Welcome to the Cyber Insurance News and Information Podcast. I'm your host, Martin Hidden, and today we're going to be talking about crypto and the adversarial cyber environment, while also serving as a fast-paced test bed for security incentives, loss prevention, and eventually cyber catastrophe insurance. It's a big space, and to help us discuss that today is Mitchell Amador, the CEO of Immunefi. Mitchell, before we dive into that big topic today, thanks so much for joining us. Tell us a little bit about your career and how you got to this space.
Sure. Well, I got here accidentally. I had no particular enthusiasm to become a security professional and the technical side of the business was never my forte. But I found in the course of building lots of different things in early crypto and prior that I kept stumbling into the most severe security and threat modeling problems that we had in the industry. I had to deal with SIM swap attacks where someone takes over your phone, breaks into your iCloud, tries to steal all of your data. It's like identity theft at mass scale. Insider attacks, social engineering attacks, attempted hacks of company treasury and funds, attempted kidnappings and stalkings of all sorts. IP thefts, technology thefts, corporate espionage and everything in between. So in the course of building a lot of things I was pulled into this world of security and I saw all the problems that ultimately brought me to the conclusion that this was in 2019, 2020, that if we didn't transform how we were doing security in crypto we were not going to survive. That we would hit a kind of vulnerability apocalypse that would delegitimize our whole industry. And it was that insight and a wish to prevent that and to safeguard my industry that I loved, I got involved for ideological reasons that I entered the space and that I built Immunefi, which is one of the larger protectors of the industry today.
So tell me about Immunefi. We chatted before today so I know a little bit but I don't get paid to know things. I get paid to have you explain them. So tell me what Immunefi does.
So, Immunefi is the biggest security platform protecting on-chain protocols, platforms, and blockchains in the world today. And specifically, we occupy the bug bounty niche and beyond. But we occupy almost all of the major protocols' bug bounties. If you look at major protocols by TVL or size, almost all of them are going to be Immunefi customers and they're going to host their crowdsource security defense mechanisms with us. In practice, what that means is we've aggregated the largest white hat community spanning the entirety of the crypto security scene and also the traditional web security scene. And we tell these guys, hey, look, we've got all these amazing projects. They need protection. They need support. And you and only you are on the frontier of security that can go and help provide these things. You can find out how to crack their infrastructure and disclose the vulnerabilities that they don't know exist before they could be exploited. And we operate as the central clearing house for all these what would be traditionally known as zero days to go between almost every major project in the industry and the global white hat security team.
So you help people find problems and fix them with regard to security in the crypto space.
That's right. We help people find the holes in their bank vaults they didn't know they have. And unfortunately with software there are always holes.
Indeed. Indeed. So when we were planning this and chatting about this conversation beforehand, we talked about I think the phrase was web three is a bit of a dark forest. And I wonder if in practical terms, you know, you might explain what you think people mean or what that means to people.
Sure. So I would bet that a number of your listeners are actually going to know exactly what that refers to because this quote of course comes from the famous Chinese science fiction novel The Three-Body Problem. And in The Three-Body Problem they describe this challenge: why is it not that the aliens have reached out? Why do we see no evidence of alien life and activity in civilization when we earthly humans are broadcasting infinite amount of very specific and particular and sensible radiation out into the cosmos constantly. Why don't we see it in return? And they get to this conclusion, this terrifying conclusion that the galaxy, the universe is a dark forest. And what that means is that there are these predators that are constantly prowling the environment the entire time. And so the advantageous position in this environment is just to be strictly silent and to be unnoticed, to be unseen, to be invisible because the moment you reveal yourself, a predator will pounce upon you. It is game theoretically optimal for them to take you out. And the connection to crypto is we are the same way but with vulnerabilities. At any particular moment, there are dozens of illegal criminal groups, many of which could be operating at vast scale. Think billions of dollars, okay? It's like really really large scale that are scanning every major contract on chain that are looking at every new project and every new deployment hoping and waiting for a single gap, a simple break in the armor that they can exploit to steal all the money in those contracts. Because in crypto, a hack is not just a hack. It's not a breach of PII or personal identifiable information that's going out. Nobody cares about that here. The hack allows you to steal real money. The biggest heists in the history of mankind all happened here with our bare assets. And so every sophisticated technical criminal organization in the world realizes there's no better place to be a thief than crypto. And at the peak of these, by the way, just to color and contextualize this dark forest analogy, the peak, the most famous group of thieves in crypto today is North Korea, specifically the North Korean army. Okay, this is the environment we're operating in.
