Not Your Crypto Podcast

Wow. This has been one of the biggest months ever for crypto hacks, so we’ve got a lot to work with. Let’s start here. On April 18th, a bridge used to transfer KelpDAOs liquidity token between chains got a message. The message said a user wanted to transfer tokens from unichain to ethereum, and that the tokens were already sent on the unichain side. So, the bridge did what it always does, and rele...

The jokes just write themselves with this one. In this episode, we bumble our way through an overview of Zero Knowledge Proofs, another entry in cryptography’s long line of mind benders. ZKPs come from one of the most consequential decades in history for nerds like us. Forget Classic Rock and the emergence of Hip Hop, the cryptographers were the ones really cooking from the mid 70s to the mid 80s,...

Building on top of a gnarly bug in some dex math, an attacker constructs a flashswap strategy that leaves a crypto protocol’s liquidity pools drained of over a hundred million dollars. Wait wait wait, haven’t we seen this before? Don’t worry, this isn’t Cetus Part 4. Instead, we’re talking about the November 2025 hack of Balancer.   You see, when Balancer was doing its math on your transaction, th...

We continue to be mostly uninterested in the ebbs and flows of the crypto market, but if we’re not yet in a winter, crypto has at least had a significant frost. That, combined with the looming end of year, inclines one to reflection. In this episode, we look back at the big product developments this cycle, and cast our exacting judgement - are we any closer to a decentralised internet? And does th...

Our brains may have finally recovered from researching liquidity pool formulae for the Cetus episodes, so let’s pop another defi hack off the stack and see what we got. In April of 2022 (ancient history I know), an algorithmically backed stablecoin protocol called Beanstalk was drained to the tune of 181 million dollars. But that's not even close to the biggest number you’ll hear in this episo...

When stuff gets hacked, there’s a lot of focus, rightfully, on the exploit. How did it happen? Which smart contract had a vulnerability? How’s it get fixed? The exploit, though, is just a small part of the story. By and large, attackers don’t want to degen with a massive bag of tokens. They want something more useful - no offense to the crypto heads. That means they need to cash out. But you can’t...

Betteridge’s law aside, DAOs have been around for nearly as long as you could code on the blockchain (which, I guess, hasn’t been that long). In fact one just called “The DAO”, and its associated hack, was one of the defining events of early crypto. DAOs are decentralized organizations that you participate in by voting with a governance token that you own and stake. But, this is crypto, and everyt...

51% attacks have always been an animating theme in blockchain security. Since the integrity guarantees come from distribution, how do they break when one player gets the majority of the hashrate? Well, that was the question facing the Monero community in August after an actor entered the game, rained hashpower from the sky, and (very) publicly pulled off a six block reorg of the chain. But immedia...

So, just over 200 million dollars is gone from Cetus’ liquidity pools. Damn. Time to call the insurance broker and make a claim. Just play it cool on the phone. Right? Wrong , of course. In crypto, the exploit is just the first shot fired. The ambush that takes you off guard. Keep your head up, and you’ll find that the attacker still has a long road ahead of them to navigate their massive bag thro...

If we can be sentimental for a second, some things in life remind you of simpler times. Maybe it’s a well loved book, or a familiar place. For us, nothing dials up the nostalgia like the return of a vintage vulnerability. In this episode, we continue our discussion of the Cetus hack. With the defi side covered in Part I, we now turn to the central mystery - how did the attacker manage to add a mas...

Wow, it’s been a while, we hope you can find it in your heart to forgive us. Turns out, this episode took us a lot of research. So, what happened? At the end of May, Cetus, a dex on the Sui blockchain, faced a crisis. The liquidity pools that provide the exchange with capital were being drained of all their tokens, and fast.  Cetus hit the pause button after 15 minutes, but already 200-some millio...

In January, Sony launched a blockchain. Their goal, according to them, was to “Realize the Open Internet that Transcends Boundaries. "Well, that _was_ their goal, until the Open Internet actually showed up. And there was one boundary Sony didn’t want transcended. On launch day, memes started flying, including tokens named after Sony-owned IPs. As one would expect from a media giant, Sony took acti...

