Cheap Attacks, Expensive Trust & the Systems in Between | Boston Blockchain Week 2026

Good afternoon. Uh, so as mentioned, my name is Gregory Molinar. I'm the community and growth director with Vanson Leathers, uh, which is a manufacturer, which I'm excited to hear about with um, the people that are up here. Uh, I was previously with the Rhode Island Blockchain Council as well. uh did a lot of work um over there and I am excited to be along these three people here and I'm going to allow them to introduce themselves.

Start with John.

Happy to be here and again uh excited to be here with the rest of my fellow panelists but John Roberts, chief digital and operations officer at Navig Credit Union. Uh we're about a $4.3 billion financial institution in the state of Rhode Island.

My name is Hameed Pasharia. I'm the founder and CEO of SQE holdings and uh we have basically our own layer 1 blockchain. Uh and we'll chat about that.

Hello everyone. This is Sarah Sari. I'm associate professor at um business school in the BIS in WPI I mean Worcester polyic institute in Worcester Massachusetts. And my research area is in operations and supply chain and um using the blockchain for application in this area. So with the uptick of cyber attacks on a wide range of areas but including you know public infrastructure systems processes um Hamid knowing your past already in that world working with processes and instruments that help manufacturers uh it might not be that some of these problems are new, but the way in which they're being uh exploited or attacked are new.

And I wanted to see if you could maybe speak on what made it cheaper to attack them and how it can be kind of counter attacked. So uh most of you guys probably know just last month there was uh 40 municipalities in the United States that got attacked through the water system. Uh that is an astronomical number considering that a month before that there was al almost none. The main reason is AI. AI has learned how to hack IoT devices.

Uh the basically statistics just just alarming. uh there are 40 billion IoT devices in United States alone and is going to become 80 billion in the next three years and not a single one of them is protected. Even the ones that you think are protected are really not protected because AI has learned how to hack uh basically IoT systems in general. So one of the functions that we built uh it's we started four years ago was how to protect IoT. I foraw this uh back then and we realized that the only way to do that is to get rid of the key exchange because key exchange requires key rotation and key rotation means money.

It costs a lot of money. I mean think about it. Even if you have to pay somebody $50 a month to come in and rotate the keys for you. Well, that's $50 on a month on a $100 device and in a you know in a basic factory there's like a thousand of them that the cost is prohibited. So if the cost is not possible uh the second problem is that IoT devices themselves were never designed for postquantum cryptography.

PQC is not available in most of them. Now PLC's and stuff yes we can do it. The problem is the cost is too much. So the only solution is no key for communication. So keyless communication in my opinion is the only solution and I've talked to several people in the industry and they all agree.

Very interesting. Sarah, with what you do at the universities um and the curriculum that you teach, you may be seeing things that others are not, you know, publicly yet. um with smart contracts and uh AI and what are maybe some of those things that you are seeing?

Um so so far I think I'm the maybe person who has the least kind of technical things from the f fintech background. I'm operations and supply chain. Um but what is very important from operation supply chain when we're talking about digitization of um of the products or the um kind of like bringing supply chain into a digital world is that how we can make sure that the digital um kind of like model or tween that we have um is very connected good connected and can represent very well that entity. So um for me um when when you're talking about using AI because now my perspective is that um when we are talking about AI AI is very helpful in kind of like um capabling our community and people in using huge data, a large amount of data and getting the pattern, finding the pattern, finding the uh risks, everything. Um and and like reducing the gaps that me as someone who is in operations with someone who is in kind of like developers they have but at the same time when I am interested to teach how AI can be useful in the area that I am I'm also concerned about how I should teach a student to to question that AI from the perspective of not only security but what is exactly ly the the logic behind that the assumption behind that and at the same time concern in whole university not only WPI everywhere is that um how we should keep the level of thinking and learning at universities or I mean it's not going to be replacing AI with everything so that's something that is um also important for us from the university perspective that we would like to talk and we are talking a lot about how we can talk about the standards and how we should um kind of like bring AI not only to the teaching and research but also um like advising students so that we can um we can also know the value of that the um the the assumption or testing them verifying them that's that's something that is concern or not concern I mean something that we really taking care of that at universities

and you mentioned a lot of data and so John at a at a bank you guys are dealing with a lot of consumer data important you know financial data what is it what are some of the things that as a bank and regulated you know you can't just do what you [laughter] want um what are some ways that you guys are looking at AI both I guess from being attacked but also implementing some things that the consumers can benefit from.

