How To Keep Your Crypto Safe from North Korea's 2,500 Hackers

Nothing said on the Edge podcast is a recommendation to buy or sell tokens or securities. This content is for educational and entertainment purposes only. Nothing shared here is financial advice. Welcome to the Edge podcast. I'm DeFi Dad here with Nomadic. Today's show features Pablo Sabbatella, founder of Opsac, and Louis, head of operations and audits. Pablo and Louis, thank you for joining us. How are you doing?

I want to set the table a bit for why we wanted to have this conversation. In early DeFi, I think the biggest fears were smart contract bugs, reentrancy attacks, oracle manipulations, and things called flash-loan exploits. But today, the attack surface has clearly shifted. It's much more focused on people and this thing called operational security. So today we want to talk to you guys as experts on operational security, and personally, I want to learn how to make my own DeFi setup safer.

This always worries me as somebody who holds their own assets and manages them. And for DeFi protocols listening, how do they do a better job than they're doing? What are some easy, low-hanging-fruit things that you think could raise the bar for DeFi? We want to talk about that as well.

1. How Pablo pulled Nomatic’s data from just an email

But I honestly want to start with our first call. I called you guys—I don't know if it was 2 months ago—and, to be honest, it was one of the most unsettling calls I think I've ever had. It turned out to be a great call, but about 2 minutes in, you started asking me some questions about my email. You deduced that it was a fairly new email, then you flipped the screen around and basically showed me what you were looking at. You had way more of my personal information than I've ever been comfortable with somebody having, all from just an email on a Google Calendar invite. I want to talk a little bit about that: what was the lesson you were trying to teach me right off the hop?

Hey guys, very well here. Thanks for inviting us.

During our first call, what we did was basically called OSINT, which stands for open-source intelligence. This is a technique used to research people by three-letter agencies, law enforcement, researchers, and investigators, where you look for information about someone both in the public domain and in published information, right?

Public information would be what I can find on Google, paid reports, social media, interviews, etc. And then published information is information about you or a company that should be private but has been leaked on the dark web after a hack or a leak, right? For example, we had the Ledger hack or the Trezor hack of their databases, and that data is on the dark web. So if someone was exposed there, I can find their home address, email address, full name, phone number, etc.

There are basically systems where you can search for anyone's email address or phone number. These systems are sometimes legal stuff, sometimes gray stuff, let's call it. But the amount of stuff that you can find is crazy: where you live, leaked passwords, usernames, your KYC information. Every time you take a photograph for KYC like this, you should smile, because that's going to appear on the dark web—your passport photograph. The amount of stuff is crazy.

What I wanted to show you was basically how much information is leaked out there and is being used by threat actors, and we have no idea about that, right?

2. From hacking for fun to white hat security

Before we get any further, I do want to take a step back and talk a little more about how the 2 of you got into this world. There are terms like white-hat hacker, operational security, and the dark web. These are all terms that get thrown around; as crypto investors, we hear a lot about them. Actually, you don't even have to be an investor anymore to hear about this. It's all related to data leaks and all sorts of malware exploits taking place even in Web2.

So tell us a little more about your backgrounds. I'm very curious: how do you develop these types of skills, and at what point do you realize that these skills can be used for good, defensively, to protect folks who might be victims of these crimes?

My background: when I was 14 years old, I started hacking, back in 1989. At that moment, the idea was just to hack people for fun. There was no money, no credit cards, no Bitcoin, no crypto, nothing. The funny thing was to hack someone else's computer and open the chat room, change the background, and that kind of stuff, just for fun.

When I started learning about security, I created a website where you could learn about hacking in Spanish. Later, it became the biggest hacking and security website in Spanish at that time. It was called Hackemate, a mix of checkmate and hacker. I had many technology startups, and I was also interested in finance and technology.

So when Bitcoin appeared, and Ethereum specifically, the mix of security, technology, and finance was obvious to me. When I got into this, I started seeing that lots of people were being scammed for millions of dollars with the same basic and stupid techniques that we used to have fun with 26 years ago, right? So I said, “Hey, I think I know how to fix this.” I started talking a lot about cybersecurity and simple things that people could do to be safer. Then I decided that I wanted to go all in on this.

I started doing operational security audits on myself, by myself—sorry, for people, for friends, and for companies. Then suddenly I started seeing traction, and this started to grow a lot.

Thanks, first of all, to our CMO, Kim Jong-un, who does a good job for us. Basically, what you see today—and what we're going to talk about now—is that 99% of stolen funds in the industry are not from smart contract hacks. The industry has gotten far better regarding smart contract security because we have very good auditing companies that do formal verification. But the weakest link in any organization—and this is outside of crypto as well—is never code or systems; it's people, right?

So, yeah, I started with all of this, and I met Louis. We were working at the same company, called Crescendo, and Louis was the first one to join the team.

So my name is Louis. I'm French, and I now live in Argentina. I used to do Web2 security, so I always loved cybersecurity and hacking, like Pablo. As you know, in Web2 we protect data, and back then I started investing in stocks and also in crypto. It was the beginning of Web3 security. We started hearing about Code4rena and all these platforms, so I gave it a try.

To be honest, I wasn't the best at looking for bugs in smart contracts, but in the meantime, I realized that many protocols were getting drained or losing money through Web2 attack vectors. That's when I realized I could bring my expertise and help the industry. Meanwhile, I started getting more and more interested in Web3 security.

Back in December 2022, if I'm not mistaken, I wanted to take a break, give myself time to do Web3 security full-time, and travel. So I booked a one-way ticket to Buenos Aires. That's where I met Pablo a few months later. We met back and forth between Europe and Argentina, including at Ethereum conferences in Europe.

Then, in a coworking space in Argentina, we started working next to each other, and then we started doing operational security audits together. At the beginning, operational security was a hobby, something I loved doing, and then it became a need for the industry. That's why we're doing OpSec today.

