Welcome back everyone. I am Caspian Sea and I'm joined
as usual by my partner in crime. Mr. Bennett Tomlin, how are you
today? I'm doing will kiss.
How are you doing? Alright, we have a few crazy
updates. I mean, not that crazy in the
world of cryptocurrency 200 million dollar tax one for the
finance, smart chain. And the other being about mango
markets, which is A decentralized trading platform,
right? So yeah, but just to I'm going
to quickly just let people help people understand what by Nancy
smart chain is because that's going to be the first one that
we're going to dive into Finance, Mart chain.
Basically is a I don't know how to explain this as its there.
Defy platform its finances like supposed decentralized Finance
platform where you can build all these things on it.
But it isn't decentralized and the reason we were able to find
that out was because of this 100 million dollar hack.
That ultimately could have been valued at roughly nearly half a
billion or more but because just because the finance smart chain
BSC is not actually decentralized.
Well they were able to Halt the blockchain and stop the hacker
from stealing all that money. But Bennett, why don't you give
a more detailed? Explanation of what exactly went
down the technical details. I think are not super important
for how this hack was pulled off.
They took advantage of the fact that Finance Mart chain was
using an old pre-compiled version of a library that had a
slight flaw in the way it verified proofs.
And so, because of that, they were able to withdraw things
they weren't supposed to be able to, the piece of the
infrastructure. They were targeting, is the by
Nance, smart chain token Hub, which is the bridge that allows
for assets to be moved. And onto and off of the finance
smart chain. And so that was targeted.
Like, bridges are often targeted.
We talked about the Wormhole Bridge hack a few months ago
where jump ended up having to step in and what happened in
this case is the hacker was able to pretty quickly move.
As you mentioned about 100 million off of this chain onto
other chains and start liquidating it, but Finance was
able to get ahold of all of The validators Who Run the banks.
It's smart chain and convince them that it would be in there.
And the users of Finance, smart chains, best interest for them
to Halt it until they could come up with a way to hard fork and
return those assets to the bridge, right?
So this makes you question the Reality of I'd we've discussed a
lot of. I don't know if we've discussed
it here necessarily, but there's a lot of claims about
blockchains and decentralization in the cryptocurrency industry
in general. And a lot of times what you just
have is like six people or eight people or 10 or 15 or whatever
it is and they try to claim this is decentralized that there's
you know maybe there's some way of electing these nodes and
who's going to run them within the In the ecosystem and maybe
it's by voting with through how many tokens you hold or whatever
it may be. But a lot of the times these
things just are not decentralized and the reason
they're not like one of the benefits of not being
decentralized. It turns out is for security
reasons. Yeah.
It's certainly like it gave them the ability to stop this and I
think that is more notable than some people have recognized,
right. Because they've been comparisons
made. Ed to like the etherium hard
Fork after the Dow hack, or the Bitcoin, overflow roll back, but
in both those cases, it was not possible to actually like hope
the chain and stop it from progressing.
In the case of etherium, a bunch of white hat.
Hackers took advantage of the same vulnerability that the
black hat hacker had taken advantage of moved the funds to
their own, little child Dows inside the Dow and then They
forked it away removing the hackers access to the part of
etherium. He's still here.
The difference here is that CZ was able to call up the
validators, or get in touch with the validators.
However, he did, and let them know.
Hey, we think it would be best if this chain no longer
progressed until we figure this out.
Is there any idea about who the hackers were or are yet?
I don't know that there is for the finance chain hack.
There is some other information for some of the other hacks like
I was talking about the Dow hack and that's from 2017, so it's
not news. But earlier this year, Laura
Shin, the host of Unchained did figure out when she was
publishing, her book, crypto paeans that, Toby Hornish the
co-founder of 10x was the DOW hacker.
Yeah. 10x which we don't need to get into but also a Really
stupid, stupid, nothing. 2017 scam?
Yeah. Do you think this will over the
course of any amount of like, extended timeline?
Besides, just the moment of, do you think this will have any
real lasting effect on by Nance smart chain or on B&B or on
Finance in general? Who the fuck knows?
Right Finance. Smart chain doesn't make sense
as a concept, A centralized way to do defy a chain, that's this
controlled Old doesn't serve a purpose.
The only reason cryptocurrencies are ever useful as for
censorship resistance and we're showing here why this chain is
not that meaningfully censorship resistant, right?
So the only reason it's ever existed is as a way for people
to profit from copycat schemes and like Ponzi schemes, and
these weird games and scams and stuff that propagate in this
alternative chain. All the while driving value to
be in be the token that Finance created.
