. We like to talk about our security program. So I think that should be a red flag for those that are using obfuscation as part of their security program. The, the other things that we think about is really everything.

• 8:19Speaker 02

  So the, the, the table stakes is good enterprise cyber hygiene. Making sure that you're running a secure environment with all of the normal cybersecurity controls and technical controls that you would find at any financial services organization, whether it's an insurance company or a bank or, or even, you know, in healthcare, there's a lot of intersection points in terms of how the The sensitivity of the data they store. And then from there, you start to get into nuances of crypto. Things that we care a lot about are things like insider threat. Ultimately, we have to trust employees to run the business. So how do we instrument log data, data, other enterprise data across the environment? To make sure that employees are not doing anything that is either unwittingly bad, meaning their accounts have potentially been taken over by a third party,

• 9:03Speaker 02

  or knowingly bad, and it's actually a true insider threat concern. So we spend a lot of time thinking and working on that. And in addition to kind of just the core security hygiene. Another piece that I think is part of that core competency of the security envelope that anyone dealing with internal or client crypto assets needs to be thinking about is key management. Private key management is incredibly difficult. And that's essentially what we're talking about, right? The bear instrument, to use your words, the bear instrument that we're talking about is the private key that allows me to send a Bitcoin from me to you. That key is controlling that and making sure that it is controlled in a way such that it's not subject to insider threat.

• 9:48Speaker 02

  It's not subject to external threats. It's incredibly safe, but then also having that balance of we need to be able to move assets to run our business. So building those muscles around private key management, it's incredibly difficult. For anyone that has ever worked in security or technology that might be listening, you just ask yourself, how did my company manage private keys, you know, public key infrastructure more broadly across their company? And, you know, I've been doing this a long time, almost 20 years. And most companies and most even, you know, my previous role within the government, most government agencies don't do it very well. So that is a very niche skill and it's very important to any firm that's operating in crypto.

• 10:27Anthony Pompliano?

  How do you think about that as a specific point of importance? Crossing over to individuals as well. Most of the people listening to this have crypto. They work in the crypto industry, that they're responsible for some sort of assets. How do you think about the key management that is so integral to a business like BlockFi or others? But also the same tenets seem to apply to individuals?

• 10:48Speaker 02

  So I think we kind of think about that in a couple of different ways. So there's the enterprise key management, which is what BlockFi does or any custodian is going to be doing. And then there is the, as an individual, I have certain, if I, maybe they're keys or maybe they're just like secrets, passwords, two FA secrets, API tokens, et cetera, that I have as a personal crypto investor that I need to safeguard. And that kind of is a, you solve that problem differently, right? You solve the enterprise problem differently than you do the individual problem. So for me, and what I recommend to anyone that I, anyone that I'm talking to about, hey, how do I, how do I safeguard my personal crypto or my personal identity more broadly? It comes back to a lot of like the tried and true stuff, right?

• 11:32Speaker 02

  It comes back to using strong, complex passwords, multi-factor authentication. It's all the stuff that anyone in security has been preaching about for years. And it's doing that in a way that is thoughtful, understanding that it's going to take a little bit more time. And it's going to be a little bit cumbersome at times. I've gone kind of down this rabbit hole personally to where even on my mobile device that I leave the house with, I don't have anything on it. I have a mapping app, I have a signal, I have text messaging, nothing else. I don't have email, I don't have calendar, I don't have any banking, finance apps, anything. Now, there's obviously pros and cons to that, but my concern is I don't want that phone falling into the, to the wrong hands

• 12:14Speaker 02

  from a personal crypto investor perspective and having the ability to move funds, move assets, you know, masquerade as me with some emails, whatever that might be. And then kind of boiling that down even a little bit deeper down like the crypto, the crypto stack, if you will, is for those that are managing their own keys. And how do you, and this could be a whole separate conversation. I've walked through this with so many people over the years. How do you manage your own, you know, cold cards or ledgers and backup C-traces? And how do you do all of that? That can get pretty complex and it can get pretty technical, but for anyone that's, that feels confident in managing their own keys, I definitely think for a portion of your crypto assets, it makes a lot of sense.