3. How real is the threat of AI in DeFi?

Guys, I want to go back to a tweet that sort of went viral in our little echo chamber of crypto Twitter. This was from a guy named Manuel Araoz—I’ll botch his name a bit—but we can throw the tweet up on the screen as well. He basically said:

“I now consider all of DeFi unsafe. Coding agents are superhuman at finding vulnerabilities, and smart contract security is too asymmetric. Defenders need to fix every bug, while attackers need just 1 exploit to steal funds.”

Then he goes on to say, “I’ve been privately advising friends and family to exit all DeFi positions, including low-risk DeFi blue chips like MakerDAO and Compound.”

I want to give a bit more context that came out after this. I woke up 1 day and this was all people were talking about, but I believe the reason people were listening to him to begin with was that he was an early founder of OpenZeppelin, which is a smart contract auditing company. I believe he walked away from that in 2019, so even though he’s probably an expert, I question how much he may currently be in the trenches.

The sentiment of this is the main question I want to ask you guys: What do you think of the general landscape of DeFi? Do you think there’s any truth in this statement, or do you think it’s being totally overblown? Again, this was a few months ago. I’ve dragged it out, but it kind of stuck with me, so I wanted to get your take.

Yeah. Manu is an early founder of OpenZeppelin. He’s not involved with OpenZeppelin anymore, but I consider him to be a guy that knows a lot about crypto. He’s totally involved, and he knows a lot about security. Personally, when Manu speaks, I listen and I think a lot, and I think that everybody should do that.

I think that everybody rushed too much in trying to deny what he was saying. My take is this: Every system, every program, every application has bugs. All of them—100% of them, right? We even saw how, 1.5 or 2 months ago, with the basic AI that we have today, there were critical bugs found in FreeBSD or Linux that had been sitting there for 20 years.

What I think is that if you have a good AI system or LLM to detect vulnerabilities, and you give it enough tokens—let’s say that I am North Korea and I have a pretty good AI system to find vulnerabilities, and I give it $20 million of processing power—eventually, it will find something. That will happen.

The problem, as Manu says, is that it’s very different to attack and to defend. When we’re doing audits for companies and we do something called threat modeling, we analyze companies super deeply: What’s your company? What do you do? The teams, the tools, the stack, the day-to-day operations, the workflow, the different security measures that you have, and how you communicate with each other. We have to analyze everything.

We sit with Louis and say, “Okay, we have to find all the different vulnerabilities—all of them.” The difference is that when you attack, you just have to find 1. The work is super asymmetric, and this is why I think AI changes everything.

I don’t know if you remember Sherlock Holmes saying something like, “What 1 man can invent, another can discover.” I think that here, what 1 man can defend, another one can attack or find a vulnerability. The problem that we have in crypto—the feature and also the bug at the same time—is that we want it to be permissionless.

If you have a protocol, and if you’re a bank or Microsoft and you get hacked and they steal some information, okay, it’s a disaster, but it’s data. If you’re a bank and they steal millions of dollars, I don’t remember the number now, but there was a pretty big bank heist. I think that it was like $800 million or $8 billion. It was pretty big. But most of the time, money can be recovered.

The problem in crypto is that most of the time, when the money is gone, it’s gone. You can try to recover funds, freeze them, and all of that, but at maximum, how much can you freeze if the threat actors were not sophisticated enough? 10%, 15%?

4. When will AI tools protect DeFi users?

I think AI changes everything. Maybe the way that Manu framed that tweet was too direct, but in some way, I agree that it changes everything. If you analyze the equilibrium, it’s better for attackers and worse for defenders, because we have the same tools, but again, we have to find all the bugs. They just need to find 1.

I agree with the fear that we’ve seen this year related to all of these attacks, and I got the point of Manu’s post. But what I’m wondering is, I feel like it’s a little bit shortsighted. We’re looking at everything as if the glass is half empty. We’re in a bear market, and this is where the sentiment goes super negative.

What I’ve been thinking about is: When do those same tools get used to ensure that these protocols are more secure? We know for a fact that the Fluid team has been using newly released models with some sort of combination of agents to look for potential exploits in their own protocol.

I’m just imagining that, the further out we get with these tools being used more widely across the industry by the developers who are building, I’m hoping that we get to a safer place. I recognize we’re in a pretty shitty inflection point this year, but do you see that coming any sooner?

Again, you’re the security experts. I don’t know if I’m just some stupid podcaster trying to rationalize why things are going to get better sooner.

I think that no one is an expert regarding this, because this is all new, and it’s new for absolutely everyone. I agree with you that, for example, in the same way that I believe in 5 or 10 years autonomous driving will be 100 times safer than driving manually, at some point they will say you cannot drive manually anymore. It’s very stupid to do it.

I think that maybe in 1 or 2 years, code generated by AI will be much safer than code created by a developer. We should be going to a place where code will be more secure, and that’s good for DeFi. But as you’re saying, that transition is very complicated.

We also have the fact that not everyone has access to the same tools. What happened with Anthropic? What happened with GPT-5 last week, when suddenly they said, “Well, nobody has access to this anymore”?

In the midterm, we should be better. In the meanwhile, I think that companies should put a lot of focus here. The 3 most important things would be using AI to scan vulnerabilities a lot, but dedicating a lot of effort and money to this, because it’s not the same if I put a tool in place and say, “Okay, you have 1 million tokens to spend,” than if I say, “You have 10,000 tokens to spend.”

The second is formal verification. Formal verification is hard, but I think that’s the thing that makes sure the code does what it’s meant to do. And third, OPSEC. But here, what we’re talking about regarding AI is more connected to code.

I agree with you. I think that we’re getting to a better place. Going back to Manu’s post, I think it also goes back to risk-reward. Maybe—and I’m not sure about this—some people consider that the reward that you’re getting in DeFi today may be similar to what you get with treasuries. Given how the threat landscape has changed, this new threat model, maybe we should have better returns. I don’t know. What do you think, Louis?

In my opinion, no matter whether it comes to AI or other tools, it’s always going to be criminals against companies and users. It’s all about incentives.