Rate that derives its value primarily from the efforts of
finance. And so, what's it going to do to
finance chain? Why does by Nance chain fucking
exist? I mean, what it does is shows
any Regulators we're looking at protocols on finance chain and
think, hey, that looks like a Ponzi scheme or hey, that looks
like you're offering unregistered margin trading.
They can now say, so why don't you stop the chain?
And make them remove that because you just proved, you can
stop the chain and remove things.
That's what you did. And so now you might have people
asking you to do that. Laura Shane had CZ on her
podcast, maybe it was two three, four years ago.
And that was when B&B had just begun and she had specifically
asked him is is this a security, right?
Right. So the, so the way I view it is
basically just because multiple people around the world have a
view, doesn't mean that we all agree.
So, but there's there's no legal definition.
That a certain coins at least - cries Nellie's not defined
legally by anybody as a security, many people may think
themselves or they maybe even a comment or PNA email me.
And I'll be like, I think for every person that you find that
who thinks that way I can find more people who are not, I can't
find him people who thinks otherwise.
So I think it's a difference in opinion but it's definitely not
classify legally or anywhere as far as I know.
And to be honest, even if it's classified legally in some
countries probably classified differently.
In other countries and the whole discussion about whether coins
as security or not only came some within the last.
I don't know, six month or so before that there wasn't there
wasn't any discussion about whether it could do coin or URC
20 coin is or is not a security. Nobody cared.
And he said no but he couldn't explain how it wasn't a security
and you can hear her pushing back and being like, I don't
know. I've spoken to a lot of lawyers
spoken to a lot of people about this, and they all say sure.
Looks, it looks like it quacks, like And it and everything about
it seems to be a security and he just pushed back and said no.
So I think we're testing the limits of that with with moves
like this where you stop a hack from occurring by making some
phone calls, one of the things like in the cftc settlement
against Sookie do recently that they made note of in the order
was that b0x. LLC had these admin keys, that
enabled them to stop the protocol and had used them like
in this period before. For they handed those over to
the doubt. And so like the ability to stop
conducting, the behavior is a thing that like we have seen
considered in other cases, right?
We've discussed B&B BSC. We discussed CZ and this.
But what about mango markets? This happened a couple days ago
as of recording mango markets, decentralized exchange fact, for
over a hundred million dollars or somewhere around a hundred
million dollars. What what what happened here?
I'm Not sure this one's a hack. Okay, in it, it's really more of
a market manipulation, right? It's another one of those cases
where they took advantage of how an oracle was programmed, ran up
the price of an asset and in the.
And then in this case, borrowed against that asset, with the
intention of basically letting them seize the worthless
collateral. It's a little bit similar to how
Danny and seafood were accused of cashing out of Wonderland.
Right is taking is basically manipulating the price of time
up, taking out these debts against it and then using those
to liquidate with no intention of ever repaying because you
don't want that collateral anymore and so they didn't
really do anything. They weren't supposed to.
They just made the markets briefly irrational and took
advantage of that irrationality. Now, having said afterwards,
they are now going into the governance.
Rooms and trying to make proposals and negotiate with the
members of the Dow and how much they should have to return to
avoid criminal charges whether or not that's going to work out
for them. Especially since there is a
people online claiming to have identified, the person who did
this hack is less, clear to me, but that is currently where
we're at with the mango markets situation.
What that it is saying here is that essentially, By having
these these tokens that this this lad stole we're not stole
that he made markets irrational. Like Benny was saying, you seen
a lot of this there like flash loam type situation, right?
Like this is similar. Yeah, so this isn't exactly a
flash loan but that the concept being like you take out a giant
loan move that money into some asset or whatever immediately
profit from that position and then pay back the loan which is
now probably valued of like a thousand times less.
Than it was originally, and you've made a bunch of money.
It's taking advantage of the parameters of these different
protocols, and using Concepts that are perceived as being good
for efficient markets and making an efficient markets out of it.
So that's what we saw. And what what Bennett is saying
is now that he controls all of these tokens, he's proposing
things for the community to vote on, where they pay him a certain
amount of money so that he He doesn't get in trouble but also
they get all their tokens back. And this is a common like, this
is a common thing in decentralized finance.
Again, you have like governance based on which, I mean.
Wow, talk about going back to exactly the way things once were
basically, if you have the most money, you've got the most
votes. Most of the time, this is not, I
that's not every single day our or defy protocol, but it
certainly is most of them. And yeah, that's kind of being
Fully taken advantage of right now which is a little bit funny.
