This discussion started with the $1.5 billion theft incident of Bybit, mainly exploring the security vulnerabilities of multi-signature wallets (like Safe) and their solutions. DiscussFish pointed out that there are weak points in the infrastructure such as the front end, hardware and browsers that multi-signature wallets rely on. Especially, front-end tampering and blind signing issues cause a mismatch between transaction intentions and actual operations, making them easy to be exploited by hackers.

To solve this, he proposed temporary solutions like domain whitelists and transaction parsing plugins, and advocated for an end-to-end closed-loop risk control system, combining AI and third-party verification to boost security.

Moreover, DiscussFish first shared his experience of being phished for 12,000 ETH last year, highlighting the risks of blind signing of hardware wallets. He called on the industry to adopt a hierarchical and decentralized structure, a zero-trust architecture, and strengthen security culture building.

He also mentioned that facing attacks from nation-state hackers, the industry needs to cope with challenges through technological iteration and enhanced security awareness.

Finally, DiscussFish envisioned the future of the integration of AI and Crypto, believing that AI agents might play a vital role in blockchain networks in the future, driving industry innovation.

DiscussFish predicted that the market might recover from June to October this year, which depends on whether the US national Bitcoin reserve plan is approved. If not, the bull market might end, but currently, the probability of approval is relatively high.

Audio transcription by GPT may contain errors. Please listen to the complete podcast:

YouTube：

Spotify：https://creators.spotify.com/pod/show/7qfkmlvhrl8/episodes/EP-55--1-2--ETH-e2vdl5i

Reflecting on the Vulnerabilities of Multi-Signature Dependencies, Proposing Temporary Solutions like Domain Whitelists and Transaction Parsing Plugins, Advocating for End-to-End Closed-Loop Risk Control

Colin: Could you share your thoughts on the Bybit incident and any notable points you think we should focus on?

DiscusFish: This is actually a very typical situation. The current industry solutions for multi-signature wallets rely on various infrastructures and intermediary services developed by multiple parties. Traditionally, this decentralized and distributed model is believed to be less prone to issues. However, the problem now is that the interactions among applications and hardware developed by these different parties have some bugs and weak points that are easily exploited. Over the past period, we have seen a series of major security incidents, facing off against nation-state-level hackers. This issue has been on my mind since I was attacked last September. Around November, we reached out to several hardware manufacturers and recognized that blind signing is a serious problem. The connection from the front end to desktop plugins to hardware is also easily tampered with, which we realized is the weakest link. We immediately contacted companies like OneKey and Ledger to explore possible solutions. During this process, we found that while some of these companies have solutions, it’s difficult to implement a solution that can withstand attacks effectively. Someone mentioned that it might take six months to iterate properly. Ledger has also created a systematic solution, but due to contractual reasons, they need to be updated passively, which takes a long time. We need to find a way to effectively patch the bugs and vulnerabilities that arise in the entire chain.

Currently, the market lacks an end-to-end solution. Right now, we are using a combination of different companies, but this combination often leads to unexpected issues that hackers can exploit. In this process, we have developed some internal tools and demos. First, we implemented a domain access whitelist to ensure that the websites accessed are legitimate and not tampered with, which can help guard against typical phishing attacks, especially issues like entering incorrect URLs or website redirects. Secondly, we created a transaction parsing plugin that can run on mobile devices, and some hardware wallets communicate with plugins or Safe via QR codes. We verify whether the content transmitted through these QR codes has been tampered with before validating the parsed content on the hardware wallet. We’ve developed some small plugins, but it feels too fragmented; the entire end-to-end process is not fully integrated, and there are too many steps to use. Hence, after this incident, we are continuing to reflect on this.

One core point is that our industry has grown significantly, with trillions of dollars at stake, which inevitably attracts high-level hacker teams. During this process, our team members have mentioned that we need to dig deep both horizontally and vertically. However, the industry is developing rapidly, and with the fast pace of iteration, many potential risks are often overlooked in the rush to conduct business. Therefore, our current thoughts or actions are to leverage our experience in managing various private keys (both hardware and software on-chain) to accumulate a series of risk management capabilities and establish risk control engines. We hope to act as custodians for scenarios like Safe, where we manage one private key within a completely independent hardware and software environment, along with our series of risk control engines to analyze transactions, while simultaneously introducing customized review schemes, automated AI parsing, manual reviews, and implementing black and white lists, along with advanced contract parameter controls.

