Welcome to Corazant Technologies, home of the Digital Executive podcast. Do you work in emerging tech? Working on something innovative, maybe an entrepreneur? Apply to be a guest at www.corazant.com/brand. Welcome to the Digital Executive. Today's guest is Mitchell Amador. Mitchell Amador is the founder and CEO of Immunefi, the leading bug bounty and security services platform of the onchain economy. Working at the front lines of web3 security, he has directly helped prevent over $38.5 billion in hacks and thefts across the ecosystem. Through Immunefi's growth, he has helped protect many of the ecosystem's most critical protocols, including MakerDAO, Optimism, Filecoin, LayerZero, Chainlink, Arbitrum, Lido, and Polygon. Mitchell has led and participated in dozens of live onchain incident response war rooms, stopping exploits in real time, and negotiating the return of millions in stolen funds from international black hat actors. Well, good afternoon, Mitchell. Welcome to the show.
Thank you. It's great to be here.
Absolutely, my friend. I appreciate you doing this. You're in Portugal. I'm in Kansas City, the United States, and several time zones and calendars to get here, and I just immensely appreciate you for making the time. And Mitchell, if you don't mind, I'm going to jump right into your first question here. You founded Immunefi in December of 2020 and helped scale bug bounties from an experimental practice into a core security standard for all web3, building what's now the largest blockchain security community with over 45,000 researchers and more than $25 billion in user funds protected. What did you see early on that convinced you incentive-aligned crowdsourced security could work where traditional cybersecurity models had failed?
Sure. Well, I think it was being native to the industry and understanding how rapidly things spread in crypto was key to that insight. And specifically, I came to two conclusions. Number one, the proliferation, the success of DeFi, which happened very quickly all of a sudden as things do in crypto, meant that we had sudden gaping security holes that scammers and attackers and a whole host of negative actors would coalesce around very, very rapidly. A key and essential quality of crypto is how quickly things diffuse, how quickly information travels throughout the whole network in this process of viral diffusion. This applies to good things like realizing all of a sudden that things like DeFi and onchain finance are really, really useful and have unique value propositions you just can't find anywhere else. But it also applies negatively in the sense that when people realize that there is an opportunity to steal money, it quickly diffuses through the criminal side of that same network. And that's what we saw. And so in seeing that, knowing that, having had a front row seat to the consequences of that in 2017 during that initial market run that really led to some great things, but also to a lot of damage to a lot of people. I realized that the only way we could possibly keep up to that was if we corralled the global security community in the same way, knowing that the security community will outnumber the criminals and the attackers many times to one. So it was less of a total certainty that this would work. It was more of an absolute conviction that this is the only thing that can work right now. We simply do not have time before the realization that hackers and thieves can earn life-changing money here by attacking these systems before that debt diffuses through the onchain society. We need to bring the security community to bear and protect as much as we can. There was this necessity that JFD's insight.
That's awesome. And absolutely, you saw first off, you had experience in the DeFi space here, but that security gap was definitely a necessity. And we saw that. I've been in this space as well for quite a number of years. Love this place, this space here, blockchain, web3, and crypto. It scaled quickly. We saw a lot of things come and go. And part of it was with this scaling of these different platforms and currencies, we saw a lot of fraud that went on. And security is obviously paramount now. And I appreciate what you're doing to secure this market. Mitchell, you've argued that security has to move from static to continuous real-time threat monitoring and tooling that keeps pace with evolving risk, and that the industry needs to treat security as infrastructure, not insurance. What's the practical difference between those two mindsets and what changes inside an organization when it makes that shift?
Sure. Okay. There's a few things here. Number one, we've gotten to the point where these systems have so much money and are so mature. There are many multi-billion dollar protocols effectively at this point that you need to understand there are attackers who are perusing your infrastructure 24/7 trying to find ways to rob. Now, the North Koreans with Lazarus group are of course the most famous of these attackers, but there's a great many others. Criminality is an inclusive and open society. So there's lots of people who are snooping at your code at this stage. Now to deal with that, the only way you can do that is you need to shift from a 'oh hey, we have an anti-crime problem, an anti-petty theft problem' to 'hold on, we're in a never-ending war against some of the most well-funded hacker groups in the history of the world, typically backed by nation states.' And the consequence of that, the essential consequence, is you need to be thinking on the frontier of competitive advantage and protection all the time if you want to stay safe. And that means you are now like so many other countries in the world that need to be investing in R&D and staying on the cutting edge of whatever you can do to stay safe. Now given that, that's where real-time protection comes in. And it's less of a 'hey, let's go and use these products, let's go and use these tools,' it's more of a mindset: how do we constantly stay on the edge of security given that we're in the most adversarial and hostile and dangerous environment in the entire internet? And out of that comes 'hey, maybe we should be investing in real-time, truly, hey maybe we should be investing more in bug bounties and similar types of crowdsource tools which are the most effective way to access the latest and the greatest in security knowledge you have. Hey, maybe we should be trying out new technologies and new techniques like firewalling otherwise.' Like it doesn't really matter what the specific tool is. What matters is are you on the frontier because your attackers, they certainly are. And if they get the equivalent of a nuclear cybersecurity weapon before you do, you're dead. Okay, so this is the first part of that question. Now the second part of that was on the distinction between is security infrastructure or is security insurance. And the reality is these two things are going to converge in crypto over time. But that convergence is going to take at least another 5 to 10 years. And the reason is because insurance provides a financial backstop for protecting against risk in the most general possible way by saying, 'Hey, we can just afford to bear the cost or whatever this is.' But it can only do that when it has effectively priced risk. And that means knowing really, really well the nature of the type of risk you face and the kind of damages that could be inflicted. And we are not there. We are not there for crypto. We are a long way from it. We've been tracking every kind of hack and every kind of critical disclosure event that happens in the industry. Over 93% of all critical disclosures in crypto in the last six years or so have gone through Immunefi for context. We have a really comprehensive data set. And while we can tell you what the average hack is likely to be and what the median hack is likely to be and what's the probability a project will get hacked in any given year, there is a huge variance. There's a really long tail and that creates a power law effect in terms of impact that makes the risk quite difficult to price at this stage. Okay. And in consequence we cannot think of security as insurance. It cannot be so predictive and it cannot be so wide ranging in coverage. What we can do is think of it as security as infrastructure. We can think of it as the walls right around your town. We can think of it as the moat around your castle that while not foolproof, right, while possible to defeat and you know that perfectly well, provides an extremely advantageous form of protection that will cover the vast majority of threats that you can possibly face and can be done at relatively low cost as well. All things considered, the cost of these security measures is almost nothing compared to the amount of damage they prevent. And so this is the attitude that we need to be taking. Number one, we need to have this attitude of like, hey, it's cyber defense, not cybersecurity. We're at war. We're fighting against nation state actors, not petty criminals for the most part. And number two, we need to be thinking of this as a constant piece of infrastructure that our societies and our economies require to sustain themselves. It's not going to be foolproof. It can't cover all the risks. It can't cover all the cost, but it is impossible to live without it. And the moment we do that, we become a defenseless nation in a very, very hostile world.
