Jonathan Levin - Shut the windows and lock the front door, preventing fund losses in 2025

[Music] Hello. Good morning, ETHC. Bonjour. Um, it's great to great to be here. Um, I'm Jonathan Leven.

I'm co-founder and CEO of Chain Analysis. I'm glad that some people woke up this morning uh after all the events last night. Uh I want to talk to you a little bit about security inside the crypto industry and I think that there is a lot of talk uh around the industry about you know what it takes to secure private keys. How do we think about securing exchange API keys? How do we think about operational security from a fishing standpoint?

How do we think about, you know, all the different aspects of security that are now known to the crypto industry? Um, but actually the way I want to talk about this is that it's really important when you think about securing your nice house in can that you have to think about not just locking the front door, not just thinking about the gate in front of the house, not just thinking about, you know, cameras, not just thinking about closing all the windows before you leave, but actually making sure that you've got comprehensive coverage. age around the house that actually helps you secure all of the contents and your crypto is actually no different. And for all the builders that build these houses and make these beautiful things that the industry has, how do we think about baking in security from from the very beginning? So when I look at the ecosystem, we have two pretty significant problems.

The first problem that we have is money is being taken from users at a pretty high level. And if you look at this year alone so far, we already have, you know, almost as much stolen funds as we have, you know, last year. And actually, you know, we're only halfway through the year. And so the pace of fund loss inside the crypto industry this year is actually you know set to be a record in terms of the amount of funds that are stolen both from services and from individuals. We also learn about more individuals losing funds in another way which is not just about funds being stolen from wallets but actually also from you know fishing attempts.

And so what we see at chain analysis is that a huge amount of the funds that are actually stolen from users today are not because someone actually even gets fished and puts, you know, connects their MetaMask wallet to a drainer or uh inserts their, you know, password online. But actually the largest and fastest growing fund loss for crypto assets is scams. And these are places where either you have an investment scam where someone is promising you returns or you're buying something on Facebook Marketplace or you're thinking about uh you know buying an apartment somewhere and actually this targets really a huge amount of the population and as I say you know the losses on this end of the financial market are actually almost a trillion dollars a year um or roughly roughly a trillion dollars. That is an enormous amount that far eclipses even money that's being stolen. I think about this as the sort of like scammers and bad actors coming through the windows um from the house rather than through the front door and taking you know a lot of people's resources particularly in the most vulnerable parts of our industry.

The thing is is that you know AI is changing really everything and when you think about you know the industries that it's revolutionizing I mean everyone in this room knows that it's you know changed the way that people write code and deploy applications. One thing that it hasn't changed is burglary. you know, it hasn't it hasn't changed the way that people break into houses, but it's certainly changed the way that people break into wallets. And when you think about, you know, these different attacks that have happened over the past year and some of the trends that we see, you know, I think it's really important to understand that the illicit actors are really moving quickly. You have a very sophisticated attack on Binance on Bybit, sorry.

That was really about how, you know, hackers can get into some of your vendors can actually take out one of their developer boxes and really alter code to be able to sign transactions. a very sophisticated, hyperargeted attack on an individual institution, but you get to see a lot of things changing across the industry where now AI is actually allowing people to do impersonation attacks at scale and really this attack surface continues to just grow and grow. And really what this means is that we have to adapt and we have to actually say that the attack surface is getting larger as the industry gets larger. The attacks are getting more sophisticated through the use of new technology. And we as an industry need to take responsibility of making it harder and harder for these criminals to make off with this amount of money.

So where do we go? Where do we go from here? So we have seen some really big examples of bad security practices that we as an industry need to be able to do better at. The first is being able to blindly sign a transaction on a secure device when you are making withdrawals from your centralized service. Um, if people have not sort of read through the incident on B on by bit, you need to do this as a builder in this space because these types of attacks are significant and they are possible also to mitigate which I can talk a little bit about.

There's also been a large amount of admin wallet cloud environments that have been comproi compromised. These are attacks where you can actually have, you know, API keys or access as admins that really a sloppy post in a GitHub repo or, you know, no two factor on an API key can result in sort of hundreds of millions of dollars walking out the door. Again, you know, have a look at these examples. you should read about private key leakage of uh both private keys and exchange API keys that are really resulting in hundreds of millions of losses. And then finally, you know, we are still seeing some zeroday exploits on smart contracts.

We have seen that out of all the protocols and all of the fund losses that we've observed around the industry as chain analysis, you know, 100% of those protocols were audited. So, getting yourself a security audit is not enough to be able to say that we have a secure smart contract. Like yes, it's a it's a thing that everyone should be doing, but actually being able to monitor these contracts and understand how to remediate an issue. If there is, for example, a zero day exploit that even an audit shouldn't even pick up, then we should be in a position where as an industry we stop criminals from making off with that money. And so this is something that I think the whole industry needs to tackle together.

And you know the reason why I'm excited to be here at ETHCC is that you know the future of this industry is really about the builders that are building great products for consumers to to tackle. Um so how does this really work in terms of you know more on the smart contract exploit side but this also happens actually in the context of a buy bit or even a private key theft and you know what what we really see with this is that there is precursors to the attack that are able to be monitored on chain. The beautiful thing about the blockchain is that you know it is open and you can see every part of the activity that people are doing online and you can maybe start to detect these types of attacks way before they arrive at your front door. People need to fund an attack. People may try and exploit on another smart contract.

