How Hacken is Securing Web3 Beyond Audits

Recorded at EthCC, Cannes.

Hodl Up: Hello guys and welcome back to another episode of Hodl Up. We've been on a really big run at EthCC this time around, and today we have Dyma from Hacken with us. Dyma, thank you for joining us.

Dyma: Thank you for having me.

Hodl Up: Before we get all serious about security, I really want to know what got you into crypto in the first place.

Dyma: It was a happy accident. At the time I was working for the Ukrainian government, building cybersecurity operations, and I started learning about crypto: following the news and projects, reading white papers and so on. Then there was a crypto event in Ukraine with a pitching competition, and if you won, you got 33 bitcoins. We said, okay, we need to participate. We made a very simple deck for a tokenized bug bounty platform, and we won the 33 bitcoins, but with the promise that we'd do an ICO. So we did an ICO back then, left our jobs and went full-time crypto.

Hodl Up: That's good. What year was this?

Dyma: It was August or September 2017.

Hodl Up: So that was during the ICO boom, but still, 33 bitcoins. I'm hoping you held.

Dyma: Of course it was life-changing money. Even at the time it was $130K. And from the stage, one of the guys allocating the bitcoins, who was an investor, said that same day, "I'm going to put in another half million." I was like, what?

Hodl Up: It was that crazy period. How did you come to start Hacken and do what you've been doing? What was the thought process?

Dyma: We just don't have much fear; we do whatever we want. And right now, I love and hate crypto.

Hodl Up: We're in the same boat.

Dyma: I love it because it can deliver amazing products that make people's lives better. But I hate it because our industry is full of scammers, fraudsters and hackers, and we're a very non-transparent and insecure industry. What we're doing in crypto is basically trying to solve that somehow.

Hodl Up: Because of all the reasons you mentioned, we have new regulations meant to protect the end user. But at the same time, for me at least, all this regulation is making me hate crypto a little bit, the way things are going and shifting. We're losing the plot, as an industry, compared to when we started. And AI today makes everything easier, but it also makes everything harder, especially on the security front. Someone just said that developing with AI is a security and privacy nightmare.

Dyma: On regulation: you have to understand that regulators are people. They're people with experience in some Web2 stuff, and now they have to deal with an unknown industry, crypto. They don't understand it, they don't use it, and they don't understand the risks or what to check. So they're trying to apply the old rules to the crypto industry, and that's why it's not moving anywhere. I'd say regulators are very far behind. They're not doing the things that really matter, but we have to do KYC for all our transactions and movements. That's okay up to a point.

Hodl Up: You mentioned AI, but I think AI is a good thing for people like you building Hacken. People like me aren't technical, but I'm vibe coding, and if I launch a project or an app, I'll need audits. I'll need security, people who know this stuff. If I launch an app through vibe coding without understanding a single line I'm writing, it could be breached right after it goes live, or as soon as it gets big.

Dyma: For sure.

Hodl Up: So are you seeing increased demand for audits and security checks?

Dyma: I see a slightly different story. Some projects ask us for a security assessment, and when they hear the price, they say, "This is ridiculous. I built this crypto wallet for $5K, and you're asking me for more than that for a security assessment? How is that possible?" Of course, that's how it is. But AI can obviously speed up your development many times over, so it's definitely a good thing. But we'll certainly see a lot of new hacks. It's inevitable.

Hodl Up: In your eyes, as a professional in this specific sector of our industry, what's the biggest obstacle to crypto becoming safer? I'm asking as someone who knows that many founders have neglected security checks, assessments and audits in the past. Can we blame the founders, or is it the culture we have as crypto people?

Dyma: First of all, it's the culture. We have our own culture in crypto. Our culture is to make money fast and not think about risks. That's what we're good at. The reality is that we don't put enough pressure on founders. Usually people do the extra security work if they've been hacked, but in crypto that's already too late. Or if regulators push them and they're obliged to do some security work, otherwise they'll get fined. Or when they start losing to competitors who are gaining more trust by following security best practices, when they're losing revenue, then they also start doing security. But in our industry, you can have a protocol with huge liquidity, do a small audit of just your token smart contract, say "I'm secure," and the community goes, "Oh great, we trust you." And that's accepted.

Hodl Up: That's what I was going to ask, because it used to be that companies would just get an audit stamp and not care what happened afterwards. They'd say, "Oh, we're secure, we got the stamp from XYZ company." They didn't understand that security isn't a one-time thing; it's an ongoing process. So how do we get founders and companies to understand that security is something you do continuously, every day, not something you pay for once and hope all your troubles go away?

Dyma: Thank you for the question. It's actually a very important question that we're working on, and I'd like to ask you a question. What do you think is more risky: Aave or Compound?

Hodl Up: Oh, that's a nice one. I haven't used that sort of DeFi in a year, but I would say Compound, because Aave is so big.

Dyma: Okay, good. What's more risky: USDT or USDC?

Hodl Up: USDT.