Yeah, sure. So, uh I'll I'll start with benefit. You know, I was actually just talking to to John before this session from Cubic, and one of the big things you've seen is massive consolidation in the in both the credit union and the community bank space where especially if you're under a billion dollars, there's this there's drive for scale. And the perception that's been out there is that the only way to achieve scale is to go out and merge. So merger and acquisition, get bigger, hire more people.

I think that's an area where uh for us AI is almost an equalizer where you can you can look to scale via AI AI alone as we're learning in certain areas in particular cyber security it's not enough but um that's an area where we are able to scale so you look at regulatory compliance uh on the data side you know a lot of the solutions most credit unions are looking at especially in that you know sub5 billion dollar range are all of your off-the-shelf products. Uh a year ago, I remember sitting with uh a couple tech folks and they're saying, "Hey, you'll never be able to afford in the next three years your own AI infrastructure." Um obviously that's changed a lot in even the last 3 months. And you see a lot of the uh you know the the the frontier models that are out there and the open source models and everything's becoming available. Um that's changed because that's a piece where we can't just take that consumer data that regulated data and just pump it out there uh into claude.

You know the last time I checked I think they at a minimum store things for 30 days on their servers. So now that consumer data is out there. Uh we're in a world of you know I mean you talked about attacks. One of the larger credit union insurers just had their own attack. So that hit close to home for many financial institutions saying hey these are the people that we hire to ensure us for for cyber and here they are suffering their own attack.

Um, so it it is it is complex. It's ever evolving. Uh, for me in my role, a close partnership with my risk and compliance team, conversations with the regulators, the reality is that most of the state and federal regulators have not have not caught up with uh with what's going on. So, it's almost a brave new frontier. So, we're all kind of learning as we go.

Um the sad part is you don't you don't see as many uh great ideas being tried out the fintech space you see it but um it's a lot of the same vendor partners a lot of the same large scale companies providing these solutions to us.

Yeah. And you mentioned Claude and there's a bunch of other you know models that people use. Um and we we mentioned attacking being able to be cheaper. Uh you know you mentioned the last three months in the last year a lot of people who never coded or developed in their life have [snorts] launched companies that are doing very well

and are able to if you're on the malicious side do malicious things a lot cheaper that you couldn't have done you know prior prior to that. and and so with like students um and not being regulated, you know, people being able to just code and and deploy and then once it's out there, it's out there. So, uh like what are some ways um Amid that that could be monitored, I guess, and and and tried to be protected against once once this code is put out there. Yes. So when it comes to data, there are four aspects of data that you have to be careful with.

Number one is generation of the data. You need to secure the data when it's generated because if I hack somebody's laptop when they're typing, I don't need to sec you know hack their communication. So generation of data needs to be secured. We call that uh know your data KYD instead of KYC. The second one is KYC.

You have to know the client. You have to know the customer. You have to verify the customer and only then when you know the data is protected and it's being generated by the right person then you can actually secur sec securely communicate the data. That's what we do best. By the way, what what we do at SQ is basically we create keys that are generated locally by shared globally.

In other words, we don't need to transmit the key. So therefore we have we do a perfect job in communication because frankly we never share uh use the same key twice. These keys are large. They are totally unhackable in my opinion. We've calculated we have basically PhD level mathematician who calculated the probability of somebody hacking it.

And it takes more energy than the solar system to hack one of our keys because we don't use a standard 256 bit. we use at least five 8,000 bits of accur of keys. So the idea is this you have to secure everything and then the final one is when you finally store the information what I have learned is that uh SQL databases are not useful because in order to use them uh somebody a company like for example Oracle they try to basically encrypt the data as they store them but every time you want to do a checking on the data you have to decrypt it. So being able to search the data while it's encrypted is not an easy thing. So that's one of the features we built.

So that essentially we have our own database engine. So I look at is that you have to secure all four port parts of it and if you don't secure one of them, you might as well not secure them. Okay. It's really all about the entire platform. Yeah.

Uh going back to to Sarah and the coming together of AI and smart contracts and working with young students who are coming out into you know that kind of environment. What are uh some of the things that your curriculum you know is is focused on? I guess on both ends I'm assuming people want or are more interested in like protecting and then there's others that want to go and create um you know a business or a platform.