The first example is when we talked about OSINT at the beginning. This is something that we do for clients to show them how exposed they are. This is literally what threat actors are doing: trying to do some spear phishing and some attacks against you in order to compromise 1 of your accounts—or some of your accounts on social platforms, centralized exchanges, Gmail, or any other platforms where you could have admin access, and where they could look for private keys, seed phrases, and so on.

I think unfortunate events such as Bybit, or recent OPSEC failures, have had a positive impact on the industry. Everyone is trying to put more resources, money, and time into improving their security.

Regarding the topic of AI, I also think we’re going in the right direction. There are some nice companies around that are trying to write secure code and ship secure code. Anytime you push a commit to your GitHub, they do some constant analysis of all the codebases you have.

5. Common attack vectors in DeFi and how to stay safe

The scary part is, as Pablo said, there are always going to be bugs. But I believe we’re going in the right direction given the tools we have.

Okay. So, guys, I selfishly really wanted to bring you on to honestly help me and DeFi Dad sort of live on the podcast. We’re DeFi users. I’m always worried about moving stuff around. Of course, I’m in control of it, which is unnerving, but I’m wondering if you can walk us through some DeFi best practices and how I can elevate my own personal setup a bit. Either one of you, whoever wants to start.

We're just looking for more advice. We don't want to be exploited or hacked or anything.

I can start with one. First of all, this is the first thing they tell us when we come into crypto, but people keep failing with it. We see at least 5–10 people every day losing more than $100,000 because they're using hot wallets.

A hot wallet is basically a wallet that you have installed on your device. That could be your computer or your phone—MetaMask, Rabby, and so on. Given the fact that it's installed on your device, even if you have your seed phrase on paper, the private key is on your device. The only thing we need is for your computer to be infected, and there are thousands of ways to infect a computer.

The malware—a virus that infects your computer—steals the private key and sends it to an attacker, and your funds are gone. The first recommendation is to use hardware wallets. This is the Ledger Flex, for example; I like it because it has a big screen.

What's the thing we see with many people using hardware wallets? Where do they store the seed phrase? On paper? No. Many people store the seed phrase in password managers, which is a very, very shitty idea. Where do you have to store your seed phrase? Only on paper.

If you want to do it properly, we can give you the link in the show notes. Instead of having your full seed phrase on a single piece of paper, you can use this. This is called a manual Shamir backup. Instead of having your 24 words together, you have a first list with the words from 1 to 16, a second list from 9 to 24, and a third list from 1 to 8 and from 17 to 24.

You keep each one of these in a different place, and by combining any 2 out of the 3, you have your full seed. If someone finds one of them, they cannot brute-force the words. If I lose one, I can recover it with the other 2.

This is very simple. We give it away as swag at conferences, and you can also download it for free from GitHub to store your seed phrases. If you want to be a bit more sophisticated, you can use tamper-evident bags on top of that. You can buy these on Amazon; they're nearly free, around $0.10 each.

You put a copy of your seed phrase inside, close it, and if someone wants to see what's inside, they have to break the seal. You save your seed phrase in, let's say, a safety deposit box at a bank. If you go there and the seal is still closed, it means that nobody has ever been able to see it.

If people used hardware wallets and saved their seeds offline, we think that at least 75% of the cases we see wouldn't exist. Probably 80% of the OPSEC failure incidents we've seen in the past started with a device being compromised. Someone's device got compromised, and there are hundreds of attack vectors that people can use to infect your device.

Some of them are easy to prevent. We teach people that if one day they're on a podcast and their microphone isn't working, they shouldn't update their Zoom application, things like that. But besides that, you have supply-chain attacks and other attack vectors that are way harder to prevent.

Some of the OPSEC mistakes we see a lot are putting your seed in places you shouldn't, such as in a password manager, or using hot wallets. You need to give yourself a test when you're working with crypto. If you're not ready to give your unlocked laptop to someone else, you're probably not doing the right thing with your keys, because when your device is fully compromised, this is really what happens.

This makes sense. Many times, I do an annual audit of where all of my wallets are and how I would retrieve them if I lost my laptop or my phone. I think about it in case something happens to me and my family has to retrieve some digital assets.

I always run through the idea of, if I lost my phone, would that matter? The short answer is no. It would be a pain in my butt, but my assets would be safe. To your point, if my laptop were compromised, would I be okay? It would be a pain, and I would definitely lose quite a bit of sleep and question things, but based on my own self-auditing of what I've done to protect myself, the answer is no. It wouldn't really affect me much more than maybe one wallet holding simple spending money.

I think the TL;DR of all this is that it's actually much simpler than many people understand it to be to stay safe. The issue is that it always requires that extra effort. The really tragic mistake is when people put seed phrases on a phone or laptop, and now they're in iCloud or whatever cloud storage they use, or they put them in a password manager.

6. How to safely buy a hardware wallet

LastPass got compromised, and I think a few other password managers have been compromised. These are total disasters. If you're ever questioning these things, you should basically buy totally new wallets, move and migrate everything, and start all over again. You should not be living with the question of whether the $200 device you own is safe.

In terms of the hardware wallets, which is core to the advice you're giving here, how do you securely buy a hardware wallet nowadays? I've been very fearful of it. I would never buy something off Amazon myself when it comes to hardware wallets, but I've worried about what happens if I'm on a fake website or buying from a third-party vendor that's literally just selling hardware devices that they have the seed phrase for and waiting for someone to load them up with a bunch of money.

You have 3 options. Option 1 would be to buy a hardware wallet directly from the seller. What's the issue there? If the seller—the company you're buying from—gets hacked and that database is published on the dark web, as has already happened a lot, you're on that list. Your name, phone number, email address, and home address are listed as belonging to someone who has a hardware wallet. That means you have crypto, and it's a potential physical danger.

