1.4 million dollars worth of eth. Hm, what’s that? …no. That can’t be right. With a “B”?

On February 21st, ByBit’s CEO clicked the most expensive click in history and authorized a transaction to send 1.4 billion worth of eth directly to North Korean hackers. But he (and the other multisig wallet holders) thought it was a routine transaction from their cold wallet to their warm wallet.

How did it happen? You have a few options to learn about it. If you’d like a concise, polished explanation with visual aides - you can watch the videos linked below. 

If you’d rather listen to us, questionable choice, but we’re glad to have you. With an oopsie of this scale we’d better learn something. Hopefully there’s more to the answer than just “git gud” at crypto. Let’s see what we can find.

Technical Sources:

Largest crypto hack of all time

Checkpoint Research

On the blockchain, you are your keys… right?

In this episode, the answer is - sort of. We take a look at zkLogin, a protocol that allows you to send transactions to a blockchain from an OAuth account. No, it’s not custodial. Its magic - or as near to it as cryptography gets (which is pretty near!).

A mix of clever protocol design and arcane cryptography, right at the intersection of Web2 and Web3. This tech was made for us to yap about.

So far we’ve covered events in 2024, 2023, and 2022. It’s time for 2021 to take the stand. 

In this episode we cover an attack on Poly Network, an open source and decentralized cross chain network that enabled communication between different blockchains. 

To make the network work (lol), you need a lot of liquidity in wallets on the chains you’re integrating. Well what if you could, just, you know, add yourself as the owner of those wallets?

Of course it wasn’t that simple. But the great thing about security is that, it also kind of was? This is another one where you can crack out your CS textbook, because hash collisions are taking center stage. All it takes is one - and 610 million can be out the door.

Show notes:

https://research.kudelskisecurity.com/2021/08/12/the-poly-network-hack-explained/ 

https://slowmist.medium.com/the-analysis-and-q-a-of-poly-network-being-hacked-8112a35beb39

https://blog.merklescience.com/hacktrack/hack-track-an-analysis-of-poly-network-hack-and-latest-related-events

https://blog.kraken.com/product/security/abusing-smart-contracts-to-steal-600-million-how-the-poly-network-hack-actually-happened

We are not a current events podcast. We are not a current events podcast. We are not a…. but a current event did happen in November of 2024, and it turns out that Polymarket, a blockchain-based prediction market, got pretty big during it.

“Pretty big”. Well, Polymarket attracted over 3 billion dollars betting on the outcome of the 2024 US presidential election. 

So, who won? Oh gosh oh gosh we’re not talking about the election. But “who won” is pretty important for settling those 3 billion dollars of bets. 

Join us as we dive into Polymarket, and UMA - the “decentralized truth machine” that resolves the outcome. Sometimes on the blockchain, “truth” is what the tokenholders say it is. And the market cap of UMA’s coin - well it’s certainly less than three billion. 

How much does the truth cost?

Show notes:

Polymarket Election Event

There are many chains, so many L1’s, why are they here, wasn’t Ethereum supposed to be the one to rule them all?

Obviously not, so in this episode we’re going to investigate the need for so many different chains. Building on the previous episode we identify where new blockchains have spun up to fill a specific need, meet a requirement or anticipate a future use case. 

Specifically, we will take an indepth look at those that are trying to meet regulatory requirements with the hope of becoming more attractive to established businesses.

A listicle yes, but a useful one!

Regulation is part of life, in any advanced economy if you are going to sell goods or services be they digital or physical regardless of the industrial sector the responsible entity will more than likely be subject to regulation of some sort.

So this episode is about the other regulatory classes, like privacy, financial, compliance and even standards. We’re going to delve into the purpose they serve in web2 and ask whether it would need to change in order to accommodate web3 or vice versa. We’ll also lightly probe if there is any value in having any of these classes of regulation for web3 in the first instance.

In October of 2022 an attacker made off with 600M (!!!) by finding a bug in a bridge contract connecting two of Binance’s blockchains. How did it happen?

It’s time to blow the dust off your third year Data Structures textbook. Listen to us stumble our way through bridge contracts, relayers, Merkel trees, hashing, and cryptographic proofs. 

This is Web3, and it's fantastic.

If any of our former professors are out there, you might want to skip this one. You taught us well but it's been a few years.

Links:

We’re used to security happening behind closed doors. But our inner nerd loves transparency - and heedless of Gandalf’s warning we want to study the arts of the enemy.

When attacks happen in real time on a public ledger, and response is community driven in discord and on twitter, you get a decentralized security scene. Call it the bazaar to Web2’s cathedral.

More eyes, more voices, more noise. Is that better?

Whether you agree or not, it's certainly better pod material. And isn’t that what really counts?

MEV Boost, NFT fails etc, all these hacks were enabled by underlying technical vulnerabilities some of which can appear to the (un)trained eye very similar to classic vulnerabilities we see in web2. Are they or are we being flippant, only one way to find out. 

So this is the one where we really dig into the technical details of the most well known vulnerabilities in web2 and web3 and decide whether there are actually any similarities at all.

Several years after Web3 broke out, there’s a noticeable dearth of patagonia vests still hanging around the crypto scene. Where are the Web3 unicorns? Does blockchain have a space in the enterprise? Do consumers care?

Underneath this question is a philosophical discussion on disintermediation, decentralization, and what it means for a technology to be successful on the internet.Start exercising those brain wrinkles with a different parallel - is open source a success?

Building a commercial enterprise on providing open source software is famously hard. Despite that the internet runs on software that thousands of nerds maintain, for little or no commercial purpose. Maybe this whole time the internet was all about the love ❤️