They are just one player. You touch on and that you know I'll throw a link in the show notes that there have been great articles about their stunningly organized and global efforts to steal from in this situation and then more broadly as well that all suggests that it's shifted to a much more industrialized or organized kind of reality like that there is a persistent threat to the crypto environment from well-funded, well-organized nation-state in the case of North Korea backed actors. Is that a fair characterization?
100%. And not just North Korea. North Korea is just the most famous. The largest Iranian exchange went down in the opening days of their war being hacked by an Israeli cyber attack group. And we know that some of these other groups in Ukraine and Russia have been throwing cyber bombs, so to speak, at each other for years and years and years now. So North Korea is just the most public, but we're in an environment where the norm or the default, the typical threat model for a builder in our industry is that there are nation-state actors and they are out to get you and to rob you.
I mean, and this is a 24-hour day, every moment of time threat, right? That there's a constant scanning of the system that presents a constant threat, right? Obviously, what is the response to that? You know, what do people who are in this space need to be thinking about if maybe they're not quite aware and I suspect most of them are, but you know, crypto is one of those things that a lot of people who aren't involved hear about and they pretend they understand or they maybe are bold and but what about that idea? What does normal even look like when you're facing this kind of threat?
Sure. This is where the dark forest analogy breaks down by the way because at least in The Three-Body Problem in the dark forest you had a solution. You stay silent. You do not emit or radiate any signal. You stay invisible in order to stay alive. But in crypto we built the whole system so it's transparent by default and everybody can see what everybody else does. So no such option. We don't have good solutions in that part. And so the only solution that we have is really to go after the holy grail of cyber security which is we need objectively secure systems. We need as close to perfect security, perfect defense, unhackability as you can get as the technology can allow as physics will allow. And this is actually what all of on-chain security is about. And this is what we do. We create objectively secure systems.
Well, so pausing there for a sec. Right. So just for those of the audience who aren't on the inside, if you're outside crypto, what's the clearest way to understand the stakes here, why it matters, you know, for people who don't really understand this space, why does it matter?
Sure, great question. It matters for two reasons. Number one is this technology has proven so impactful and transformational, the blockchain that is, that it is inevitably going to underpin global financial infrastructure for the next several decades. Okay, we are in process of replacing financial infrastructure across the world. The tech works great, lowest cost, has all these benefits that will be brought to society, is being brought to society. It's happening. But the flip side of that is when an attacker can compromise these systems, they can do incredible damage. The biggest hack last year was for $1.6 billion. $1.6 billion in less than 15 seconds. Okay. Scary. Two hacks earlier in March were for $300 million each cash. Okay. This is a high stakes game. This is, you know, the GDP of entire cities across the world, right? Tens and hundreds of thousands of people laboring to create good lives just stolen like that. Okay. It has immense impact on people's lives.
Yeah. Yeah, I mean I think that's why I mean one of the ideas that's important to keep in mind is that if something bad happens to your neighbor or within the ecosystem of your economy, even if you're not involved in that economy, it's a bit like a storm hitting California and you have a situation where you may not think living in Ohio it matters, but then you realize you're paying twice as much for avocados. That sort of domino effect is the reason it matters broadly across you know, even people who aren't really involved.
Exactly. So, and this is especially salient when you think of what crypto is and what it offers, which is superior, fairer, more transparent, more inclusive financial markets. Okay? Which is exciting, but financial markets, if they're going to be efficient, they're going to have leverage. And so, they're prone to contagion. And so, these events can get really out of hand. Okay? They can cause much more damage. We've been able to prevent those scenarios to date. We've done a very good job. The industry has some really great people who believe in the mission and who support it and they put up, you know, a billion dollars in some cases to make sure that creditors at some of these institutions that are harmed stay whole. But that's the kind of stakes that we're playing with here and eventually it's going to touch the whole of society. So we need to create these systems and make them safe right now before we see trillions more in assets flow on-chain.