Option 2 is buying it on Amazon. I've never seen a case of a fake hardware wallet, which is good. We have seen fake Ledgers or fake Trezors, but if you're used to using them, you realize within half a second that they're fake because they're just USB drives that you connect to your device. You see a new drive, there's a file on it, and you're supposed to execute it.

I don't believe there's a real issue with getting a fake device. Also, if it were a fake device—for example, with Ledger—when you connect your Ledger to Ledger Live, it checks the signature of the firmware installed inside. You should be fine.

Let's say you want to avoid buying from Amazon because you're buying from a third party and you don't know who they are. What I recommend is buying from the real company—Ledger, Trezor, and so on—but not using your full name and trying not to use your address.

Most of the time, when you buy things, you don't need to use your real name. Do I need my real name to send something to my address? No. I have about 5 different names; I just use another one. If that database gets leaked in the future, I have a random email address and a random name, and nobody will know that it's me. If you have the possibility of sending it to some other address, even better.

7. Assessing Nomatic’s wallet management

Guys, I want to take this even more practical and look at my setup. I'll give you a few highlights. I use something called a Grid Plus. Again, I like the big screen on that thing, and I've been using it for years.

I've got a dedicated computer that I only use when I'm interacting with crypto. Otherwise, it does nothing else. I have my seed phrase stored in a safety deposit box and then another copy stored somewhere else. That's the high-level picture.

Do you think I'm stopping 90% of the attack surface? It's probably impossible to put a percentage on that, but is there anything else I could do to elevate my security even further? I'm curious to hear your take.

If you use a hardware wallet, your key is stored in cold storage, and your seed phrase has never been entered anywhere digitally, you're in a good posture. But this isn't enough. You mentioned that you're using a dedicated device to move funds, which is a very good practice. The first question I have for you is: did you do a full factory reset of the device before deciding, “Okay, I'm going to use it for signing”?

No, definitely not.

This is something we would recommend you do. Why? Because it's the only way to know that you start with a clean device. It's freshly installed, and there's nothing on it. Use as few applications as possible. Once you do the factory reset, you can download Brave or another secure web browser.

Another recommendation is that for any apps you use to interact with or move funds—Uniswap or any of these apps—you should save the URL in your bookmarks. This way, you reduce the likelihood of searching for it on Google, where, of course, the first results are phishing links.

So make sure that you always interact with the proper app, and then you download an extension, a wallet extension. It could be Rabby Wallet, to connect yourself and do transactions on the blockchain. I think this is a very good setup when you do that. Besides using a hardware wallet, you also need to understand what you're signing, and that's something else.

When you do a simple transfer, it's very easy to know that you're sending 1 ETH from one address to another. However, if you are part of a multisig, for example, the transactions are way more complicated, and you need to have a proper method for how to decode a transaction and know what you're signing. So if you use a hardware wallet, have a dedicated signing device, and know what you're signing, you are already in the top 1% of the game.

8. Passkeys vs 2FA, mistakes to avoid

I would say, guys, what about passkeys versus two-factor authentication? We're talking mainly about how we approach on-chain self-custody management, and this is for DeFi users like ourselves. But everyone has a relationship with a centralized exchange at some point. If you need to get back to fiat or bring fiat on-chain, you've got to have some relationship there.

The two-factor authentication that's been beaten into our heads over the years—if you've been in the space for 5 years or more, I think there's always been this understanding that if you have a centralized exchange account, you should probably use some sort of authenticator-type code. But something that's come up more recently, and I feel like it's being woven into the UX of wallets, particularly self-custody wallets, is this idea of passkeys.

So, if you're following what I'm saying—if the audience is following what I'm saying about passkeys versus two-factor authentication—what can you tell us about best practices with these, and what are common mistakes to avoid?

Yeah. First, the reason why we have two-factor authentication is that passwords are easily leaked on the dark web, right? As we said, I can go and search for anyone's email, and I will find, on average, 20 leaked passwords. So if you repeat your password, I can go and try it with something called a checker: “Hey, try this email and this password on all these 150 websites—Google, Binance, Coinbase, Airbnb, Booking, etc.” Right? So that's why we need two-factor authentication: to really make sure that it's you.

The first thing that we started using was Google Authenticator, right? So you put in your password, and then it asks you for a 6-digit code. What is the problem with those digits? If I send you a phishing website, you enter and click on the phishing link. This is something that everyone needs to understand. Everybody will think that I am wrong with this, but believe me, I'm not: all of us are going to click on a phishing link eventually. We are going to go into a phishing website. It doesn't matter how sophisticated we are. I consider myself quite sophisticated, and I will do it eventually. It will happen.

So you go into a phishing website. You put in your password. You click Next. It asks for your 2FA code. You go to Google Authenticator, copy the code, and enter the code. Now the attacker has your password and your 2FA. They're inside your account. That's it: account hacked. So the 2FA codes generated by Google Authenticator, Authy, Microsoft Authenticator, and others are not phishing-resistant, right?

The second problem that you have with Google—specifically with Google—is this: What do we use for email? Gmail. Where do many people store their passwords? Inside Chrome, which synchronizes with your Gmail account. Then you use 2FA with Google Authenticator, which is synchronized with your Google account, and you may have passkeys on Android. Where are those synchronized? With your Google account. So if your Google account gets hacked, they have your emails, your passwords, your 2FA, and your passkeys. Basically, everything. You will have all of your accounts hacked, and you will not get anything back ever, right?

That's where YubiKeys come in. YubiKeys are basically these physical devices. Right here, we have one, another one, and another brand. When you want to do 2FA, you connect one of them. This one is the one that we love, with Louis, called the Nano, because we keep it connected to our device all the time. When you need to do 2FA, you just touch it and log in.

The advantage is that the code lives inside here; it's not in the cloud, so they cannot hack it from the cloud. But the generic code that this generates is not phishing-resistant. So what's the solution for all of this? We did lots of research on 2FA. We love the subject, especially with Louis. The solution to this is passkeys.