This is something we have consistently utilized throughout our work in DeFi, but we haven’t fully integrated it into a product yet. By adopting this decentralized approach, ensuring that private keys are not entirely controlled by a single team, but rather held by independent third parties, we can create a controllable end-to-end closed loop. This is how we are currently operating in the DeFi space. Given that EOAs are particularly vulnerable to phishing and transitioning to multi-signature wallets faces similar problems as Bybit, we have a long chain of risks. Our current thought process and solution involve introducing an independent third party, which brings in its own independent technology stack and integrated hardware and software solutions, including risk control engines and possibly AI capabilities, to complete a closed loop from transaction initiation and analysis to risk control audits and signature coordination, aiming to mitigate the long-term infiltration attacks from nation-state hackers.

DiscusFish’s Phishing Experience, Emphasizing the Risks of Blind Signing in Hardware Wallets, and the Need for AI and Third-Party Verification

Colin: You mentioned the phishing issues with EOAs earlier, and we know you might have accidentally lost some assets to phishing last year. Can you recall the specifics of that situation, and did the funds end up being transferred by hackers from North Korea, as rumored?

DiscusFish: My background involves an airdrop from a project. At that time, I wasn’t in good health and was a bit distracted, which led me to click on a problematic link. The issue was that when funds reached the hardware wallet side, we had risk controls in place for domain names and DNS parsing, but that system was bypassed, and our risk control did not trigger. After that, I was a bit distracted and didn’t check carefully. Once it got to the hardware wallet side, because of the blind signing, I pressed the button and immediately felt something was wrong. I quickly checked and found that something was off, and what followed is known to everyone. So after this incident, we sought to address the blind signing issues with hardware wallets. During this process, around last National Day, we kept meeting with OneKey and others, only to discover that the problem isn’t easy to solve. EOAs are particularly susceptible to phishing and targeted attacks. When we turned to using Safe for multi-signature, I realized that this issue somehow became more severe, as nearly every transaction involves blind signing. We had to create many small tools to attempt to resolve these issues. Ultimately, a closed-loop solution is necessary, requiring our hardware wallets to achieve an integration of hardware and software because the hardware UI is the final checkpoint. We also need to introduce independent third parties that can intercept, alert, and process situations when a person’s state isn’t optimal. This is why we have begun iterating on and attempting to productize this area.

Reasons for the Absence of the “Altcoin Season”: Lack of Driving Force and the Hope for National Reserve Decisions to Boost Market Development

Colin: Additionally, last year you were the first to raise the issue of “no altcoins,” which sparked a lot of debate. Some people, including many well-known figures, criticized the idea of having no altcoins, while others accepted it. In December last year, the altcoin market indeed had a very brief surge. At that time, you might have felt the altcoin market was coming back, suggesting that “altcoins” had started. However, it wasn’t long before it seemed that altcoins were, as you initially suggested, nearly nonexistent in this cycle. Of course, we are not making predictions; as someone once said, only God knows about short-term forecasts. Do you have any new insights now, believing that the cycle of altcoins is nearly impossible as it may mainly revolve around Bitcoin’s market cycles? Also, do you think the bull market is over or that we are starting to turn into a bear market phase?

DiscussFish: My current feeling is that apart from some minor emotional peaks in the past two to three years, the entire industry still lacks clear, grounded applications and genuine demand scenarios like those seen in 2020 and 2021. I believe the fundamental issue lies here. Without intrinsic driving forces, there won’t be new, truly valuable application assets accumulating. On the other hand, in this cycle, a large number of players have remained in the traditional U.S. stock market, trading via ETFs and platforms like Robinhood, without truly owning cryptocurrency assets. Therefore, a lot of money hasn’t remained in the market, nor has there been the anticipated spillover effect from Bitcoin and Ethereum into other coins. The combination of these two factors seems to mean that the altcoin market was also a short-term, sentiment-driven phenomenon that lasted only a few weeks, without a widespread explosion. I still largely maintain my previous judgment.