It's just a little bit silly in the vein of it being a little
bit silly, the Carlstadt except stack, Chris brunette writing
the piece revealed that they had Discord messages from the person
who had been planning this and then executed it.
And so the attacker of the Mango markets here.
Allegedly avraham Eisenberg was not even being particularly
cautious with their opsec or anything before engaging in this
describing like exactly what they were thinking about doing
and, what effects it was going to have in a Discord and then
they did it. And now they're trying to
negotiate to convince no one at the Dow to file criminal charges
against them for manipulating it.
Yeah, this is Similar to though, this time it was.
Yeah, it's the same. We've spoken about this many
times. It feels like almost every week.
We say, if you gonna do crime try not to like chat it up with
a bunch of people about it, write it down in places, where
it can be used as evidence against you not to say that I
want to help criminals. I don't, it's just, you guys are
really dumb, and I feel like, even this level of, hey, don't
be this fucking dumb. I need to express to you because
you're making everyone else. Else's life, very easy in trying
to capture you and render Justice unless you want to get
caught then maybe start taking more precautions.
So that that's that's both of these, I guess.
At least the BSC hacker we don't know who that is yet and and it
could be, it could be anybody and they they've done some level
of decent, you know, operational security.
But it is just, it is, it's laughable, how often this
happens. That they do almost no like
covering their foot to their Footprints and no due diligence.
We talked about this about North Korea and Virgil Griffith where
we specifically who also is in the news.
Again, recently, it just all of it is absurd.
I think total, I did the math, and it was something like eleven
million dollars a day has been lost in the crypto.
So currency industry this year, if we average it out and someone
responded to that with like and yet the credit card industry
loses 70 billion dollars a year. And I was like you know, the
beauty of, I didn't respond to him because I'm just exhausted
by that argument. But the beauty of the not to
suggest that I'm a fan of credit cards and debit cards and Banks.
But the beauty of those things is that you can charge back that
you can get your money back and it's not gone forever that 11
million dollars a day that's being lost in.
The decentralized finance industry is gone and your odds
of getting it back unless you're bringing criminal charges
against somebody. And you figure out exactly who
it is, and where they live are minimal.
So I think it's apples to oranges.
It's not the same fair comparison.
But yeah, I guess this is 200 million dollar hacks in roughly.
45 days. Separated from one another, it's
getting to be a little bit taxing.
I would say it's get it's almost like even for critics and
Skeptics you just go like oh so another hundred million dollar
hack, the numbers are almost like mind-numbing the mango
markets. Hekkador was just referring to
in the Discord when he was describing it.
Someone asked him or said like unless it is highly illegal to
be like are you sure you want to do this?
And his response was, are there rules these days?
It's very tricky though. Substantial Capital risk, like
are there rules these days these things.
These hacks are so commonplace and so mundane and rarely is it
possible to phenotypically figure out?
Who's responsible for them and many times, like the people who
created these deeply flawed things who caused these people
to lose their assets and get hurt or then immediately back
doing another one. Yeah, well, I've seen that was
sifu or Michael pattern. Pacioretty as we've spoken about
before we've even do Quantrill. I was talking to Ben monster, I
forgot that do Quan even launched Aluna to right after
and that still exist. Of course it does.
But he, he said, I don't remember who he is quoting, but
the idea being that, like, after the failure of Lehman Brothers
were bear Stearns. It would be as though.
Those companies were like, oh, okay.
So Lehman Brothers, 1.0 failed and bear Stearns 1.0 failed.
But now, we're going to start bear Stearns 2.0 and like, no
one wants that. No one wants that.
I think even more troubling than that is often when those hex
have defy protocols. There are accusations though,
again, they're very often challenging to prove that It's
the developers themselves, who end up often hacking these
protocols? Right is that they have been
working on it. Whilst not.
Who else could the developers of other protocols who also like,
read solidity and understand. I'm, he's called such a small
pool. Such a small pool to begin with,
you know? Yeah.
And so, like often it feels as though, like they get it up to
20 million in total value locked or something and then the
protocols Calls out to their tokens starts Free Falling, and
no new deposits are coming in and it slowly bleeding out.
Then you'll see this protocol that you vaguely remember,
hearing about months and months ago, but not since suddenly get
hacked and the, and the developers behind it disappear.
And are they disappearing because they're ashamed?
Maybe. Yeah.
There's also been some questions recently, about like criminality
in the space. I think a lot of people are
suggesting that it's easier to it's easier to push the
narrative that like you were just experimenting.