That attitude is one that it's a befitting example because I think broadly with the digital economy that we've embraced since, you know, basically the worldwide web came into fruition in the '90s is one where we've raced forward maybe built on less than ideal tech stacks, right? That the problems of yesterday don't get addressed and you wind up exacerbating the failure to get it right from the beginning or at least have a principle in place from the beginning. Is that a juxtaposition to the way you see this all being developed within the crypto world that the idea is we got to get this right from the start? For it to be new and reliable and the world to be comfortable with this change. We also need to find ourselves in a situation where you know the money goes into a if you will vault or a bank that is actually secure that people can feel safe about it. Is that too simple a way to think about it?
Yes and no. I mean, look, we've been building in this at scale now, Martin, for over a decade, okay? At scale, I'm talking millions and millions of users, no longer hobbyist projects, but serious money and people dedicating their entire careers to this type of activity. So, it's been a long road. We had our period there where we were YOLOing and you know we were influenced by the move fast and break things philosophy but all of crypto has converged on you know kind of move as fast as you can and break absolutely nothing as security philosophy. Every single investor will enforce that standard and expectation on their portfolio companies. Every single institution will expect it. Every single exchange will demand it. So we've gone in this new direction where yes, that is our point of view and it's still early days, right? So you could say that we've committed to that. Obviously being around in the industry a long time, I'm a little more nuanced. I see all the things we tried and failed at as well. So I can't say we really decided it from the beginning. It's more like we learned the hard way at small scale and now we've committed as kind of more mature adults that this is going to be the foundation of our industry and it's working.
So, shifting back to bug bounty, I wonder if you could in a plain English way explain or define what a bug bounty is.
Sure. So, a bug bounty is real simple. It's a big prize that you put up for someone in case they can find a vulnerability in your system. Okay? And that's a very general statement because it's a very general tool. The bug bounty itself, the bug bounty program we call it, is really just a legal contract. It's a prize contract. It's a contest or saying, look, I'm looking for this type of thing. I've got my bank vault, if you will. And my bank vault is not just made up of a building, or it could be. It's also made up of code. It's also made up of servers. It's also made up of infrastructure. It's made up of websites and so on and so forth. And I say to you, Martin, you being the cunning, clever, brilliant, hopefully white hat hacker that you are, if you can find a vulnerability that meets these requirements, that lets you do these bad things to me, to my customers, to my data, then I'm going to pay you a prize. I'm going to pay you, and I'm going to pay it according to this much money that I specified in advance in the contract, the bug bounty program. So this is what a bug bounty is. Now even though the description I gave here was simple as you can imagine it can get very very technical right because we're talking about technical systems and your typical bug bounty program is going to specify at least half a dozen if not two dozen different impacts or deliverables so to speak that they're looking for like you need to be able to hack this system so that it achieves this thing specifically or this thing or this thing and that determines how much money you get. But on a high level at how it works, it's a contest.
So the wisdom behind paying hackers to report flaws, that's because you're tapping into the perspective and the way they see things as something to break into. Is it you're taking advantage of whether it's learned or maybe internal natural instinct on the part of them? Is that the wise part? You know, find a potential adversary and convert them into an asset.
That's a benefit, Martin, but that is off the mark. That is not why we do this. It is nice. Hackers are brilliant and creative and, you know, hairbrained people, make no mistake, and it's great to have them on our side. But the real reason that we do that is numbers. It's the sheer force of security power that we can bring to bear into hardening our systems. And I'll give you this example real simple. Imagine we have our own vault that we're protecting and we've got you've got two three colleagues who do it in security and you need to make sure all the system is secure because you got gold there. You got your corporate IP there. You've got all the PII from your business. You got all your customers records, all the transactions. Maybe you have access to your actual banking infrastructure as well, passwords and the like. There's a lot of valuable stuff there. Now, we're going to say on one side, you have three guys that are going to work great and they're going to work hard. I'm sure they're extremely competent, but they're three guys. Now, what if I said I could deploy 30,000 guys to stress test your system? Which one do you think is going to result in a more secure system?