• 12:54Speaker 03

  Yeah. Joe, John, what questions you guys have? Adam, are there any things you don't have to? Name people specifically or other companies specifically, but mistakes that people mistakes that people are making when it comes to security in the crypto industry today.

• 13:07Speaker 02

  Yeah, so I'll kind of touch on a couple of things. Institutions institutions aren't asking the right questions. We work with hundreds of institutions at BlockFi. And we work with a number of different crypto custodians and crypto service providers. And every time we send out our questionnaire, but these are the, you know, the 30 questions that we care about from a crypto custodian that gives us a good risk thesis. On do we trust them or not? Obviously, we do a lot of deeper diligence, but just kind of at the the table stakes security. We generally get feedback that this is a great questionnaire. No one else asked these questions. So I think from an institutional perspective and an enterprise perspective, companies aren't asking the right questions. And the sad part is it's not their fault.

• 13:47Speaker 02

  It's it's the the skills that it takes to actually ask the right questions and then be able to interpret the answers. Those are pretty niche skills and there's not a lot of people in the space that that can do both of that. We've actually debated internally about potentially opening open sourcing our due diligence questionnaire that we use for crypto service providers and custodians. It's something that we kind of go back and forth on because we do treat it a little bit like intellectual property. But it's something we might do in the future, and certainly we're considering as a contribution to the broader ecosystem. For individuals, I think it would really scare folks. And it's not just BlockFi and it's not just crypto, but even data that Microsoft has released

• 14:27Speaker 02

  around the number of people within enterprise 0365 tenants that don't have two factor authentication on. So I think that to me, if we if every if every individual turned on two factor authentication for every financial app they have, whether it's BlockFi or any bank or anything, you'd see fraud rates be dropping by double digits overnight. So I think that is the easiest button for for individuals. And then I think for for people that are maybe managing their own keys. I think they don't think through the threat models, right? I think they they over index on the government coming after their crypto. And they don't over index on the the the person down the street. Or their best friend, or their neighbor, or their brother-in-law acting nefariously.

• 15:12Speaker 02

  So I think people that are managing their own keys, they get a little too over-indexed on big threats and they don't think about like the threats that are around the corner.

• 15:20Speaker 04

  Adam, so last year, there was like six times more stolen funds crypto-wise than in 2020. Why do you think all this is happening? Is it just adoption or what do you think's going on here?

• 15:31Speaker 02

  So yeah, I think the pie is getting bigger. More people are holding crypto. So the by definition, almost the amount of people that can be targeted with scams, with phishing, with SIM swaps, with all of that is getting bigger. The pie is getting bigger. The other piece is there's a lot of liquidity out there now, and there's a lot of ways to move crypto around that maybe weren't there three or four or five years ago, or factually weren't there three or four or five years ago. I've been working full-time in crypto since end of 17, early 18. And before that, I've been involved in different ways. But there's certainly a broader interest and that is going to bring the bad guys. It's like with anything that you see, right? Credit cards were a new thing. Well, it brought the bad guys. And then credit cards switched to chip and PIN and or chip, at least in the US.

• 16:16Speaker 02

  That brings a different type of threat actor. And we're just going to see that. And it's a little bit of a game of whack-a-mole. It always has been. It's a little bit of a game of cat and mouse. It always has been. Wherever the money is, is where the bad guys are going to go. And that's just, I think, what we're seeing now. And I also think if we think about it, we kind of zoom out and go more like macro geopolitical, we're seeing very sophisticated threat actors, either semi-nation state or semi-nation state backed or some loose affiliation targeting crypto, because it's a mechanism that they can use to get their hands on liquidity that isn't necessarily bound by the traditional financial services market. But that doesn't mean it always works. Even with some of the big breaches we've seen, it's very difficult to move those funds

• 17:00Speaker 02

  and to cash them out afterwards, based on, as we all know, it's not anonymous. It's not actually something that lends itself to kind of widespread fraud or widespread malfeasance. It is, there are plenty of tools out there and there are plenty of agencies that are looking at it now. And there's plenty of third parties that are helping them provide that transparency. So, you know, I think it's all of those things and probably it'd be hard to say kind of. Which is more and which is less.

• 17:29Anthony Pompliano?