This year, my perspective or expectation for the market is that I believe the best conditions for market development may arise in the second half of this year, around the period from June to October. As the issues regarding national reserves in the U.S. gradually clarify and are resolved, the entire industry or market could see significant inflows of new funds. However, in the current stage or in the short to medium term, we may not solve problems at the application layer. It seems that there isn’t an excessively enthusiastic influx of funds from either inside or outside the market. Thus, I’m primarily focused on the second half of the year.

I am not making a judgment on this matter today. Ultimately, it may depend on whether the U.S. can achieve results regarding the national reserves this year. If there are no results, the market may end. At this moment, we feel that the odds of a breakthrough remain relatively high, but it’s hard to say, so I’m focusing my expectations on the second half of the year.

Summary of Historical Theft Cases: Responding to Nation-State Hackers Requires Layered, Decentralized, Zero-Trust Architecture and the Penetration of Security Culture

Colin: DiscusFish, you’ve been around the crypto space for a long time. I joined in 2017, and the history of hacks in this industry is quite extensive, with many thrilling incidents. This time, the amount stolen from Bybit set a record, but it also has sufficient profit to cover the losses. From your historical memories, what are some of the most memorable theft experiences worth sharing?

DiscusFish: I believe that the offense and defense are always upgrading. In the beginning, the methods of attack were quite primitive. We practitioners must realize that we are dealing with nation-state-level forces, not ordinary hackers. These attackers are organized, some starting training as young as their teens, employing various core attack methods against our companies and challenging us on a human level. Everyone must understand that we are facing such opponents. During this process, humans may become complacent, and human factors can lead to some issues. Ultimately, we must adopt methods and approaches that can withstand these threats.

In the history of the internet, Cobo may be one of the first companies with a Chinese background to adopt the zero-trust model as a security methodology. We adopted this methodology because it has been validated as able to withstand infiltration from nation-state-level actors. As early as 2018 or 2019, we began implementing zero-trust transformations internally. All our internal services, as well as every employee’s computers and phones, must have various security measures in place. After realizing this, we knew we needed to adopt this solution to keep all systems in a state of minimal trust.

At the same time, the most critical asset for us is the private key, which must be managed with a layered, decentralized approach. What does layering mean? We need to disperse wallets significantly. I have previously shared my four wallet theory at a personal level. But at the institutional level, there should at least be a structure of hot, warm, and cold wallets, each layer having its own characteristics, along with black and white lists and a series of processes that include time delays. Often, to achieve efficiency — especially in such a fast-developing industry — we compromise on security, but mandatory time delays can significantly reduce security risk exposure, particularly between cold and warm wallets. Each layer must have different security risks, and an audit system and processes should be established to mitigate systemic risks. A cold wallet should ideally exist in a physical form to ensure absolute security.

Secondly, decentralization is crucial. After years of industry development, the number of participants has increased. In the beginning, we may not have had solutions and had to trust our internal teams to handle things. However, now, especially with the popularity of remote work, internal employees have occasionally been infiltrated by North Korean elements, even obtaining high permissions within organizations. Therefore, we cannot fully trust internal processes. Thus, it is essential to decentralize and involve independent third parties to control and verify some private keys, which is also critical. Nowadays, many custodial companies, security firms, and insurance companies can hold different levels of private keys — some for hot wallets, some for warm wallets, and some for cold wallets. As independent third parties with their own security solutions, they can engage in risk management and control. Through a series of measures, the cost and threshold for attacks can increase exponentially.

Finally, we have done well in terms of dispersing our software and hardware across the globe. From this perspective, we must design our entire internal system and architecture using the lowest trust system and the zero-trust risk design principle, combined with a layered, decentralized approach to managing critical assets, along with a suite of software and hardware security modules, strict internal access control processes, and a secure lifecycle management. Additionally, having some emergency response solutions during and after incidents can help us survive in high-risk and uncertain attack scenarios.

Increased Security Investments in Compliant Exchanges, Offshore Exchanges Lack Adequate Security Measures Due to Growth Pressures

Colin: Personally, I want to understand why compliant exchanges like Coinbase seem to have experienced relatively few hacks, unlike offshore exchanges, which have almost universally been hacked multiple times. What do you think is the reason for this? Theoretically, could offshore exchanges use the same architecture as compliant exchanges? Since offshore exchanges handle larger amounts of funds, or operate differently, I wonder if any of the security experts can answer this question. Also, DiscusFish, do you think that facing attacks from North Korean hackers will make it increasingly difficult for entrepreneurs in this industry, raising their security costs or the investments required to a level that significantly hinders industry development? Can the industry withstand these attacks from North Korean hackers?