A month ago, the Cronos blockchain voted to increase the supply of tokens in their ecosystem from 27B to 70B (!!!). This issuance was positioned as a reversal of the largest token burning program ever run in crypto, where 70% of the CRO token supply was burned in 2021. The tokens, Cronos Labs said, were needed to support issuing an ETF, and to support their crypto x AI roadmap. We reasonably have...

Fortunately (for niche podcasters such as ourselves), more detail has been published about just how the ByBit hack happened. The story now turns to Safe{Wallet} - ByBit’s multisig wallet provider. After getting access to a developer’s laptop, Lazarus pivots through the cloud to put a transaction in front of ByBit. The cloud you say?!? AWS? S3? API tokens? Javascript?? We know these words! You’d be...

1.4 million dollars worth of eth. Hm, what’s that? …no. That can’t be right. With a “B”? On February 21st, ByBit’s CEO clicked the most expensive click in history and authorized a transaction to send 1.4 billion worth of eth directly to North Korean hackers. But he (and the other multisig wallet holders) thought it was a routine transaction from their cold wallet to their warm wallet. How did it h...

On the blockchain, you are your keys… right? In this episode, the answer is - sort of. We take a look at zkLogin, a protocol that allows you to send transactions to a blockchain from an OAuth account. No, it’s not custodial. Its magic - or as near to it as cryptography gets (which is pretty near!). A mix of clever protocol design and arcane cryptography, right at the intersection of Web2 and Web3....

So far we’ve covered events in 2024, 2023, and 2022. It’s time for 2021 to take the stand.  In this episode we cover an attack on Poly Network, an open source and decentralized cross chain network that enabled communication between different blockchains.  To make the network work (lol), you need a lot of liquidity in wallets on the chains you’re integrating. Well what if you could, just, you know,...

We are not a current events podcast. We are not a current events podcast. We are not a…. but a current event did happen in November of 2024, and it turns out that Polymarket, a blockchain-based prediction market, got pretty big during it. “Pretty big”. Well, Polymarket attracted over 3 billion dollars betting on the outcome of the 2024 US presidential election.  So, who won? Oh gosh oh gosh we’re...

There are many chains, so many L1’s, why are they here, wasn’t Ethereum supposed to be the one to rule them all? Obviously not, so in this episode we’re going to investigate the need for so many different chains. Building on the previous episode we identify where new blockchains have spun up to fill a specific need, meet a requirement or anticipate a future use case.  Specifically, we will take an...

Regulation is part of life, in any advanced economy if you are going to sell goods or services be they digital or physical regardless of the industrial sector the responsible entity will more than likely be subject to regulation of some sort. So this episode is about the other regulatory classes, like privacy , financial , compliance and even standards . We’re going to delve into the purpose they...

In October of 2022 an attacker made off with 600M (!!!) by finding a bug in a bridge contract connecting two of Binance’s blockchains. How did it happen? It’s time to blow the dust off your third year Data Structures textbook. Listen to us stumble our way through bridge contracts, relayers, Merkel trees, hashing, and cryptographic proofs.  This is Web3, and it's fantastic. If any of our former...

We’re used to security happening behind closed doors. But our inner nerd loves transparency - and heedless of Gandalf’s warning we want to study the arts of the enemy. When attacks happen in real time on a public ledger, and response is community driven in discord and on twitter, you get a decentralized security scene. Call it the bazaar to Web2’s cathedral. More eyes, more voices, more noise. Is...

MEV Boost, NFT fails etc, all these hacks were enabled by underlying technical vulnerabilities some of which can appear to the (un)trained eye very similar to classic vulnerabilities we see in web2. Are they or are we being flippant, only one way to find out.  So this is the one where we really dig into the technical details of the most well known vulnerabilities in web2 and web3 and decide whethe...

Several years after Web3 broke out, there’s a noticeable dearth of patagonia vests still hanging around the crypto scene. Where are the Web3 unicorns? Does blockchain have a space in the enterprise? Do consumers care? Underneath this question is a philosophical discussion on disintermediation, decentralization, and what it means for a technology to be successful on the internet. Start exercising t...

Normally when data goes out the door, it's gone - you can’t put the cat back in the bag, the horse back in the stable, or any other animal-metaphor back in its proper place. But crypto isn’t normal. When an NFT goes out the door, what if you could hack it back? In late 2023,  NFTTrader had a re-entrancy vulnerability that led to the loss of a lot of valuable assets. But that wasn’t the end of...