Crypto is becoming a place where you can trade everything. What crypto will do eventually is link every single asset globally. This technology, at the end of the day, will break through barriers and that's the magic, I think.
Hi everyone. We're live here at Paris Blockchain Week for another special interview. Today, I'm joined by Ben Zhou. Of course, you'll know him as the founder and CEO of Bybit. Ben, it's great to finally catch up with you and meet you in person. I've been in the industry for a number of years and I've never actually had the pleasure, so it's great to meet you in person. First things first, it's been about a year since the industry was rocked by the Bybit hack. We now know in the postmortem that this all came down to the Safe wallet hack, but I really just wanted to chat to you about the year that it's been and the lessons you learned and if you think the industry really took the lessons that needed to be learned from that situation and everyone has leveled up when it comes to security. Unfortunately, there have been also more incidents that happened even most recently.
So, I think security incidents and the threat of hackers is going to be a constant battle for crypto. And I think what we do as the industry, even through the Bybit incident, we were very thankful that the industry really helped us. So, we have been doing our best to also help the victim moving forward. So, we launched this thing called lazarusbounty.com, which helps victims to track the lost funds. One of the core issues is we were relying on a third party for our cold wallet. But it is very hard for other projects, especially starting fresh. You want to design your own hardware wallet and for now, Bybit has a very banking grade vault level hardware wallet system. Where it requires you physically be there and log HSM and all of that. And I mean, we now know that it takes almost like 8 months to build one and to order the system, to order the equipment and it's massively costly. So, only the exchange maybe is able to do that. So, still you need to rely on third party for most of the players here. It's just that at the end of the day, you just have to be extremely careful and be updated yourself to the latest update, to the latest awareness. And making sure that whatever you're signing, you look through carefully. But again, there's always new ways to hack and even with agent AI now being used so much, it increases the more security threats and I think there's going to probably be more issues to come out with AI and everything.
I think it was about a year and a half ago I went to a nuclear bunker in the Swiss Alps that SEBA Bank uses for their MPC shard to manage their Bitcoin. And for me, that was just like a huge eye-opener that some companies in the industry are going to extreme lengths to give their customers the assurance that hey, if you're trusting us as a custodian of your funds, these are the lengths that we're going to. It's hugely expensive for them to do, but it's amazing to see it firsthand. And I think that was the big learning from the Bybit hack is that a lot of people were just trusting third-party apps and essentially doing kind of blind signing and those kind of things and it really sometimes it does take a big accident for everyone to be like, okay, we can't be doing that anymore. We really need to level up our security. But the other piece to that is the social engineering. We've seen this with North Korean-linked hackers. The time horizons that they do things on are like 6 months to a year that they're willing to get people to go through a whole hiring process, get embedded in a company and then compromise a system and go about it that way. And at that point, it's not even a technical fault. It's a social engineering fault. And I don't know if you have any thoughts on how the industry tackles that, because it's not only going to be the crypto industry, it's going to be the AI industry, it's going to be the tech industry in general that slowly is going to be infiltrated by these kind of secret agents that are just trying to hack and steal as much funds as they can.
So, through our incident, very interesting you asked. We've created regular relationships with a lot of the security firms. And I asked them, like people think is this system flaws, this cold wallet design, MPC sharding and all these hardcore things that hackers care about. And they tell me, 90% of the time is social engineering. Because if you're a hacker, to achieve your goal, if your goal is just to steal the crypto or the money, the easiest is through social hacking. So, social engineering will always be there and it will always happen. And that's actually the easiest breakthrough point for any hacker. So, I think this is something for most companies and teams, they need to be aware is the social engineering that you should really focus your time on. And make sure you design the thing assuming social engineering will happen.
Given that context, how do you prevent that from happening? So, one of the biggest, I think, logic changes for us even on Bybit is prior the hack, we were like, how do we prevent hacking from happening? After the hack and what we learned, how they do things and stuff, we are assuming a hack will happen. How to make sure that when it happens, it's minimal damage and the firm won't die. And that should be a lot of the mentality for all the firms is to do that. Once you're in that mentality, you actually design many layers of things. And start to be more aware of the social engineering part of things.
I think the industry gave you just sort of praise for the way that you handled it. I mean, like you went on all the X spaces, you did numerous interviews. You were very forthcoming with information within hours of the hack happening. And a lot of exchanges actually came to the table and helped you, you know, like obviously cover the losses and at least just give you the liquidity for the ETH. Can you talk a little bit about those conversations in the background, how you reached out to other big crypto exchanges, because it's a lot to ask other competitors in the industry to come and help you with a problem, but if they didn't help you, it could have been a problem for everyone else.