30,000, not a thousand times more because that's not how it works, but definitely 5, 10, 20 times as much. You start to approach the kind of hypothetical limit of how secure a system of that architecture can be. And the only way we found to do that in cyber security is really by deploying more eyes. More eyes, more people who are using different techniques and who have different points of view and ways of looking at it. And so what a bug bounty really does is it gives you scale. It gives you the kind of scale that you could never build yourself. Like and let's go back to this North Korean example. So the North Koreans who are doing this, they are not a corporate outfit. They are literally part of the army, the intelligence division of the army, and they're responsible for bringing in revenue to which they bring at least billions of dollars per year, which of course goes to fund the North Korean military and society and so on and so forth. Now, in the total of their program, I would say there's probably maybe 300 to a thousand hackers, probably on the lower end of that. Okay? And these guys operate one of the largest and most sophisticated and certainly the most feared hacking armies in the world of finance today. Okay? And there's less than a thousand guys. Immunefi alone has over 90,000 registered hackers. Okay, just us, not including our competitors or all the other players in the industry, just us. We outnumber the biggest threat actor in the world, right? Many many times over. Okay, many many many many times over. And many of these hackers with us are also corporate entities or companies that have access to some of the most advanced and frontier security technology in the world. The best formal verification solutions which is like fuzzing solutions and these are basically sci-fi technologies that we've burst into reality in the course of crypto that make us able to create secure code. Crypto makes the safest code in the world at this point. It's just us and people working on nuclear and ballistic missile systems. Okay, this is the small group of people who can create objectively secure code in the world today. And we've created tech to make that commercially viable and feasible at massive scale. Now combine all that, these crazy brilliant minds plus we outnumber them, right? We outnumber them 100 to one easily. Probably more like a thousand to one if you pull in the broader web two security communities. And you realize, wow, if you can deploy all that talent to secure a system, that is going to be incomparably more valuable. That's going to be the most effective thing you could possibly do to secure your code and to secure your infrastructure. And that's why we use bug bounties because in a world where a single failure where if you get 99.9% you fail, right? And getting even a fraction of that wrong. In that world, you need this disproportionate army of security experts who are protecting you and bug bounties and crowdsource security is the only way to do it. You are always going to be outnumbered. No matter what company you go to, Martin, no matter what project you build, the odds are the North Koreans are going to have more hackers than you. But with the crowdsource solution, we can give you an army that's infinitely larger than theirs.
I mean it seems like there's a sort of different pillars of if you will breakthrough here. There's the technical, economic, and then you touched on the sort of the cultural part of this. I mean is the breadth of this that great?
Yes, I would say so. I would say so. And in more ways than I explained, right? Obviously numerically we are much more advantaged than the attackers. There's just more brilliant good people in the world who have more brilliance and expertise than there are attackers. That's the reality. We do have technological breakthroughs. In fact, we the very people who are the ones who would want to help society and do this work. We are typically the ones who make the technical breakthroughs as well because you know the great inventors, the geniuses, they don't tend to be like you know the criminal masterminds of society for the most part. They tend to be the tinkerers and the creatives and the kind of like artistic engineering types who just like to build things and want to contribute to society. And then we've created really an excellent culture around this work even better than traditional web even better than traditional open source. The crypto security culture is I think in my opinion in my experience the best security culture in the history of the world. We share everything. Okay. We share our data with each other. We share our information. We share our technology and techniques with competitors more like coopetition or almost anywhere else. And we glorify people who protect society. And this has created an environment where it's very easy to get involved. Plus, we have huge incentives like, you know, Immunefi pays out. We just paid a $3 million bounty for a single bug two months ago. And that's not an uncommon occurrence. That's just something that happens. Some guy can retire for life on that if he wants. You know, he's probably sitting in Indonesia somewhere because he's probably from Indonesia just relaxing.
Okay, cool. Good job, man. Go have some kids. You touch on something that, you know, I use the word culture in the question that set that answer up. And one of the things that I've become fascinated in in this space is the CISO at corporations and the way that they are sort of the new kid and they're pressing for money and they're viewed as a cost center. And I've read a couple of reports that survey them about what works. And it's counterintuitive to certainly corporate culture in the conventional sense where what they admit confidentially in at least one report I've read is that being able to talk to CISOs at other companies in the same space as them, potential competitors, and share information about what they're seeing and how they're responding to it is invaluable. But the problem is that's counterintuitive to classic C-suite mentality about a competitor's executives and I wonder whether or not like that's do you have any thoughts about that that the way that you've described this you what did you say cooperation or I forget.