Um I mean I can't really talk about protection. I think it's very different from for maybe data science people or software engineer people for example. Um what I know that is a very recent um study from um professional software engineer they found that the new in 2026 they found that um the security thinking for juniors who are developing change from reviewing sorry writing the codes to reviewing the codes it's it's different it's one side then I'm thinking about the students who are going to graduate from um our majors operations and supply chain related that those who are who needs to think of the business process for for managing the chain for managing the products and um when we are um talking about using AI and um for helping them to write the codes to to be more kind of like um coder not coder I mean to just help them to be more technical at the same time um we should actually help them to um think more about being verifier and to to know how they should um how they should kind of think of um accountability of these codes as a person who is going to manage these chains or the networks or the products. Um because for example as everyone knows when we're talking about a smart contracts when it's on blockchain it's very different from the usual traditional software blockchain generally connect directly with payments with assets permissions and if it's anything happens you have already lost many things from the financial perspective um I don't know if uh anyone knows but uh I mean maybe heard um the case for market in 2022. So the [snorts] case was um there's a very smart hacker um Arab Einberg who tried to manipulate the price of MG MGM MGO uh token of that market token and that uh when when they manipulate when he manipulated the price of that token in external kind of like platform that external platform was the main source of mark uh that market oracle to know the value of collateral of that.

So it gives the like wrong information to the smart contract who was um who was kind of um responsible for telling the market that hey now you can actually lend this amount of money to Mr. Eisenberg and then he borrowed and withdraw 116 million assets there and then and the issue was not only about the coding the security is very important but the problem was that this the smart contract even the smart contract was not correction behind the data that was fitting the smart contract and this is something that I as a someone who is in um area I would like to tell my students that um it's not only coding it's the the business process behind that it's the challenges um and the test that we have to have for the data for the verification of the data for the trustworthiness of um actually the the tr the output of the of the smart contract these are the area that I would like to highlight in my class and for my students.

Yes. Uh so John, hearing that um it makes me think that there's areas where that could be applicable to banking and people trying to manipulate things. Are there areas that you guys are looking to add AI um like for consumers to be able to interact with let's say and if so what are some hurdles maybe that that you're seeing or having to go through? Yeah, the the consumerf facing piece has been a lot trickier than you know back office operations. Uh doing that internally honestly the biggest challenge with the consumer facing is you know ultimately report to a board of directors.

uh they represent the credit union membership. And there's still and our board is excellent, but there's still very much a uh you know, if you go and there's an old joke that if you go and you ask 15 different credit unions all separately what they excel in, you're going to get 15 credit unions that say member experience, you know, and and that's just kind of what everyone rests their laurels on. Um, and there's this there's still very much this feeling that uh AI is still unpersonal, which I think many of the people in this room probably don't believe in. They're seeing the capabilities. Uh, but it's an education process.

So, it's educating your board. It's educating the rest of your executive team. It's educating all of these non-technical people. And and you know, I've got a team that's far more technical than I am. Um, but that education aspect takes time and getting people comfortable with the concepts of AI and what it can do for them.

And then once we get there, we've got to do that to the membership too, you know, and it's um it always becomes like a who stole my cheese, you know, the the change itself is often the most difficult thing to uh to overcome. Um, but it's reassuring, you know, education. Uh, having the next generation of workers that come in that understand, uh, process is just as important, if not more important sometimes, than the coding. You can have a great coder that doesn't understand the process and you're going to have a a technical abstract at the end that doesn't provide any value to the consumer. Uh, you need to understand the process to be able to translate that value down the line.

For sure. Absolutely. And um with you know, we've seen like these stories that get out of uh models like breaking out, you know, and and going to do their own thing essentially and having to like get shut down. And so with systems that you know might do that or systems that maliciously and anonymously get deployed out as as an institution or you know a supply chain a manufacturer like what are some practical ways that that can start to be defended against or at least looked out for. Um, and really like if something does happen and and it is anonymous, what happens?

Is it just oh well you out of what?

Well, let me answer that. Like I said, you have to secure the information at all levels. And if you do secure the information at all levels then theoretically what you suggested will not happen. Uh but you have to have you know uh uh you have to have mitigation. You have to mitigate every possibility and that is not something that is easy to do especially if you're talking about hardware mitigation.