  Gotcha. And when you start to think about kind of adoption cohorts, we had individuals, then we had organizations, both public companies, financial institutions, et cetera. And now we're starting to get into what I would consider the nation states. Talk to me about what you're seeing there from a security standpoint and how important some of that kind of difference of, a difference of the adoption and security that's necessary for a nation state versus an individual.

• 17:56Speaker 02

  Sure. So I think as the threat, you know, kind of to my earlier point, like as the threat landscape changes and matures, organizations have to get better. The reality is, you know, a rogue nation state is probably not targeting an individual crypto investors unless you're really vocal, you're known to be holding crypto, you know, people know that you have a lot of assets. Those folks might have a unique threat profile beyond kind of the, the, the day to day crypto investor. I was going to say the average, but I really don't think there is an average crypto investor on these days. So you're more prominent, just like with anything, the more prominent someone is, the more risk they're going to have. There's a lot of kind of similarities potentially between like physical risk, right?

• 18:38Speaker 02

  The more prominent a celebrity or a movie star or an investor or someone is, or a businessman or woman is, the more there is a potential risk for them to have some type of physical violence done to them. So they approach security in a different way. And I think same thing for, for institutions, you know, we've seen so many institutions enter the space. And in the four years or so that I've been in crypto full time, the change has been from, should we, when talking to institutions, should we get involved in crypto to now it's, well, the should is a foregone conclusion. We definitely are, the question is just how much? And, and that's really what I've seen. And I think firms again are really struggling with what are the right questions to ask? How do we have to adapt our current enterprise security practices for this new asset class?

• 19:23Speaker 02

  And for this new asset class that has some fairly unique risks that we know, to your point, are being targeted by nation states for theft. It's a, it's a, it's a little bit of a, of a paradigm shift for, for institutions because you can't just apply boilerplate cybersecurity, boilerplate enterprise security. And I've personally have been on the phone with numerous large financial institutions, kind of helping talk through some of the, the things that we see. And it's, I think, almost always really eye opening to them, the different types of risks and the, the scope of existing risks that. Expand when dealing with crypto.

• 19:58Anthony Pompliano?

  When you do think about physical security, like how do you think about that? So somebody's watching and whether they've got a hundred dollars worth of crypto or they've got, you know, millions of dollars, how do you usually kind of advise your friends or family or anything there in terms of what they should think about?

• 20:14Speaker 02

  Yeah, um, you know, first of all, don't talk about it. That's hard for some of us, right?

• 20:18Anthony Pompliano?

  Whoops.

• 20:21Speaker 02

  I'm with you. So there's a, it's one of those things where there's, I would recommend folks not to talk about it outside of trusted circles. Obviously, you know, we all want to get our friends and family into Bitcoin. We think there's a lot of upside there that that still remains possibly, obviously not financial advice. But we, we want to talk about it among certain groups that we have some level of trust with. I just wouldn't be flashing it. I wouldn't be super out there with it. I wouldn't be very vocal about it. It is one of those things where you can store a lot of assets on a ledger device or, you know, however, and that is a bare instrument. So I would be just exercise good operational security,

• 21:02Speaker 02

  good OPSEC, as we would say in the military. For those of us that are out there, we have to like really think through what are, what are approaches, you know, do, do we want to be more out there? And in kind of personal operational security, personal OPSEC, there's this philosophy, right? What do you project and what do you protect? What information do I protect? And then what do I put out there? You know, you could put out there, for example, well, I don't actually control any of my crypto. My, you know, my accountants and my lawyers do, and then they make trades based on, you know, me giving them instructions over a Zoom call. If you could write a blog post about your personal, personal operational security practices such that someone would, and obviously not give all the details,

• 21:42Speaker 02

  but such that someone would, would probably put you more down the, the stack of people that they would want to go, go after. And there's, you know, people that are maybe more accessible. I use the analogy, you know, you don't have to be faster. Then the bear, I just have to be faster than you.

• 21:59Speaker 02

  So that's, that's, that's one approach to it. Then I think it's, it's one of the pieces that is less talked about, but we have certainly seen crimes against people. You know, in, in New York City, certainly in Asia, in, in other parts of the world without a doubt, where there have been crimes to up and to include kidnapping, specifically individuals to go after crypto.

• 22:19Anthony Pompliano?