These are the types of things that actually builders in the space should be looking at contracts that they have that are similar to other people who are building in the space. Um because in all of this preparation that you have for these attackers, you actually get a level of insight about what they may be doing that targets you next. And when we think about this at chain analysis um and hexagate is when we see these types of preparations, we see the best teams actually looking at this in real time and taking remedial action uh before actually funds are stolen from the service. And then really the thing that chain analysis is best known for is actually following the money afterwards and helping you know understand and help exchanges and law enforcement actually freeze funds after funds have been stolen. And you know, in the case of Bybit, for example, you know, we helped uh we helped Maple actually freeze, you know, $40 million worth of those proceeds that actually helped deter some of the the thieves from from doing this uh again.

So what I've said is that really the bounty that criminals have to go and you know steal money from crypto users and crypto businesses and protocols and you know everyone in this room is never it's never been higher. the focus that we've had as an industry on making sure that you've got, you know, security around a private key that you hold or that you've got two factor authentication with secure devices on your exchange accounts and your API keys for those exchange accounts is something that I consider to be, you know, fully table stakes in terms of, you know, being able to be a participant in this space, but actually we as an industry need to be protecting our assets with a full amount of security obser obser observability and remedial action when we need it. And so I think about the ability to even monitor the smart contracts that people are interacting with or deploying as something as basic as a window lock. This is something that is again if you have a house and you're trying to secure just the perimeter of the house, you need to have locks on all of the different entrances inside your your house. And actually the ability to set up the monitoring capabilities on smart contracts is really about window locks themselves.

And I think that when we look at the types of things that you can monitor today to understand where activity is happening, you can you can look on chain at different types of data whether those things are you know attack preparations, gas funding of a particular malicious smart contract, a drainer contract that's being placed on the blockchain. Um there there is you know a breadth of data that that can happen on the blockchain itself and then there's lots of data that you can also monitor when it comes to you know understanding its impact on mark on the market. And so we spend a lot of time looking at you know pricing data and looking for disconnects on prices uh as you know attackers are are preparing you know oracle attacks or other things that that harm users at the end of the day you know these detection engines are stuff that your teams need to build. These aren't something that come fully out of the box. Ultimately, each house is different.

Each protocol is different. Each smart contract, you know, has similarities with others. But actually designing the security around your house means that you have to make assessments on, you know, everything that's happening in your particular ecosystem. And then the thing that's common is actually what types of remediating actions you can actually take as a protocol or as an exchange or as a user. And you may want to start thinking about the ways in which you want to build in the governance mechanisms to pause a contract.

Or you may want to look at how do you use the sequencer that you're on to talk to that team about how do we integrate security more deeply. And you'll want a very flexible way to get notified about these different attacks that are happening across your across your your real estate. And really, you know, this has been something that we have been thinking about, you know, for a decade at chain analysis. And, you know, I'm excited to be here telling you that we are now moving much more to the left of these attacks. that really my view is that chain analysis has been always about following the money after these attacks have happened.

And with Hexagate, we are moving much more to the left where we can actually prevent a lot of these attacks from actually taking place in the first in the first instance. Um and that actually this breeds a lot more security within the you know crypto industry and and this is something that you know as a whole we can build applications and use cases that power a lot more things for a lot more users. So just to to give a sense of like what people are doing today and what what I think good looks like you know there is very much a security through layers approach that people need to be taking. You need to it's not just enough to think about a smart contract audit. It's not just good enough to be thinking about you know secure offline storage.

It's it's really about the layered approach that can stop attackers from getting at, you know, the crypto assets that everyone wants to hold and wants to build for, you know, the users that use our applications. And so you know if you are building a protocol, if you are a builder in this space, you should be able to build observability around your smart contracts, around your infrastructure to be able to actually monitor the risk of abuse. Um, I think about that as being again something critical for any builder on the product side to be able to understand how your products are being used and to be able to detect abuse. If you are a a blockchain ecosystem, if you are, you know, getting people onto an L1 or an L2, you know, we are seeing that these ecosystems are also rolling out security programs. So if for example, if you're a builder on base today or you're a builder on Avalanche, you can actually get a free version of Hexagate to be able to monitor your contracts that allow you to start going down this journey.

Um, and that builder tier is going to be able to service, you know, the basic needs of your of your application as you get started. And really, you know, over time, my vision around how do we prevent scams? How do we prevent hacks? You know, a lot of this is about the a massive amount of data that chain analysis has collected over the last 10 years that we can then apply machine learning and and on onchain runtime analytics to actually prevent these activities from happening. So when I think about the way that you should think about your own application or your own wallet infrastructure or your own person like think back to the you know house in can that had all the windows open they left the front door open it's really hot outside it seems really really great to just connect your wallet to the next application or the next thing but actually you need to start by saying that there are locks on everything and that there's monitoring to make sure that the locks are actually closed and you know really this is what we are this is what we are doing to help the ecosystem and you know if people want to you know work together on these different security layers like we're very happy to do that at chain analysis and um I hope you enjoyed that and I'm not whether we have time for one question or nope okay so thank you [Music]