Passkeys were designed by Apple, Microsoft, and Google. When you create a passkey—let's say that I create a passkey to log into Coinbase—a pair of keys is created: a public key and a private key. The public key is stored by Coinbase. The private key is stored in the secure enclave of my device, at a special place in the microprocessor that cannot be accessed by nearly anything.

When I try to log into Coinbase, my private key will be decrypted with my Face ID or my fingerprint. I want to log into Coinbase. I touch the fingerprint that unlocks my private key. It signs a message that is sent to Coinbase, and Coinbase says, “Hey, this is Pablo,” right? That message—that passkey that is sent—cannot be phished, right? Because it checks who is requesting this key.

The advantage is that it cannot be stolen from my device—and we're going to talk about that—and it cannot be stolen from Coinbase, because they don't have a password that I can repeat, right? What is the problem with that? We usually have good technology, but we don't know how to use it. We have wallets, and we save seed phrases in password managers, for example. That's a very common mistake.

What happens here? We designed passkeys to be stored in the secure enclave of our devices, and then what great idea did we have? We started synchronizing them with our iCloud account, with our password managers, or with our Google account. So if they hack my iCloud, they have my passkeys, right? That's a problem.

So what's the solution that we came up with? What's the thing to do? You use passkeys, but you store them inside here. Every time you want to log into a website, it will first ask for your password. Then, in the next step, you will touch the YubiKey. It will require a PIN, because we configure them in a special way to make the PIN mandatory. When you touch it, this phishing-resistant code will be sent, and you will be logged in.

In that way, there's no way to hack that other than to steal this physically from me and also have the PIN, right? So if you have both, okay, but if not, no. The last thing to say about this is that the problem with passkeys is that every platform enables them however they want. So the UX is very different on many websites.

For example, something that I do not like about X and Gmail is that, by default, they treat passkeys as both the first and second factor. Right? So if you have my passkey, you can log in. My passkey is safe, but I would prefer to always have the passkey as a second factor, rather than have it be, “You have your passkey, you're logged in,” right? Louis, is there something else that you'd like to add about this?

9. Why everyone should be using physical keys (Yubikey)

Maybe I can add a few things—talk for 2 minutes about the YubiKeys and why they should be used. YubiKeys have a wide range of different functionalities, but by using them, first, as Pablo mentioned, you're going to put yourself in a position where all of your online accounts are authenticated in a phishing-resistant way. So Gmail accounts, Facebook, and so on. That's for your online accounts, let's say.

Then, if you're a developer, for example, you can set it so that all your commits are signed with the YubiKeys. This is a really legitimate way to prove to an organization that you're the right person who is pushing the code. What else can you do? On your vault—when I say vault, I mean your password manager, which is something very sensitive—whether you use something online, such as 1Password, or something locally, like KeePass, you can protect your database with YubiKeys. That's the best thing you can do for your security.

On top of that, you can even encrypt a file or a folder on your device with YubiKeys, and you can make it mandatory to touch the key for the folder to be opened and decrypted. So what happens if your device is fully compromised? The YubiKey is plugged in, but the attacker won't be able to touch the YubiKey for you. YubiKeys are amazing. We have full documentation on everything you can do with them. Please buy YubiKeys. Yes, it's a piece of plastic. Yes, it's €80, but you're going to put yourself in a very good security posture.

This is great, guys. I've been resistant to getting into passkeys. I think part of it is change, and I'm becoming a bit of a dinosaur myself, so I resist change. But I've set up my whole life in this 2FA world, and the idea of going in and changing your life over to something different—it just takes a bit of time, and people are lazy, like myself.

But this idea of passkeys plus YubiKeys is interesting, because I actually felt a little bit less secure about passkeys for all the reasons you mentioned, like how they just sync to everything in your life. I was really questioning why people were saying they were so amazing, but it was this missing element of YubiKeys. This transitions us into something else I wanted to talk about.

10. How DeFi builders can avoid compromising devices

So you started touching on this, Louis, but I want to talk a bit about the protocol side. If there are any DeFi founders, developers, or builders in the space listening, you mentioned that one about dev commits: if you're using YubiKeys, the code is safe. That's really interesting. Maybe give us a little bit more on what you continually see these DeFi protocols missing or getting wrong—what common mistakes are they making?

I should also caveat all this by saying that KPK are the guys who put you on our radar. They went through the OpSec training with you and had rave reviews, so that's what kicked off this conversation. From their perspective, you hardened a lot of their internal processes. We'd love to hear what people are missing and how we raise the bar for DeFi protocols.

Yeah, I can start with some ideas. We're going to start with the ones that are super simple and make a big difference.

First of all, as Louis already said, 9 out of 10—or more, 99 out of 100—incidents that we see start with a compromised device, a compromised laptop. That's basically an infected laptop. How can you get your device infected? You get into a fake job interview. For example, in the third call, they tell you to clone this repo, download this, share your screen, do this or that, and you're infected.

What's the problem that we see with fake interviews? Let's say that I am working at a company, and they conduct a series of fake interviews with me. They infect me, and then they steal $5,000 from my MetaMask. Will I disclose to the startup founder or the security lead that I was infected? Or will I say nothing because I was doing a series of interviews?

They will think, “Hey, this guy is stupid because he was infected. And second, he was doing a series of interviews to join our company.” What do you think? More than half of the people who get infected don't say anything. That's a very big issue, because maybe they also stole access from me, and now they have a first foothold inside the company's infrastructure. From there, they start moving laterally, and they can hack the organization.

It can be a fake job interview. It can be because you're downloading some library or dependency, installing a Chrome extension, or downloading pirated software. There are many ways you can get infected. But what's the thing that will prevent all of this? Having an EDR.

An EDR is the next version, let's say, of an antivirus. An antivirus works by detecting a specific file. They already know that this file is a virus, so if you download a file that has a very similar pattern, it will be detected. But if I know that DeFi Dad has a MacBook Pro, uses Brave, and uses Rabby, I could very easily develop malware that specifically targets his Rabby wallet in that browser and tries to steal his private key. That will not be detected by an antivirus.