  Yeah, it's a, it's scary stuff, but I think that to your point, having a good plan, having the, the security in place ends up being things that you can do in advance, right? It's kind of like an insurance policy. Most people think they don't need it, but this is a message for people to, to take it seriously.

• 22:35Speaker 02

  You know, one, one of the, one of the, the individuals on my team, she likes to say, if you're always ready, you never have to get ready.

• 22:42Anthony Pompliano?

  That's true. The, what, what did Conor McGregor said a version of that? He said, stay ready. So you got to get ready, which is, which is perfect. One other thing I want to ask you about, I saw some people in the chat talking about the HubSpot incident. Obviously this affected tons of different companies in crypto because they just naturally use them as a vendor. And so, one, just to be clear, this was an incident at HubSpot, not any of the crypto organizations, including BlockFi. But talk through a little bit as to how you guys think about vendor security? And is there things you can do to mitigate potential issues there? Just kind of, you know, how, how do you guys think about something like this?

• 23:19Speaker 02

  Sure. So we have a whole kind of end to end vendor management, third party risk process. The, the security team is part of that. We don't manage that, but we're very, very in the weeds on that. We have a lot of due diligence that we do around vendors. We're looking at things like SOC twos, penetration tests, security policy reviews, and a number of other things that, that we analyze when determining is a vendor right for BlockFi. The, the reality is, you know, HubSpot's a real company. They're a publicly traded company. They have thousands of employees. They have third party attest data. Of their security program. But that doesn't really, to me, always work, right? Obviously, it didn't work at HubSpot. There's plenty of different breaches that we could see over the years where firms had all of those things.

• 24:04Speaker 02

  But I think this is one of the situations where you can do all of the right things. You can check all the right boxes. You can have a mature security program that addresses real risk. And the bad guys will still find a way in. And that's pretty much what we saw at HubSpot. And obviously, probably lesser news in crypto, but just as big if not. Actually, I would argue considerably bigger news, well, it was the Okta breach recently as well. But at HubSpot, you know, what happened was, for us, we, in addition to analyzing third parties and doing a lot of diligence around them, we also monitored logs. So we were able to see, it was Thursday evening, and we actually know the exact time,

• 24:45Speaker 02

  where we saw a HubSpot employee from a HubSpot IP address access our HubSpot instance and export files, or export data. And that data was specifically CRM data, generally data that you would find for marketing purposes, things like email, name, phone number, etc. So we were able to see that essentially in real time and kick off our incident management process. And shortly thereafter, alert HubSpot. It is my understanding that HubSpot actually didn't identify this issue prior to being notified by a client. I don't know if we were the client that notified them first, but my understanding is their internal security program, their internal telemetry, didn't create a red flag for this, an alert for this.

• 25:29Speaker 02

  And it was actually the client notifying them that caused them to go into incident response mode. Since then, we've worked very closely with them. We've thoroughly analyzed all the data. We've taken a number of different steps to secure all of our data at HubSpot. What I would like to see, and this is technically somewhat difficult, but a lot of vendors do it, is I would like to see more vendors allowing clients, so firms like BlockFi, to manage our data that is in their environments with customer-managed keys. Keys that where we control the encryption of the data, such that if there is a compromise on the vendor side, they would not. necessarily have access to that data without also getting access to our encryption keys.

• 26:07Anthony Pompliano?

  Yeah, that would be super fascinating if they started to do it, but it would break the kind of the way they think about their business, data management, etc. But I think to your point is they're kind of being forced.

• 26:16Speaker 02

  I think there's, I think there's a lot of interesting things that have been done in crypto, specifically MPC, where very novel solutions could be done around third party data management that no one is really talking about.

• 26:28Anthony Pompliano?

  Yeah. One last question I want to ask you is when you think about security in general, whether it's for the platform, for the individual, etc. Are there any good resources that you would recommend? Obviously, I'm assuming the BlockFi blog would be great in terms of some of the pieces that you've penned and others on the team. But are there things that folks that they say, hey, look, I really enjoyed this conversation. I want to go learn more. Like, where would you send them?

