An Attacker's Perspective: Web3 Security is Better Than Web2 Security - TOKEN2049 Singapore 2024

hey everyone uh I'm Ido I'm one of the co-founders and CEO at block a uh today I guess we're going to talk about um uh web 2 versus web 3 security and how um you know we're working to secure the most adversarial environment we think on the internet so just to give you an overview about blockade uh blockade works with some of the biggest companies in the space today um companies like metam mask openc coinbase and others um we've raised money from some of the biggest investors in the space um maybe even in the world and and our team comes from traditional cyber security primarily kind of the Israeli cyber intelligence units right so my background my co-founders background is in uh finding vulnerabilities in some of the biggest uh operating systems browsers and cryptographic implementations in the world um and over the past two years or so we've been working like I said with some of the biggest companies in this space to protect their users from various different threats that are taking place on chain so like I said we work with some of the biggest companies in the space uh one of those being consensus through our work with metamask um and they've gone and constructed um an independent report um that went and showed that over 47% of consumers that interact with the space or actually don't interact with the space don't do it because they're worried about too many scams and that worry is is very much Justified right uh crypto as we said is overwhelmingly adversarial um and and the reason for that uh we'll talk about in just a second but I just want to throw some stats at you right so over 7,000 malicious new daps are deployed every single week right um over $1.8 billion have been stolen uh through various different hacks across the industry over the past couple of years um and 177% of losses are attributed to nation state actors now the onslaught is constant and it's massive right we see attacks in the hundreds of millions of dollars and and no one even bats an ey right these things happen on a bonly basis and it's practically only a matter of time until the next one happens and the reason all of this takes place across our industry is that um stealing money is bigger than than stealing data right attackers are financially motivated and their goals are ultimately to make a profit it by performing the types of different attacks that they do and so um that's why a lot of these attackers look to kind of start with doing things in web 3 because they know that the time to value is instant if we kind of look at the attack life cycle that a lot of these different kind of threat actors think through so when they go and attack some company or some organization in web 2 ultimately you know they develop an exploit that exploit requires them to go and install malware they need to access an exfiltrate data they maybe you know create some sort of ransomware or or some sort of ransom they maybe sell that data and only then do they kind of generate a profit that time that takes a lot of time takes a lot of Manpower and is ultimately very very inefficient when there's an alternative for attackers that they can just find an exploit and create money right and that's ultimately the world that we that we live in when when we talk about you know uh uh applications that are built in crypto and so as the industry grows because of these kind of problems uh you know security challenges increase as well right um and and blockchains are growing at a significant Pace right when we look at just the past six months more tokens have been deployed on on various different l2s on on ethereum then in ethereum and its whole existence right and so those more tokens result in you know uh more malicious tokens for example right those applications result in more smart contract exploits those um applications result in more transactions and more malicious transactions and more malicious apps and when we look at the different types of challenges right there's you know uh attacks in the hundreds of millions of dollars across various different smart contracts that take place every single kind of uh every single month or so there's malicious transactions that are signed um by unsuspecting exchanges or users because the lack of different tooling that allows them to understand what it is they're signing or taking place right for example the wer ex exploit that took place just a couple of months ago um where ultimately over $200 million were lost to a nation state actor because of signing malicious transactions and when we look at various different kind of tokens right that we said are growing at an impeccable rate we see different types of Honey pods right different types of scams right I'm sure all of you have seen wallets that look like this uh with tons of spam in them um you've probably seen you know various different tokens listed on all sorts of dexes and you can't tell the difference between which one is real and which one is fake and hopefully none of you have interacted with any kind of rug but uh that happens too unfortunately wall drainers are another major kind of problem across the space right uh determining which site is real and which site is fake if you're minting into you know a legitimate nft or if you're not um and and these attackers go and replicate the brands of some of the most popular sites in the space um at record Paces right um we'll see you know L launches taking place and seconds later you know tweets or emails or other kinds of threads uh taking place and doing these things and attackers even compromised legitimate websites right uh just last night um The A.I um website was compromised by one of the largest kind of trainer groups uh across the across the industry um and and and ultimately you know had had compromised many different users and so we take a a different kind of approach to some of the different kind of existing security or infrastructure players across the space right and and the way that we see it is that you know ultimately it's important to secure kind of the infrastructure layer and existing players have done so uh through custody or kind of compliance but when you look at the application layer there's all sorts of different scams smart contract exploits asset theft and things like that and that's where lockade kind of plays and so you know some these different threats that we talked about um affect our our customers in all sorts of different ways right um one of these ways is an insane kind of lawsuits and legal fees right um some of our customers have uh you know been been in the scope of various different lawsuits um that ultimately result in millions of dollars and um and affect their users and their businesses in in in kind of uh unexplainable ways and so the key that we kind of look look to kind of a lot of these different things is you know detecting kind of exploits and detecting various different scams before they actually take place right and and not after right ultimately preventing these types of you know um uh lawsuits or kind of uh um tragedies from happening to our customers but more importantly they users and so you know we cover a lot of the different um uh threats across the space right whether those are malicious staps malicious transactions tokens smart contract exploits and allinone kind of holistic platform which is really critical to kind of finding an end to-end kind of solution to some of the problems that we talked about and there result also pretty phenomenal right um so like we said we work with some of the biggest wallets across the space uh metamask Dimension one right so we scan over hundreds of millions transactions every single month of those finding hundreds of thousands of malicious transactions uh and ultimately protecting hundreds of millions of dollars uh from being lost every single month just for metamask alone we do the same for coinbase right and so in just a couple of months uh since launching right we've been able to protect over $75 million worth of assets uh across their user base and with openc we've had amazing success as well right um they'd seen uh uh hundreds of different malicious nfts being launched across their platform some by even sophisticated nation state actors and ultimately after deploying blockade um those threats have gone down so significantly um that ultimately uh you know uh we've been able to kind of push those attackers off their platform and into other kind of nft marketplaces and in fact you know the results are so significant that when we look at kind of various different threat intelligence signals um at these different threat actors Inferno drainer being one of them which is a massive kind of business right uh Inferno drainer is is actually one of the biggest kind of companies operating in crypto right uh generating close to $100 million run rate every single year um we've been able to actually you know uh shut them down and make their life so significantly harder that they ultimately said hey we're going to move to some other place and Target other kinds of users um and so that's just one example of how kind of applying these types of security measures across various different wallets or protocols or applications across the space can make meaningful impact right this is a company that had stolen you know this is a threat actor that had stolen $80 million uh a year from from various different users ultimately you know we've been able to shut them down and move them to a different kind of um and move them to to to perform kind of U you know their operations in various different places um and so that's kind of a brief overview about some of the work we've been doing across the industry um and and with many different partners um this is some of our uh contact details you can check us out online um and reach out if you have any kind of questions um thank you