Ting with a protocol or whatever whether you're a criminal hacker
or whether you're a failure of a Founder, like do Quan like how
much it's almost like decentralized Finance makes this
significantly more difficult to prove intent.
Now, I'm not sure if that's actually true not suggesting
necessarily that it is harder to prove intent because I think
when I look at do Kwan's case for instance, it stinks of And
ality and I don't think that the South Korean law enforcement
agencies are going to be fooled by him being like, what?
Just because I was the face of it and I made all the decisions.
I'm not, the one who should be prosecuted and it's like,
actually, you should. So, I don't think there's, I
don't think there's much of a case to be made for him, but
maybe there is for some of this other stuff.
I don't really know. Um, and, you know, we haven't
heard much from 3 AC. So is it, is it easier to get
away now? Today's with, with crime, I
don't know the answer to that. Either that maybe that's true.
Maybe it's not, I don't know. Yeah, it's just, it's
disappointing to see how commonplace these still are and
I think they're all the time they hurt real people, it's very
hard to get the people who did them and also that's the other
thing we hear a lot about is like that, you know, not your
keys, not your coin. If you're going to be doing
stuff in this industry, like expect rug pulls expect exit
scams, these moments are going to happen and I do like it's
hard for me to feel bad for the decision makers at Celsius for
putting money with 3, AC 3 Euros Capital like I were for tether
for becoming, you know, Equity investors in that like I don't
feel that bad for them. Do I feel bad for retail
investors at Celsius though? Like, of course I do people who
like normal people who put 50,000 dollars their life
savings. Into Celsius.
Of course, I feel bad for them. And I don't look at that and
say, like, well I guess that's a lesson you're learning because I
think that's a really shitty way of perceiving that concept like
shouldn't just plowed it in front of retail Traders.
But then you wonder like how much maybe Celsius had a lot of
retail but you wonder like how much I have retail.
And when we say retail, I guess, I mean dumb retail as in that's
an unfair characterization. I say I say dumb retail meaning.
Money, that doesn't understand what it's necessarily investing
in. So mango markets, like, like,
for Celsius. I know, I know there's a lot of
quote, dumb money because it's like these people were assured.
A lot of, a lot of things from Alex Mission ski in the Celsius
team. They were promised that this
was, you know, that there were all this, like, nothing could
ever happen to these investments.
In these, these lending schemes, there was nothing that could
possibly go wrong. They were assured that
repeatedly over and over and over again that had You have
done money. How much dumb money is in mango
markets, right? Like, I don't really know.
I doubt it's that. I doubt there's types of dumb
but yeah. Sure.
And I guess Matt my point I guess my point being a bit here
that Perhaps, Perhaps the dumb, the quote dumb money in or let's
say retail money, let's just say retail, let's go back to read to
let's call it retail money. Again we go back to to retail
money and we suggest that there's of this hundred million
Is that was moved off of mango markets, hundred million dollars
worth of tokens that Wings off of mango markets.
How many of the people involved actually are just like yeah well
we deserve this versus the people at Celsius who I would
assume a lot of them are like I never could have possibly seen
this coming. The people of mango markets are
probably more informed about the cryptocurrency industry, right?
They should be. It's I guess I mean it's hard to
it's harder to use to centralize Platforms in general.
Yes there's a higher barrier to entry anyone who's been trading
and mango markets probably at a harder time getting started then
someone depositing money into Celsius Journey yield and so you
hope that that's going to filter out more of the most vulnerable.
This is part of why we got so upset about stable gains which
was like taking deposits from regular people and putting them
directly into anchor. Write that y combinator project.
Checked because it's removing any of that filter and making
it. So that potentially some of the
most vulnerable and dip exposed to these most dangerous projects
because the issue is there is a tiny bit of Truth in the, it's
an experiment. It's untested.
This is new and things might go wrong, right?
The nature of crypto is that it's designed once a transaction
happens to make it very hard to reverse that transaction.
And so, So, hacks are going to have larger consequences because
of that detail, right? And because of that, when you're
deploying new Financial software, if you are not really
confident about each and every piece of it, there are going to
be more, harmful hacks exploits and problems.
That's just the nature of what cryptocurrency is that?
Part is true. The part that's less.
True is the like there's still often like in the case of
Finance, Change the issue is they had not stayed up to date
with updates to the bridging system in Cosmos, they were
using an older pre-compiled version because they hadn't
stayed up. It had this one vulnerability in
it and so, we're like and they running this chain.