• 26:48Speaker 02

  Yeah, it's a good question. There's a ton of resources out there. I think for everyone, a good kind of 101 starting point, certainly read the BlockFi blog. Certainly follow the kind of InfoSec or the cybersecurity community on Twitter. There's a ton of different voices that are talking about a wide range of issues that span crypto, personal security, operational security. I would also just kind of tell everyone, and you know, something that we think about a lot is how do we make the user experience better? And this is kind of where I would ask for like partnership across all of the user bases is how do we make the user, the user experience better? And sometimes we have to slow things down in order to better analyze risk and to better analyze the safety of the platform.

• 27:32Speaker 02

  And sometimes that that can impact clients say it's fast withdrawals. Everyone wants really fast withdrawals. But for us, it's, we actually need a little bit of a speed bump there such that we can run our risk analytics, our fraud analytics, our security analytics. In the event that there is some type of red flag. So I would say anyone that's looking to go down the journey of security and learning more to really approach it from a first principles perspective. Just because something doesn't make sense, there's probably a really good reason for it. Go in with it, in with it with a really low ego and like a really open mind. And, and start to kind of go down that journey. I think for, for everyone in crypto, really good place to start is the CCSS framework. It's very approachable. You don't have to have a, you know, a computer science degree to read through it.

• 28:16Speaker 02

  It makes sense on the surface and I think that's a really good starting point to just understand, you know, kind of to my earlier points, there's a bunch of questions in there that that you should expect your crypto firms to do. It's certainly not a silver bullet. No framework is, but I think it's a really good starting point for anyone in crypto. And then there's also a lot of overlap that you could apply to your personal life as an individual crypto investor.

• 28:40Anthony Pompliano?

  Where can we send people to find you on the internet? Twitter, LinkedIn, somewhere else?

• 28:44Speaker 02

  On LinkedIn, I'm a little bit overwhelmed with connection requests at times. I am on Twitter. I tweet quite often. I'm not quite as witty as potentially you are, but yep, there I am. The, the actual, the banner image is from the Thor chain hack and it was what the hackers, the note that the hackers left for the developers.

• 29:04Anthony Pompliano?

  Wow.

• 29:05Speaker 02

  I read there because I think that it is, it's very good advice. It's sagely advice, not only to everyone in the space, but just everyone in general, you know, you shouldn't rush code that controls nine figures.

• 29:16Anthony Pompliano?

  Yeah, I have not seen that before. That is incredible. I love that you put that as your image.

• 29:21Speaker 02

  It's kind of funny when the hackers leave you a note.

• 29:23Anthony Pompliano?

  Yeah. Well, and a note that basically is like kind of slapping your hand like, hey fools, don't do this. But I do think that this is an ever evolving space. And so this stuff is just getting started, right? So yourself and many of your peers and colleagues are incredibly important, but also part of the beauty of security is that hopefully no one ever has to talk to you about it because that means that everything's secure. Right? Is, is one of the things.

• 29:49Speaker 02

  Quite the contrary. I'm, I think, you know, again, I think one of our tenets of the security program is we're here to help. Like we're not the department of no, we are here to help. And I think Zach really appreciates that where, you know, we're not always just saying no. So I. I think from from my perspective, I hope people do reach out. I hope people do talk to me. I've hired at least one person from DMing me on Twitter. And I am constantly talking to institutions and individuals that that have questions about BlockFi's security program and we do it quite a bit. We like to be very accessible.

• 30:25Anthony Pompliano?

  I love that. And I know Zach speaks very highly of you. So whatever you're doing, keep doing because he feels very safe with you around, which is good. Awesome. Well, thank you so much for taking the time to join us. I think that this is just a part of the market that most people don't hear from and we'll definitely have to do to get in the future as things continue to progress.

• 30:43Speaker 02

  Absolutely. Thanks for having me.

• 30:44Anthony Pompliano?

  All right. See you, buddy. See you. Thanks so much for listening to today's episode. I really hope you guys enjoyed this one. Make sure you subscribe on Apple, Spotify, or your favorite podcast player. And if you're looking to try to transition to get a new job in the Bitcoin or crypto industry, we've got you covered. Head over to pompscryptocourse.com. We've developed a curriculum with the top teams across the industry. It's a three-week intensive training program with over 50 events packed into that three-week time period. Go to pompscryptocourse.com to learn more and I'll meet you guys for the next episode.