Okay. Crypto has never been as secure as it is today. And we have a clear path if we were to adopt some of these toolings and some of these mindset shifts to become even more secure. I say this to my colleagues, you know, security is a really difficult fight right now for a variety of reasons, the rise of new AI technologies like Anthropic's Mythos, which is very famous at the moment, or the rise of these quantum cryptography changes, but the reality is crypto has never been more secure than it is today.
So, Immunefi is the world's largest on-chain security platform. We're responsible for protecting the vast majority of major on-chain applications, like blockchains, DeFi applications, and key infrastructure in the on-chain economy. We protect them from threats and black hat hacking groups using the global security community, creating bug bounties, audit competitions, and PR reviews to find vulnerabilities before the bad guys do. We end up protecting hundreds of billions of dollars every year from theft by North Korea and other malicious groups. So that's a little bit about what we do.
Okay. So most security founders come from a technical role. What was your background?
Well, my background was not so technical, oddly enough. I was an early builder in crypto and blockchain, so there's some technicality, but my major interest is in history and philosophy, understanding how things came to be. That brought me to security because I've seen so many cyber attacks - SIM swapping, insider attacks, server break-ins, North Korean hacking techniques, scams, phishing, and more. I realized in 2019-2020 that DeFi would work but would also lead to an explosion of hacks. If we didn't solve that quickly, all our work in crypto would be delegitimized. I concluded that only something like Immunefi could harden and protect global on-chain infrastructure fast enough. So not a technical background per se, but I was given all the messy problems.
Very very specialized though. Sounds project-based. I did some research and found that your data shows 94% of bug bounty programs active 5 years or longer have found at least one critical vulnerability. What is a critical vulnerability and what does that actually say?
There's two ways to look at it. Programs define critical vulnerabilities how they want, but at Immunefi we have a standardized system. A critical vulnerability is one that could lead to theft of significant funds - hundreds of thousands, millions, tens of millions - or compromise the underlying infrastructure to make it unusable, like destroying consensus or manipulating block construction. So when you look at that 94% data, it means 9 in 10 protocols will discover a critical vulnerability so severe it could destroy their business over the course of running a bug bounty on Immunefi. It's fatal, catastrophic - like the movie Armageddon, the meteor is coming.
Yes, I saw it many times. So the asteroid is the critical vulnerability, not the space shuttle.
No, we are the space shuttle. You send us out to do the dirty work to protect the planet - the global white hat community - except you have a thousand spaceships throwing them at asteroids and praying they veer off course. And we do that very successfully over and over again.
Okay, so it's not as dramatic as Armageddon, but is it every 5 years you have a critical vulnerability?
No, much more frequent. That data was over 5 years. Almost every program surfaces that threat. But in any given year, the odds of a critical vulnerability for any one customer is around 40 to 45%. So you flip a coin - in a given year, you'll know if you have the Armageddon asteroid coming.
Okay, so what's the point of having a blockchain with so many critical vulnerabilities?
That's a great point. What's the point of having an internet with so many critical vulnerabilities? The internet is incredibly insecure - it was not designed to be secure. It's an ugly patchwork where no layer optimized for security. That's why we have a huge cybersecurity industry. Blockchains are mission-critical systems for money, and we have low tolerance for money vanishing, but it's unavoidable until we crack the future of software development. We may solve that over the next few years, but until then we tolerate some insecurity just like we do with banks, government systems, and passports.
So you can't stop bugs, but you can get faster at finding them?
Yes, historically you can't stop bugs, and the best way to stay safe is to get faster at finding them. But we're moving into a future where that might change - what if you can find bugs so fast and deeply that you prevent them from ever getting into production? That's the cutting edge, the holy grail. Most audits in crypto are done by 2-5 people. But what if we could put a thousand eyes on it? That's what Immunefi enables. We've handled thousands of critical vulnerability disclosures - almost everything like that in the industry flows through us.
For blockchain like Bitcoin which has been running since 2009, does this logic apply? Does it have potential for a critical vulnerability?
Of course. There have been double-spend and mint vulnerabilities in Bitcoin's history, some dormant for years. For example, a vulnerability introduced in 2017-2018 was found dormant until the early 2020s. That's scary. The Zcash vulnerability was more tame - it allowed creating fake money only in a shielded pool. But with Bitcoin, a double-spend scenario could compromise all Bitcoin. The entire value of the chain is at risk, which is why these are so dangerous.
Going back to the improvement you're seeing - that soon critical vulnerabilities will be reduced. What's the link to Bitcoin and other projects?
The link is the same for all. We're on the frontier of protecting the on-chain economy. Almost every major project works with Immunefi because they understand that vulnerabilities are normal and expected. Crowdsourced security is the most effective way to surface vulnerabilities. Practitioners assume whatever code they write is insecure by default and need to find economically feasible vulnerabilities before the bad guys do. That's our primary job.
Okay, so a bug goes back to an insect - you're saying we can engineer security that removes the risk of a bug?
You can beat that. You have led dozens of war rooms - can you walk me through what a war room is and what one actually looks like?