DiscusFish: I’ll add my perspective. My intuition is that compliant exchanges prioritize security over efficiency in their operations. For instance, they tend to be stricter in certain aspects, so they invest significantly in security.

In theory, offshore exchanges have substantial funds available for security investments. Whether it’s early Binance or others, including the recent situation, hacks seem to be quite frequent.

This might be because offshore exchanges face immense growth pressure, requiring them to iterate rapidly and deal with frequent user complaints. In contrast, compliant exchanges don’t have such high expectations from ordinary users regarding withdrawal speeds; some even have T+1 or T+2 withdrawal processes, and I’ve even seen T+7 scenarios that users can accept, as their clientele differs. The clientele of compliant exchanges mainly consists of institutions. Both types of exchanges likely have a long history and have probably developed considerable experience in handling security issues, essentially viewing security challenges as a rite of passage for enterprises.

I believe that as long as there is enough profit margin within this industry, investing in some SaaS products should be able to address the pain points and needs of the industry. However, currently, many do not possess strong security awareness or willingness to pay. We also see many excellent security products, but they often earn only hard-earned money, struggling to balance costs, relying on other avenues for support.

This is indeed a challenge; however, I feel that as offense and defense evolve, people are beginning to realize the importance of security, leading to increased investments in this area. This also provides certain development space and funding for companies focused on security SaaS. From a security and architectural perspective, there are effective and verifiable solutions available. However, in the case of Safe, there are about four to five parties involved in a transaction, and coordinating among them can be slow. The slow iteration of hardware also gives hackers a time window.

Once the blockchain industry fully exposes issues and discusses them, it should be able to resolve these problems through one or two cycles of iteration. Moreover, Web2 faces similar challenges. Although the resource investment toward security within Web2 is not as extensive as in the blockchain sector, we’ve seen advancements like Passkey, which has been promoted for many years and only recently started seeing widespread adoption, especially in sensitive financial areas. Therefore, these foundational technologies can be reused and developed, including the rapid security iterations seen in devices like Apple products. Ultimately, solutions exist; they may just require time and investment. In this process, some developers lacking risk awareness and acting too aggressively may bear costs, but the issues are solvable.

Security Advice for Entrepreneurs: Implement Zero-Trust Models, Conduct Multi-Audit Cross-Verification, and Regularly Drill Security Measures

Colin: For entrepreneurs, you’ve likely observed the Infini project recently. Despite having a great reputation and a solid founding team, it was hacked for $50 million. While the community supports them, what advice do you have for startup projects to improve their security awareness based on your extensive experience?

DiscusFish: I believe it’s crucial to effectively implement a zero-trust model during the entrepreneurial process. In the current environment, this methodology and philosophy are the only means to protect everyone. Also, do not rely on single points of failure or unilateral contract audits; it’s essential to have at least two or three companies conduct audits for cross-verification, as this can expose potential issues. Additionally, do not rush to increase funding amounts; early on, you can gradually increase funds through internal and public testing while isolating the funds to better manage risks.

In fact, there are many reasonably priced security solutions in the industry, such as secure monitoring and risk control systems, which everyone should utilize to enhance survival probabilities.

During the entrepreneurial process, the business model must consider the user end. Especially for entrepreneurs without a technical background, significant attention should be paid to security and internal zero-trust architecture — at least 20% to 30% of focus should be allocated to this. If the company does not emphasize internal security culture and systems, conducting periodic internal phishing tests and offense-defense drills, people will inevitably become lax. It’s crucial to remember that hackers may always be watching.

Colin: Indeed, in the process of growth, it seems there’s hardly a company, whether at the personal or organizational level, that hasn’t encountered theft. Fortunately, as long as one is not completely defeated, both individuals and the industry can make progress.