You're talking about uh you know basically inside people because one of the biggest problem is inside people. So one thing that we created uh at SQE uh and it's been difficult is to get rid of the super users. Super users are one of the biggest problems in any system because you have to trust them. Uh they are the people who have are g gatekeepers. The b blockchains have one benefit.

There is really no super user, right? Everybody has at pretty much the same level and the system kind of like runs itself. So for a bank in order to use a basically a blockchain to solve one problem they have another problem that they have to solve which is uh the cost the cost of you know gas fee uh those are very inexpensive and and I was talking earlier to a couple of gentlemen I'm saying like okay let's say you actually achieve everything and you had the best uh process control everything is done but it cost if I'm going to pay 2 3% % of the transactions to somebody else to secure the data, then then you're not going to use it. And so you don't you won't get the benefit of a smart contract if the cost is too high. And like Bitcoin is the most secure uh chain out there, but it's also the most expensive.

Uh and as you go from proof of work to proof of a stake to reduce the cost, well then you lose some security. Then you go to lower levels and and basically like a distributed uh kind of like local centralized network. Well, now basically uh you just gave up some more security. So at SQE one thing that we were focusing was we cannot give up security at any cost. So our platform was designed so that we can create the highest security at the absolute lowest cost.

Just to give you an idea, uh a transaction in terms of energy consumption on our chain uh is 1.5 trillion times cheaper than Bitcoin while we are more secure than Bitcoin. So this is a changing paradigm. The you know we just started introducing our chain to a few clients. We actually we don't have any retail.

We only worked with uh uh with basically uh corporations so far. Uh we have made a few uh really nice strateg uh strategic relationships which we are going to announce. Uh you know but but basically we solve the problem when it comes to hardware. We can secure hardware. We can secure browsers in a way that nobody has done before.

We can completely secure so that at your own laptop uh you can secure yourself. If somebody wants to hack you, they cannot do it because they're not you. That's the only thing that you can protect. So if I can verify who you are without knowing anything about you, well that's the technology behind our technology. Okay.

So yeah, it's not easy but I think we are there finally as um being at the position that you are at. What I guess is you know top one or two things that is worrying you in um you know currently like like right now

you know I I think uh the panel cyber security uh 6 months a year ago there is a part of me that thought you know hey AI is my savior look at the pace with which we can identify these threats and the tools available to my team and then this year you know as we've seen the the CVS re ramp up exponentially uh the human cost to validate all this information has not gone away it's increased um and the threats become larger more real more rapid uh that pace of change you know we're definitely at an inflection point where uh that concerns me you know it's it's the hope was I'd your reduction and it's it's ramped up.

That's that's interesting to hear. Um in in closing, um I'd like to just go down and have everybody give, you know, a final statement of what it is you're, you know, focused on specifically in this area andor any final comments that you may have. Um one thing that I was um I mean I have in my mind and I would like to transfer to my students is that when we are thinking of using AI I think everyone um is have the same idea maybe is that we are not going to lose the accountability of the people around organizations even though we are using AI and and we know that AI is learning much faster and better than us as human specifically when we are dealing with huge and large data. Um but something that we also should consider and it's I think one of the standards that NI or um OEDC they are talking is that when we are talking about accountability we should also consider the authority as well. So these two can't be separate from each other.

I can't just come and judge one clerk's one clerk in the bank who can uh who should just say to the person your loan is denied because the AI give that direction to the clerk I should go and actually judge the organization who authorized that person because it wasn't him who have that decision. So it's it's more about how we should know the accountability or how we should connect the accountability with authority and the power of the people in the organization.

It's really good Hamid.

Um what I can tell you is that to solve you have to solve the entire problem. There is a trilmma and we think we have solved it which is speed, security and cost. You have to meet all three of them in order for blockchain to become the thing that blockchain has been promising. Without solving all three, you won't get there.

Thank you, John. Uh I would just say, you know, I think events like this uh information sharing, staying curious, you know, some of the questions I ask sometimes are are probably dumb questions, but uh my mom always told me there's no such thing as a stupid question. Um, but I think I think this is critical where you're you're sharing information amongst like like-minded individuals all looking to solve problems, meeting uh solutions providers. You know, you got to stay curious and keep looking for answers and trying to move move the business forward.

Thank you all three of you. Thank you. That is the end of the panel.