Okay? There are some white hats who will almost invariably do what is prosocial. And we work with all of them at Immunefi. Great guys. Lots of phenomenal people there. And then there are plenty of real cyber criminals, real black hats, that are just going to rob you and never try and support you. And we've dealt with a lot of those guys too. They are our enemies that we're in a forever war with, really. But the gray hats make up the voluminous middle. Now, negotiating with these guys is complicated. They tend to be extreme personalities. Most security people tend to have extreme personalities, myself included. Now, these guys at the same time, number one, they're thinking about the money, because that's obvious and important. And the amounts of money that you could make in this type of activity are life-changing. Millions, tens of millions, hundreds of millions of dollars. The biggest heists in the history of mankind, outside of central bankers themselves. So it's a real life-changing opportunity. At the same time, they understand the risks. A lot of these guys have a background or familiarity with the underworld, and so they know that this is not a safe place to be. There's lots of ways they can get caught, and if they don't do this properly, there's going to be someone following them for the rest of their lives. They're going to put a target on their back forever, both from law enforcement and from other criminal groups who could also be tracking to steal the money from them.
Who is taking who from where?
Exactly. So it's not safe, right? You're a pirate, you steal from a Spanish galleon, but you know, the other pirates may well come after you. This is not a safe line of work. Now that they know you got a hundred million in your pocket, they're open to other solutions. And a lot of them have a lot of pride. They want to be respected. Adulation, admiration, and respect are worth a fortune to most people if it's constructed in the right form. So there's some combination of these that we have to combine and recombine together in order to get to a deal that convinces gray hats to come and work with us instead of the black hats and to disclose and become white hats in some form rather than harm society. And if we can get that right where all the bounties are big enough, like we're going to give you not the 100 million, but maybe we'll give you a million. Maybe we'll give you 5 million. Maybe we'll give you 10 million.
It's still a lot. It's still life-changing money.
You can still retire. Like you make 10 million dollars in cash as some of our white hats have done. Like you know, go off and go retire and relax for the rest of your life if you want. That's amazing. Congratulations. But some combination of money, material money, but also respect will help you build a career. Will make you famous. Will connect you to new financial opportunities. You can become a security expert. We've made lots of gray hackers famous in crypto. All the best white hats, almost all of them I should say, have been made famous by Immunifi. Okay? I will give you respect. And the negotiations, a lot of the time that's what they need. They understand they did something very clever. But are they appreciated? Right? And do they appreciate that there's a deal that can be struck here? Do they feel safe enough to deal that you can get this over the line? So these are the kinds of things you have to be thinking about in navigating this. It's not a heavy-handed conversation. Some teams try that, but they just end up alienating both white hats and black hats for that matter. You need to be diplomatic because these guys have power. They have real power over you. And they decide your fate and your destiny. And you should be considerate in how you handle them.
Yeah, I can imagine. Um so, are you like the hostage negotiator here? As such? Sometimes.
Sometimes. I was actually requested to mediate exactly such a situation today between a non-Immunifi protocol and a hacker in dispute over one of these cases. So, are we the hostage negotiators? Yeah, you could say think of it that way. You could also think of us as the crisis mediators, right? Or the hostage mediators, because that's more of the job. Is there a way we can get this deal to the right location that we can make it kind of win-win for both people, which is how we think about everything that we do? We perform that function. But even more than that, Andrew, we're the clearing house for vulnerabilities. So it's not just that we do the mediation of the hostage negotiation, which we do, but it's that we facilitate, we set up the market and the environment for these transactions and these discussions to happen at all. Without us, they would not happen. And it would not be possible to resolve any of these cases and that would lead to a lot more hacks and a lot more damage to society.
Yeah. Um so, how many companies are there like Immunifi?
Oh, there have been a variety of bug bounty platforms over the world. Most large countries will have at least one. And then the larger countries may have multiple. In the United States you have several. And then in crypto, there's probably five or six major players with the caveat that Immunifi owns the majority of the market today. We're larger than all of our competitors combined. It's a winner take all environment. Power law structure.
Yeah. Interesting. Okay, I have a question, but before I get to this, I just want to go back and touch on what you said that in a few years' time with regards to security. So in a few years' time, how do you see the war room playing out?
Well, I think it becomes very different. In a few years' time, it's hard for me to predict. I know how security changes in a few years' time, because I'm building that future where we're solving the problems before we ship the code into production. And that's going to be the biggest thing, because there's a chance for us to prevent 99% of war rooms before they even start at all. But even so, even in that world, there's still going to be some war rooms. It's impossible to prevent all war rooms, because our systems are not deterministic, and they're going to have unexpected, unpredictable vulnerabilities or assumptions that end up being violated and then need to be solved. In that sense, the only sense that I can think of war rooms changing really materially is twofold. Number one, they get harder in the sense that international cooperation between law enforcement states continues to break down. And cyber vigilantism and cyber letters of mark increase, leading to a much more hostile internet. And so in that sense, you have much more hostile attackers with fewer types of recourse for law-abiding players, which kind of gives you this Shadowrun. Do you ever remember the game Shadowrun?
No. Never heard of it. Cool.
Google it. It's a hilarious world-building concept. It was a tabletop game, and then they created some video games out of it, RPGs. And it's like fantasy mixes with cyberpunk science fiction. So for example, you have dragons and they're hackers. You have hacker dragons. And it's hilarious. But you have this kind of environment where I mean, it's a very dystopian world where there are these mega corporations that have their own effective cyber armies that are competing with one another and with states directly. And we're going into a world that is getting more and more similar to that.
Yeah. Which is not ideal. All right.
Well, it's not ideal, but the last world wasn't ideal either. So what's the main difference in that regard?