So there are EDRs—endpoint detection and response tools—like CrowdStrike, SentinelOne, Kandji, and many others that are more advanced than antivirus software. They analyze behavior. They see, “This program is trying to access the memory of another program, or it's connecting to this strange IP, or it's checking your keystrokes,” and they stop all of that.

If the crypto industry started using EDRs, at least 9 out of 10 incidents would have been stopped and would be stopped today. You might say, “Okay, but EDRs can be very expensive. It's like $150 per year.” It's not expensive. What's the issue? Many people say, “No, but the EDR affects my privacy. The EDR will see what I'm doing on my device,” and so on.

The second thing connected to that is dedicated devices. If you're doing crypto, you need to have a laptop dedicated to doing crypto. You don't play games, watch porn, use random social media, watch movies, or download random apps. You have a laptop for crypto, and that's it. You should have an EDR on it.

That's the first thing that makes a big difference, guys.

11. What is Security Alliance (SEAL)?

Anytime we hear about someone being a victim of an exploit or social engineering, or something related to them losing their digital assets, SEAL comes up in that conversation. I want to talk more specifically about what you guys do at OpSec, but maybe we can touch on SEAL here first.

Yeah. SEAL, the Security Alliance, is a nonprofit founded by Samsung that is focused on securing the crypto and Web3 ecosystem. We are both members of SEAL. It has many initiatives.

The first and most famous initiative is SEAL 911, which is basically a Telegram bot managed by Pascal Pichon. You may have seen him on Twitter. Every time there's an incident, you have an emergency hotline where you can connect, share the incident you're dealing with, and have many white hats try to help you recover your assets or become safe again. This can range from phishing cases and infection cases to DeFi protocols being hacked or an exchange being hacked—any kind of incident connected to the blockchain.

There are more initiatives. For example, we have the SEAL Whitehat Safe Harbor Agreement, which is basically a legal agreement that DeFi protocols can approve. It says, “In the event that my DeFi protocol is hacked, I am allowing white hats to come and try to front-run the attacker, get the funds, and give them back to the protocol.” Otherwise, what used to happen is that if you conducted a white-hat rescue, you could get into legal trouble.

Then we have SEAL Frameworks, which is managed mostly by Matan from the Red Guild. It's basically a guide covering many things that you should do in your organization or for yourself—a step-by-step process to secure your protocol or yourself.

Then we have SEAL ISAC, also called SEAL Intel, where information about threat actors is consolidated. We also have SEAL Certifications, which is the last initiative we're deeply involved in.

The idea is that everyone knows that before depositing money into a DeFi protocol, you should check whether there's a smart-contract audit from a firm you consider serious. But no one checks, “Has this company done an OpSec audit?” The idea behind SEAL Certifications is to have something like a SOC 2 certification, but specifically for crypto. Companies like OpSec can conduct an assessment across 6 different domains, such as DNS and registrar security, workspace security, treasury, incident response, and so on.

You identify the gaps that the company is missing. Then the company can fill those gaps or remediate them themselves or with an auditing company like us. After checking with evidence that all of that has been done, these companies get a certification saying, “We have done our homework related to operational security,” because it's mostly focused on operational security.

This initiative is managed by Isaac Patka from Shield3 and also by Dixon.

12. How Opsek protects crypto for CEXs, HNWI, and DeFi

Okay, I want to get into your company a bit more as well. The short form for operational security is OpSec, but your company is called OpSec, and it's spelled OpSec. Why don't you tell us a little bit about what you guys do? Who are your customers?

I think we've gone through a lot of the problems that you're solving, but give us a little more information for anybody listening. If they want to elevate their personal security, whether they're a DeFi power user or a protocol, give us the pitch about what you guys do at the company.

Okay, perfect. Basically, OpSec is the first company focusing only on operational security audits and training for Web3 organizations and high-net-worth individuals. Why? Because we saw that 99% of the stolen money is not because of smart-contract hacks, but because of all the other kinds of stuff, like social engineering, insider threats, phishing, malware, C2 exploits, SIM swaps, account takeovers, DNS hijacking, et cetera.

What we do at OpSec is use a security framework that we designed based on our experience doing incident response and researching threat actors. We start by doing something called threat modeling. That is to understand what your organization does, your team, your full stack and tools, the most valuable assets that you have, and how you're protecting them. Have you had any security incidents with them? We sit for a long time and design all the ways your organization could be hacked.

Next, we do security-awareness training for the complete organization so they understand all the threats out there in Web3, how to identify them, and how to protect themselves. Then we have additional security training: HR needs to know how to detect a DPRK operative, signers need to know how to properly simulate and verify a transaction, and founders have physical-security training. We also train marketing, finance, and everybody else.

Then we do OSINT research to see what's exposed about the team. Then we do a treasury audit. That means if you have an MPC solution like Fireblocks or Fordefi, or you're using Safe or some custodian, we check your complete setup, as well as who the signers are, how they are doing it, et cetera.

Then we do the infrastructure audit for the company. That is to check the complete attack surface, excluding the smart contracts: your domains, your DNS, Cloudflare, Google Workspace, Git, Slack, Signal, Telegram, mailing tools, EDRs, password managers, et cetera. Then we have one-on-one calls with the full team where we set up and securely configure all of their devices—computers, phones, hardware wallets, and YubiKeys—and accounts: their Apple ID, Gmail account, Google account, Telegram, Signal, password manager, 2FA app, everything that they have, company stuff and personal stuff.

At the end, we give you a report. After this initial audit, there's a problem that we have specifically in crypto: audits happen, and audits are a photograph of this moment in time. But attackers are attacking you continuously, and most companies don't have a security lead or CISO. This is something that, even if maybe it's against my interests, has to change in the industry. Most companies don't have a security lead, and it's the first role that you should hire in a crypto organization.

Given the fact that they don't have a CISO or security lead, we become that security lead as a service. We basically do dark-web monitoring, onboarding, offboarding, and office hours. We have a Slack channel where we send alerts and ask questions. They can call us on a 24/7 line, et cetera.

