Not Your Crypto Podcast

When the textbooks are written, the history of infosec may well be divided into before, and after, October of 2026.

Every day someone cranking through tokens dropped a new critical vulnerability, and the decades long project of eating the world with software gave an incredible deposit of buggy code to target.

Alongside that, we had the biggest hack of all time in Binance (don’t worry, a full episode will be later), shenanigans with weak crypto in certificate authorities, and existential questions over whether the unproven mathematical conjectures that all of cryptography relies on are at imminent risk of being proven false.

If there was ever any doubt, we’ve now blown past the event horizon for AI in infosec, and the only question is what world awaits us on the other side.

Hopefully it’s one where cryptography is, at least in theory, possible. But the jury’s still out. In the worst case it may well and truly be, not your crypto.

Cryptography is a fickle and fragile art. One mistake and you go from a cipher being unbreakable for millions of years, to solved in milliseconds.

For SecondFi, one mistake was indeed all it took when, in June, a buggy android release meant that a random nonce was not mixed in to transaction signing, rendering users private keys exposed on the blockchain with a simple calculation.

It didn't take long for attackers to notice. By the end of June, multiple groups of hackers were in a race to spot new transactions, crack the key, and fleece users for everything in their wallet.

Until a new actor stepped up and grabbed all the tokens in one fell swoop. 

Forget four 9s. In cryptography, you ride or die on a 1 and two 0s. Let’s see what happened.

In the Fall of 2025, Drift Labs was approached at a conference by a team of people calling themselves a quantitative trading firm with a keen interest in drift’s protocol. That’s not a surprise. Perpetual decentralized exchanges, like Drift, were capturing all the attention, investment and growth in crypto.

The relationship looked, by all accounts, to be mutually beneficial - with in person meetings, technical collaborations, and even a million dollar capital infusion from the firm into Drift’s ecosystem.

Six months later, the protocol was drained of 285 million dollars, and the trading firm disappeared overnight.

So how did they do it? In this episode, we look at one of the most high key social engineering campaigns that’s entered the public record. That’s not all though. Once you’re in, you’ve got to get out. Protocol governance, multisig signing security, and defi design all feature alongside, and round this one out as a truly full stack effort.

There’s lots of lessons here. But one is, I guess, that in crypto - like in life - when things seem too good to be true, they probably are.

This one is a loosie, to explain we recorded an episode over a month and a half ago documenting our thoughts and opinion on AI's impact on security engineering but to due life getting in the way I wasn't able to edit and release it.

However due to recent news about AI agents escaping sandboxes and hacking companies we still think the topic deserves thinking about and so we finally present it now for your consideration, we hope you enjoy it and gives you something to think about as well.

Wow. This has been one of the biggest months ever for crypto hacks, so we’ve got a lot to work with.

Let’s start here. On April 18th, a bridge used to transfer KelpDAOs liquidity token between chains got a message.The message said a user wanted to transfer tokens from unichain to ethereum, and that the tokens were already sent on the unichain side. So, the bridge did what it always does, and released tokens back to them on ethereum.

The only problem was, the message wasn’t real.

Bridges have often been the soft underbelly of crypto protocols. So how did it happen? We’ll dive into Kelp, the LayerZero protocol, and how attackers got onto two servers that turned out to be securing the whole thing.

By the way, this episode starts with an explanation of KelpDAO, a “liquid restaking provider”. Don’t worry if you get lost in the seaweeds on that, we did as well. Just keep going. Now on to it.

The jokes just write themselves with this one. In this episode, we bumble our way through an overview of Zero Knowledge Proofs, another entry in cryptography’s long line of mind benders.

ZKPs come from one of the most consequential decades in history for nerds like us. Forget Classic Rock and the emergence of Hip Hop, the cryptographers were the ones really cooking from the mid 70s to the mid 80s, with incredible bangers like Public Key crypto, Diffie-Hellman key exchange, Cryptographic Hashing, and of course the beautiful Merkle Trees that gave us our blockchains.

After that though, ZKPs were kinda shelved. But if there’s one thing crypto and Web3 have been good at, it’s inventing new abstract problems that need a nifty technical solution.

So what are ZKPs, how do they work, and what do they unlock for the builders? We can’t promise you’ll come away from this episode knowing a lot, but hopefully it’s more than Zero. It’s worth a shot.

Building on top of a gnarly bug in some dex math, an attacker constructs a flashswap strategy that leaves a crypto protocol’s liquidity pools drained of over a hundred million dollars.

Wait wait wait, haven’t we seen this before? Don’t worry, this isn’t Cetus Part 4. Instead, we’re talking about the November 2025 hack of Balancer.  

You see, when Balancer was doing its math on your transaction, there was one small step that would always round a number down. 

A small thing maybe, but when you’re a galaxy brain hacker with all the tools of defi at your disposal, you’ll find a way to lever that up into millions of dollars. Let’s find out how.

We continue to be mostly uninterested in the ebbs and flows of the crypto market, but if we’re not yet in a winter, crypto has at least had a significant frost.

That, combined with the looming end of year, inclines one to reflection.

In this episode, we look back at the big product developments this cycle, and cast our exacting judgement - are we any closer to a decentralised internet? And does that still mean anything?

Call us idealists, but that vision is one old acquaintance that shall not be forgot. For anyone who listened this year, thank you, and see you in 2026, when we’ll see if this winter of our discontent is made glorious summer. At the least, we’ve got some hacks queued up to yap about.

Our brains may have finally recovered from researching liquidity pool formulae for the Cetus episodes, so let’s pop another defi hack off the stack and see what we got.

In April of 2022 (ancient history I know), an algorithmically backed stablecoin protocol called Beanstalk was drained to the tune of 181 million dollars. But that's not even close to the biggest number you’ll hear in this episode.

What was the vulnerability? I’ll bet there was a juicy one in that smart contact. Well... not really? You see, the attacker flashloaned themselves 1 billion (!!!) dollars, then staked that in the beanstalk contract and minted a supermajority of the governance token supply.

With that control they could immediately force through emergency proposals, including two of which they had prepped a day earlier to drain the funds.

Bueller? Bueller?? Maybe dont take that day off, cause governance comes at you fast.