What's really critical is during the first, I would say, 12 hours. Because in the first 12 hours, we know immediately when we got hacked, we have to cover the fund out from our money. And we know we have the money. But our money is not Ethereum. What we got hacked is Ethereum. When the hack happens, clients who have Ethereum wants to withdraw the Ethereum. So, people are flocking and panicking withdrawing, the bank run on our Ethereum. What we have is Bitcoin. So, or stable coins. So, we need a bridge loan just to solve that liquidity. So, we and then we actually reached out to industry players. One of the funny things is for example, I think it was Galaxy. They are one of the largest Ethereum holders. And they were ready to sign a contract until their treasury guys tell me that their Ethereum is also in Safe. Because when that's when the thing happens, the Safe shut down. The Safe. So, everyone was using the same vault. And I cannot get a loan from whoever is using Safe. So, that limits my choice to whoever is not using Safe. And then I reached out to I think there was a big guy, there was MEXC, there was I think I reached out even to Binance and I think in the end, Bitget and MEXC was very helpful to give me a bridge loan. I think even Bitget didn't ask for collateral. They were just like, take it, you know, just take it. But they're like we only have so much in our own treasury. Because as an exchange, you cannot obviously give your client's money. But your own treasury, there's only a limited number. So, in the end, when we got everything, it was about 10% of what we needed. So, then in the next 10 hours, we just need to OTC Ethereum. So, we just massively bought a bunch of Ethereum with our Bitcoin. And that's how we solved the crisis. But it was very helpful, we're very appreciative, you know, all the industry players that came out and helped us. And that kind of reminds me, whenever someone else is in need, I want to return the favor by helping them as well.
Yeah, for sure. I think it was an important moment for the industry in general that everyone came together and made sure that people were made whole. And yeah, I mean, as a journalist, I think the way that you handled it was pretty good. And out of all the hacks and things that have happened, it's probably the best example of just good crisis communications and then, you know, like good management of funds and the coming together of people in the industry. I'm very curious to get your thoughts on the markets in general. I think there's a general consensus that we're in a bear market at the moment and it's been very interesting to see the shift of institutional capital into crypto in the last few years. And as someone who built Bybit and was built on, you know, I think of people like, you know, Crypto Banter and his YouTube channel who really brought a lot of retail users to your platform, how you view the current sentiment and like, is retail still really involved in trading crypto or are we really just shifting into institutions and like, what do you see in the data that people are using on Bybit?
I think they're still a retail driven market from our perspective. But a lot more retail, we're focusing on the retail that are not I think the crypto savvy part of the audience has been pretty much onboarded onto all the global exchanges. And with regulation, especially EU with MiCA, you are really tapping into the crypto interested people or the crypto not awakened, they haven't won crypto. Now finally, there is legal framework, there is license framework, and then if you look at the exchanges under MiCA, they're connected to local banks, whether it's Netherlands or whether it's France. So it's quite easy for them to do direct banking and to do that. But what I've seen with the narrative is that especially this trend now is not about so much meme coins and crypto new tokens, it is really about TradFi asset going on chain. And recently, everyone's focusing on how do we bring RWAs, tokenized stock, even pre-IPO stock from the US to global offerings. And that's kind of getting people interested. Even gold, silver, oil, people want to trade that. So crypto is becoming a kind of a place where you can trade everything, like a one-stop shop.
Is that what you're trying to build Bybit into now? Like the future New York Stock Exchange that is crypto and then every other sort of conventional TradFi stock share securities that people can trade on your platform?
I don't think there is such a venue today. You have of course the Nasdaq, but that's for US investors mainly. You have Hong Kong Exchange which is mainly for people who want to trade that. And that's the problem of existing financial market. It's very segregated by regions, right? A client from Nigeria doesn't have the same set of financial choices or for a client compared to a client in New York, let's say. What internet does initially is freedom of information. Everyone gets the same treatment now for information. And crypto is going to change that into financial infrastructure. So what crypto would do eventually is link every single asset globally to anyone who have an app called Bybit or one of, you know, and they can basically trade global assets from anywhere. And so I think there hasn't been a place like that. With to achieve this goal, we want to connect to the infrastructure. So we have license globally, we probably have the most license compared to all the exchanges. With all this licensing infrastructure, we're connected to the local banks and provide local liquidities. So then any client is able to buy anything from Brazil, Nigeria, Indonesia, things like that. I think that's kind of the new trend and that's what we try to build.
Yeah. Are you kind of like infrastructure and chain agnostic when it comes to, you know, bringing all of these RWAs on chain? Does it matter to you if it's happening on Ethereum or Solana or Canton? What are your views on that?
Yeah, we are agnostic. So I mean we're connected to pretty much all the chains. So if they choose certain chains they want to, that's their call.
And then a user can just go and buy Tesla stock on Bybit in the future. That would be the kind of like the vision, right? So you can buy crypto, you can buy Bitcoin, you can buy Ethereum, you can buy Tesla stocks, you can, you know, whatever you want and it should happen on a Bybit or a Coinbase or a Binance.