We work with lots of L1s, L2s, DeFi protocols, centralized exchanges, VCs, and high-net-worth individuals. Now that we're seeing lots of physical threats, mostly in France and on the West Coast in the U.S., we're having lots of high-net-worth-individual clients too. That's what we do to secure the future of this ecosystem, because I really, really believe that the number-one threat for crypto mass adoption is security.

With Bybit, because one guy was compromised and another guy didn't check a signature, $1.5 billion are gone. That doesn't look good for our industry, so that has to change. This is what we're doing from our side to make things safer.

13. DPRK's 2,500 hackers working to steal your crypto

Guys, we're getting close to wrapping here, but I want to talk about one of the biggest villains in crypto. You alluded to this earlier, Pablo, when you basically called Kim Jong-un your CMO, your chief marketing officer.

I'm going to do something that you probably shouldn't do, but I'm going to try to explain a meme to our audio listeners. We're going to flash this up on the screen for people watching the YouTube version or watching this on video, but you got this hilarious meme. It's that scene in The Big Short where the guy says, “Look at him—like, that's my quant,” or something, but instead it says, “Look at him, that's my CMO,” and it's a big picture of Kim Jong-un.

That's funny, but it's kind of real. All of this has just been getting ridiculous, how much money North Korea is taking from crypto, and it's infuriating. I want you to talk briefly about their level of expertise and their savviness. I want to get an idea of the enemy that we're dealing with here on a day-to-day basis and what you're holding at bay for some of these crypto users.

The reality is that the DPRK is deeply involved. They are deeply sophisticated, and they are ready to put a lot of resources into it. When the incentive is that big, when they can hack a DeFi protocol and steal thousands of millions of dollars, they will even be willing to put $1 million of their own money into hacking you because of the incentives.

A lot of recent sophisticated hacks were done by the DPRK, but not only them. Let's say they are our biggest enemy, but there are other people in this shady, shady market.

What I would say about the DPRK is this: first of all, they are super organized, and there are a lot of people—at least from the research that we have—2,500 people doing all of this. They are not the only ones, but they are usually one of the most sophisticated groups, and many attacks have been identified as having been done by them.

Usually, they have 2 kinds of people in the DPRK. You have people who are not so sophisticated, who are doing social engineering and the first infection, let's say. They might say, “Okay, we're going to target DeFi Dad. Let's do some research on this guy. Let's look at some podcasts. Let's do some OSINT, et cetera.”

Then they will try to do some phishing, or they will invite him and say, “Hey, we want to be a sponsor for the podcast,” and they will offer something interesting. But in the end, they will infect you. That's the first stage, when they infect you.

Let's say that you're working in crypto and you just have the podcast. They will say, “Okay, let's get some money from his MetaMask,” and that's it. Or, in your case, it will be, “Hey, this guy has one of the biggest crypto accounts.” So they will take over your Twitter and start talking through the DMs to people, posting scams, et cetera. But that's the first step.

Let's say that they hacked you and you were working at another protocol or a VC. What they will do then is pass that to a second person who is far more advanced. That person may steal your Slack session or your Google Drive session, et cetera, because let's remember something key: you can have YubiKeys, passkeys, or whatever you want in your account, but when your computer is compromised, nearly any account can be taken over because they just steal your session.

Any account that you have opened on your computer, if your computer is compromised, can be stolen. Then they pass that to someone more sophisticated, who will start moving laterally in the organization. Starting from Slack, they will go here and here, and they will do something called privilege escalation until they get where they want to get. Maybe they don't find something yet, but they will invest time.

We have seen many times that North Korea has these IT workers, as they call them. They're basically people who say, “Hey, yeah, I'm from China,” or “I'm from Singapore,” or “I'm just Asian, but I'm working in Canada,” and they try to work inside crypto organizations.

They do it because of 2 things. First of all, many times they have more than 1 salary. They're working in 3 or 4 organizations at the same time, which is a lot, and they're earning that money. The second goal is to try to steal from these organizations, and for that they will invest all the time that they need. If they need to work for 1 year at that organization in order to achieve it, they will do it.

Do you know why these guys are usually not detected? Guess why: because they work a lot. They are very good at coding, and they do not complain. That's why they are not being detected.

Something that we also say is, “Hey guys, working with anons is not an option anymore. I can have anons in my team, and maybe they are anons to the rest of the internet, but I, the founder, think that you should know all your team in person. I don't hire anyone that I have not known in person for quite some time.”

You could say, “No, but we have a policy of cameras on for everyone.” Okay, perfect. Do you know what they are doing today?

It's super scary. They hire—they pay—a guy, a U.S. citizen who lives in Kansas City. Let's say this guy has a laptop farm. They basically have a laptop in his living room connected to the internet, with TeamViewer access granted to North Korea.

This guy is the one who goes into the interviews, does the KYC, connects to the daily meetings, and talks with a script. He doesn't know that he's working for North Korea. He just thinks that he's helping some Chinese guy who works in Canada but wants to work for a company that requires him to live in the U.S.

But they are basically giving their identity, their IP, and everything to North Korea. So you think that you're the U.S. guy who did the background check, the KYCs, and connects to the call, and you see his face—and it's not.

Our rule is: the cheapest thing when you hire someone is to fly them in either to Europe or the US and meet them in person. If they cannot fly to Europe or the US, red flag.

So, basically, to sum up, you have tech workers who try to get jobs at companies to infiltrate them. Then you have people from the DPRK who are all day trying to do phishing and infect devices. And then you have the really sophisticated ones who, after they have the first foothold inside the company, are the ones who do the sophisticated hacking.

14. Close calls with real hackers

Before we close out, I did want to ask the two of you: what's one of the closest calls you've had with some sort of social engineering or malware-type attack?