Why No Participation in This Round of Memecoin? Physical Discomfort and Focus on AI

@Web3_888: Also, DiscusFish, as a well-known figure in the crypto industry, I remember Cobo Wallet might have led the way for everyone to mine. I was involved in that early on. In the current market, I’ve noticed that DiscusFish has been relatively quiet regarding industry-related matters. The link you mentioned today only briefly touches on PVP. I’m curious, given that the industry seems to have reached a bottleneck after the last wave of market activity, where do you see the next opportunity?

Colin: Additionally, I know you enjoy experimenting with various new things, but it seems you haven’t participated much in this wave of meme coins. What’s the reason for that?

DiscusFish: I genuinely can’t keep up with the younger generation. Another factor is that I’ve recently focused my attention on AI, which seems poised to revolutionize the integration with cryptocurrency, possibly bringing new growth. Over a year ago, I proposed at an offline event that the ultimate users of cryptocurrency might be AI agents or robots rather than humans, so I’ve invested considerable effort into learning about AI. I can’t keep up with PVP; whenever I get involved, it seems I’m just giving away money without much positive feedback, so I’m primarily focused on AI.

Looking Ahead to the Integration of AI and Crypto, Believing AI Agents May Play an Important Role in Blockchain Networks

Colin: What do you think about AI right now? There was a trend before regarding AI agents, but it declined sharply, and I have several friends who went bankrupt trading AI. Do you think anything attractive has emerged from AI agents so far? What promising application areas do you see for AI and cryptocurrency in the future?

DiscusFish: I think the core issue lies in the fact that the capabilities of AI itself are not yet at that stage; we are still in the concept validation phase. However, we can see that the development speed of AI is incredibly fast, with underlying computational models continuously iterating. We look forward to a future state of AI where it possesses General AGI (Artificial General Intelligence).

Regarding cryptocurrency, there are two points. On one hand, it is very friendly to completely digital assets because data is open and transparent. Therefore, AI could change interaction methods. For complex smart contracts and inhuman security operations, we should be able to rely on some reliable, intelligent AI agents to assist us in decision-making. I often joke that while I operate in decentralized finance, I must remotely arrange a few AI agents to keep an eye on things for me. In the future, it might really take that form, with AI engineers and possibly one or two AI agents monitoring the screen. Looking ahead, AI may indeed connect to blockchain networks.

Let’s envision a scenario where AI agents need to interact with each other, including value exchange and data exchange, which may also involve contractual agreements, or even loosely structured organizations like companies or DAOs. They might use something like a smart contract platform for value exchanges. I’m thinking that in three to five years, we might see the emergence of something akin to a Web social network or a value social network on the blockchain, ultimately meant for these AI agents to use. Once this emerges, the value and impact it brings could be immense. We often talk about the network effects of Web3; the asset scale or value it brings may far exceed what we currently see in traditional internet companies, so this could be something greater than the current trillion-dollar scale. I have been pondering what this could be and what we can do within it. I remain optimistic; although the industry hasn’t seen good application directions in the past two to three years, I believe they will emerge, and there are obstacles we might be able to overcome. So I look forward to that day.

Solution for Safe Wallet Blind Signing Issue: Enterprise Signing Tool + AI Risk Control + Black and White List Management

@TheCheerSong: I am a trader who engages in on-chain automated trading. After this incident, while our business cannot stop, we are also upgrading our security measures. I feel the most troublesome part is the blind signing aspect of the Safe Wallet. What we can do now is utilize some open-source permission control modules and apply them to the Safe Wallet. In this usage process, we have automated most of the transaction requests, so the Safe Wallet is primarily used for manual token transfer operations. I’d like to ask the experts if there are any tools available to verify our signature content for relatively simpler requests?

DiscusFish: Actually, someone just mentioned that we are about to release an internal tool product next week, which is our enterprise signing tool for Safe. Essentially, it involves obtaining a Safe private key, and through machines, along with some black and white lists and risk control templates, you can customize common risk control measures, such as limiting token amounts, transaction speeds, and setting black and white lists. Coupled with the capabilities of AI agents and considering scenarios involving significant losses, we can clarify this entire process while managing risks effectively.

This solution, in conjunction with Cobo’s previous contract based on access control lists on the Argus blockchain and parameter-level controls, makes me feel that currently, only by doing this can I safely engage in large-scale transactions on-chain. This is the security practice we are implementing.

Follow us
Twitter: https://twitter.com/WuBlockchain
Telegram: https://t.me/wublockchainenglish