That's like number three. In total value locked behind
aetherium, intron they should be responsible enough to handle
something like that, right? And like in the case of mango
markets, your work will Design is known you.
I've published it and you can to some extent model it.
The hacker even talked about like creating models and
simulations of how the Oracle worked.
The people who developed mango markets should have at least as
much ability to simulate some of these more stressful situations
for the protocol. And so there is still just a lot
of stress testing and a lot of hardening that goes undone in
crypto. Yeah, I mean, you call that a
lot of protocols for this, it's kind of crazy how much money
gets invested in these Concepts. Whether it's I don't remember if
it was Faye. There were a few years Fay, it
was where the math did it out of.
That was one. There was wasn't there.
Another one more recently that you also called out that had bad
math? In the, in the white paper?
I feel like there's been two or three, but it doesn't matter
made it. But there's these people are
able to collect hundreds of millions or billions of dollars
from Venture Capital hedge funds.
Angel Investors with unchecked Lawd, white papers.
None of these Venture, capitalists know how to look at
that stuff and read it. Like it was, it was etherium,
Prague pouch, just in Sun. So right workfolk of etherium,
their white paper was blank, they had no white paper, right?
And so if we think about that, I maybe we're seeing the end of
that now. Like, maybe that was the Easy
Money cryptocurrency industry, like everything's exploding in
value, it's so easy. You can literally have a blank
white paper and collect hundreds of millions of dollars type of
thing. Maybe those days are now behind
us hopefully but I doubt it I think these exploits and hacks
are a great example of it's like more than not your keys, not
your coins. It's showing the world that to
really if you really want to be If you want to be on top of
dealing with cryptocurrency and holding your coins, all the
time, you have to be like technically Savvy.
You have to code, you have to know how to read code.
You have to know what changes are being made when and how they
could affect you. Because ultimately, when a
hundred million dollars or 500, possibly million dollars could
be moved off this chain. If you have a bunch of money in
that, The value of your money could depreciate significantly
just because you didn't know about this hack at this exploit,
that could be taken advantage of.
So I think it's showing like another level of this, that
we've never really discussed, which is how difficult it, it is
to actually be protected, like, in any of these coins unless you
are completely fluent when it comes to programming and coding
and all of that. And I mean the reality is, I'm
not, I'm not that I couldn't I couldn't possibly Sibley like
confirm I'm trusting code. If I buy Bitcoin right?
I'm not I don't own Bitcoin to clarify everybody.
But like when I bought bit coin in 2017, I read the white paper
and thought it was cool. I looked at the charts and was
like, oh, this is interesting. I had no conceptual concept of
like he had no concept of like what is if I go deep into this
code, will I find any Errors or whatever.
I couldn't have possibly told you that and I think that's most
people who are involved in this industry and yeah like I
couldn't I couldn't still couldn't tell you what the what
exactly happened with like the bridge hack for finance and
Cosmo Finance chain, smart chain in Cosmos.
I couldn't tell you what the flash loan type procedure was
for mango markets and the governance tokens and all of
this stuff. No, and that's like such a crazy
difficult. Old Nuance that most people are
not going to be willing, it's like having to learn a language.
It's like be you are your own bank, your own bank CEO, CTO
Chief security officer Chief informatics officer and you are
like the head of the exchange monitoring in the you're also
the analyst for pricing, all the assets and yeah.
So that's just all you have fun. Yeah, yeah, right and I you
know, people have purchased Ledger's Or Hardware wallets.
And these are things that you think are like, well, that's
secure, right? But then it's like then there's
plenty of exploits in regard to those as well.
And we've seen complete doxing of what was it Ledger?
Ledger leak, their whole customer base that we got hacked
or whatever. So, I think you can't so hard to
be again, why we talk about the nice use cases of cryptocurrency
and I think those still exist, but the niche keeps getting nice
year and nice. Year and not nice', or although
it may be that to anyway, think that's going to do it.
We just wandered into 200 million dollars.
I don't want to talk about how that happened.
If you leave a like subscribe, comment will pass you, some VSC
tokens some mango Market tokens. Will throw them your way.
Not I mean, we will throw cryptocurrency or way.
I shouldn't have been that specific about which tokens We
were going to give you but we're very happy to have found this
money and to be able to support ourselves if you can.
You can hit that like And subscribe button.
It'll make our lives easier because we can get rid of some
of this cash that we've stumbled into these hundreds of millions
of dollars. Sorry, I'm getting word that
okay Vin it, I won't no problem man, I won't mention that we can
cut that right out. You're gonna have your own red
notice soon.