I can tell you that, for all the examples you gave, one thing we ran into was the common hacking of someone's Telegram account. Someone I knew reached out, suggesting that we should have a meeting. The way they were communicating, it all seemed pretty normal, but living in constant paranoia and knowing that no Telegram account is safe—that anyone's account could be hacked—as soon as they suggested we have a call with very little detail, I just thought, “I'm stubborn. I'm not here to please anyone. I'm here to keep myself safe.”

15. Closing

So I asked some pretty straightforward questions. I didn't get the answers I wanted and thought, “This person's got to be hacked.” So I went to their team and figured it out. It was clearly someone who was trying to start up a conversation, and honestly, I think it was going to lead to one of those types of meetings where you hop on and then it's like, “Oh, I can't hear you. Install this.” But anyways, that was one thing that came up pretty recently. Any close calls that you guys have had recently?

Okay, it's time to be honest now. I think when it comes to downloading files, executables, and things like that, I've never had a close call. But not so long ago—I would say a year ago—I made a mistake that no one should make. I was about to copy and paste an address from the address book on Etherscan.

I don't know if you're familiar with address spoofing, but any time you guys are making a transfer, sending a token on Ethereum, for example, you're automatically going to receive 10 spoofing transactions that are going to be lookalike addresses or fake tokens. Many, many people are falling for this. They're basically copying and pasting the wrong address—the wrong recipient's address, addresses that are sending fake tokens.

That's one of the things that I got close to. Luckily, when I confirmed the address with the recipient, they told me, “No, no, no, there are some digits that are wrong.” But yeah, that's my close call.

Well, I have 2. The first one wasn't a close call; I was hacked. But that was when I was 15 years old. I told you I had this hacking website, and the funny thing at that moment was hacking hackers, basically, right?

I had a guy who I knew through the internet tell me, “Hey, you have this bug in your website. You have this cross-site scripting. The way to fix this is with this code.” So he sent me some code. I didn't even check the code. I uploaded it, and it was a shell, and he hacked me. That guy is one of my best friends today—a really nice guy, one of the founders of Ekoparty, one of the biggest security conferences in LATAM.

Then, regarding crypto, I received one last week, which I'm about to do a thread about, and it's super, super good. Basically, I received an email from Google, coming from Google—not phishing, signed by Google, everything—saying that the recovery email for my Gmail account, for one of my Gmail accounts, had been changed.

I read that and said, “What the hell? How did it happen?” In fact, 30 minutes before, the fingerprint from my Mac had stopped working. So I said, “Oh no, something is going on here. They hacked me.” I moved very fast, but I didn't click on any link. Obviously, I opened Account Security and checked, and everything was fine. Nothing had happened.

How are they doing this? This is super smart. There's something called UI redressing, right? They go to their Gmail account and say, “Hey, we're going to add a new recovery email address,” and they put my email. But instead of just putting my email, they inject code.

Then Google wants to send me an email saying, “Hey, Pablo, they want to add you as a recovery email address for this random account.” But, in fact, because they injected code into that form, I read something else. I read some text that they wanted to put there, and then there's very long empty padding, and at the end is a real notification.

The problem with this is that, as Dad was just saying, the phishing or the attacks are going to come from a trusted source. They're going to come from a Telegram account or from someone you trust, from the email of a coworker. They're going to come from the real newsletter, right? Because the real newsletter from some company was hacked, or in this case, I'm going to receive it from Google.

The rule is basically: do not trust anyone. It's not just, “Hey, let's check or verify the source.” Verify the source, but also verify the content. If I have a call with Louis, and I see Louis and he tells me to insert something, and I think that this is fishy, I will not do it, right?

Today, we cannot trust video anymore. This call that we're having—it could be me, or it could not be me, and you have no way of saying whether it's me or not. You have no way, for real. If someone thinks that they can differentiate a deepfake from a real video, they are totally wrong. It's impossible today.

I think a principle that I definitely haven't talked as much about recently—I never really post about it—is that there's a real advantage to being less reactive. Like that example you gave, I've seen a bunch of these before: recovery-type emails and all sorts of stuff. It's always something that looks like it's coming from a trusted source, and the best thing I could ever do is take a moment and look really closely. Wait a second. Is this real or not?

I've taken the time to be careful in terms of setting up two-factor authentication when it's necessary. I've been as careful as I can to ensure that I am, of course, managing things like seed phrases. I'm someone who is always using cold storage. I do not use hot wallets. We're talking about $100 or so—stupid spending money. So I'm like, if I've done all these things, there's no reason that I should be reactive.

I think the assumption for some people who end up, unfortunately, suffering some sort of attack is that they have to act swiftly now, like acting swiftly is going to save their funds. Any real attack has speed baked into the plan. So if you actually have been attacked, it's more than likely that the damage is already done. It's more than likely that what you're seeing is something to trick you into believing you've been attacked, so that you take a step that ultimately compromises you.

Nomadic sends me a deck, a PowerPoint, and you have to download it, or a PDF. We're at a point where we're extremely careful with this. We simply will not open those. We also use separate devices. By the way, if we're using that separate device, you can get into a device that has absolutely no access to any sort of funds.

Just so much great advice that you guys have shared here today. I appreciate you coming on the podcast. I feel like this is probably a great place for us to start to wrap up. Thank you for your time. We would love to have you both back in the future. Keep up the great work with OPSEC. And I want to give you guys the final word here before we go.

Yeah, I would add 2 things that I always say. Everything is a scam until proven otherwise. Everything. But if you start thinking that way, in Argentina we always think that way because the government has historically been trying to screw us over all the time.

And second, if you're not having some false positives every now and then, it means that you're not paranoid enough, right? A false positive is if my dad sends me a Signal message saying, “Pablo, this is my account.” I should go to the channel where we usually talk and say, “Hey, was it really you?” “Yeah, it was me.” “Okay, perfect.” False positive.

But you should be more paranoid than you are. Only the paranoid survive.

Thanks everyone for tuning in. To stay up to date with future episodes, plus get expert tips, strategies, and exclusive content, subscribe to our free newsletter at the edge.xyz.