Dyma: Okay. All right. The answer is correct from your point of view, but someone else can have their own point of view. Until we have one methodology for how we aggregate risks and score them, a methodology that's collective and verified, we won't make the right decisions. From another angle, I want to share a story about WHOOP. For some reason WHOOP became the leader in fitness trackers, and there's an interesting reason why. I started wearing one; someone gave it to me as a present. After a month it calibrates to your activity, and it told me my WHOOP age was five and a half years older than my real age. I was like, what the hell is this? I don't like it. Why am I wearing it? I wasn't charging it, and sometimes I didn't wear it for weeks. Then I met some guys who were showing off to each other that their WHOOP age was younger than their biological age, and they were feeling good about it. And I was like, no, I also want my WHOOP age to be lower than my biological age. So I started looking into how it's calculated. I understood the methodology, and then I slowly started to improve myself: sleeping better and longer, eating healthier, training three times a week. I started running; I had never run before. And it slowly started getting better. Why am I telling you this? Because in crypto we need a risk platform that scores all projects on different parameters, not just security, because there are a lot of other bad practices: in operations, fake Twitter followers, tokenomics, financial results, treasuries. And we need to give all of them a score. That's what we're building. We've gathered data on 2,000 projects, with more than 100 metrics each, and converted that data into a probability-of-loss score. We're releasing it tomorrow, Thursday, at EthCC, and every project will find out its score.

Hodl Up: Okay, that sounds good. Are you using AI to aggregate the data?

Dyma: Of course we're using AI to gather the data, but we're validating it.

Hodl Up: Of course. I have to ask this specific question, because we're both researchers as well. He's more focused on the serious stuff. Will the interface and the service be free to use, to see the resources?

Dyma: That's exactly the right question. Right now, the teams doing risk scores for crypto projects don't have public dashboards. We will: all the data will be available to everybody.

Hodl Up: Perfect. That sounds amazing, to be honest. We need more products like this.

Dyma: We had a lot of debates inside the team, because it would be easy to copy us. But I'm absolutely okay with that, because our goal is to change the industry: to highlight the bad practices, highlight the good ones, and push projects to become better. If there are more voices, that's better, because, as I said, sometimes I'm ashamed of working in this industry. I want this to change, because it's my life.

Hodl Up: I get that a lot. That's why we also have a love-hate relationship with crypto, and we need to work, individually but also collectively, toward a more secure, better and more innovative future. You said it all depends on the methodology, and you made a very good point with USDT versus USDC and Aave versus Compound: it depends on the angle you look from. With tomorrow's launch, companies will be able to see their own risk scores. Will it be different for different types of companies? We have DePIN, we have RWAs, but we also have exchanges, which of course have something completely different, like proof of reserves.

Dyma: Absolutely. Of course you need different methodologies for different types of projects. And we don't want to build everything ourselves. We've been building a security ranking of exchanges for quite a while, and our data is integrated into the CoinGecko Trust Score. 20% of the CoinGecko Trust Score is our data, and we know it already has a positive impact on the security landscape of exchanges. For L2 security, the champions are L2BEAT, so we connect L2BEAT data. For stablecoins, there are a few pretty good public dashboards too; Ferros is a new one that gives pretty good insights. Our methodology for each type of project will of course be public, and even flexible, so everyone will be able to set their own weights for the risk assessment.

Hodl Up: I ask because I've tried to build risk scores and datasets myself in the past, to score different companies and write reports. If you become the most credible source for judging whether someone is doing good work on security, can companies technically manipulate or fake the data they provide, or not paint the full picture? For example, I know CoinMarketCap and CoinGecko show proof of reserves for exchanges, but that doesn't show the full picture. That's just one example. It could be trading volume, which could all be insider trading just to inflate the metrics.

Dyma: You're right, and it's a process. For example, one metric I'm really excited about is that we need to have every exchange's wallets for all the tokens traded there. We need to know them for several reasons. First, most exchanges aren't exchanges, they're brokers: once they take your coins, they send them to another exchange for better liquidity. Second, because they aren't solvent; they don't have reserves. And third, once we have those wallets, we'll be able to compare wallet balances with volume and identify wash trading relatively easily. In any case, exchanges are the evil of our crypto world. They don't disclose the data we must have, and that needs to change. So yes, of course projects and everybody will try to manipulate the data. And you're right about proof of reserves. There are exchanges claiming proof of reserves that aren't actually doing it for their global operation, only for some branch, and that's fake. A lot of proof-of-reserve reports have a big portion of assets covered by the exchange's own native token.

Hodl Up: Which again, what is that? It doesn't even make sense.

Dyma: Yes. So there are problems, but we need to start highlighting them way more. CoinGecko is doing a good job, but it's still a small team.

Hodl Up: And CoinMarketCap is a Binance subsidiary.

Dyma: I'm not biased at all. It's a slightly different story.

Hodl Up: Okay, perfect. Do you think you'll run into any regulatory issues going forward? From my perspective you're in the clear, because you're just aggregating and validating data. But what if a company with a low score wants to take legal action, even though it's not your fault that their company is...

Dyma: Legal action. Well, it's interesting. Of course we're prepared, with full disclaimers and so on, but it's easier to submit the data and do the work than to go to court, right? There's certainly a risk that someone could do it. But we clearly say that the purpose isn't to give someone a score, or to lower someone's score. The purpose is to finally change the industry: to give it a tool, like WHOOP, to start becoming better.

Hodl Up: I'm 100% sure this will have a big impact on the industry, because, as I mentioned, when we do research it's really hard to find credible sources other than paid press releases from different companies.

Dyma: It's very sad.

Hodl Up: And now with AI they're doing mass press releases. You can spot the AI from two miles away: the em dashes, the phrases, everything. It's crazy. What you're doing is really valuable. But do you think that in five years' time, or even two years, which is enough, it will become the industry standard, where companies indirectly advertise you by saying, "Our Hacken score is this"?

Dyma: I hope so; of course that's the goal. But as I said, I'd like there to be three big players. Just like in traditional finance, where Moody's, Standard & Poor's and Fitch give credit ratings, I'd like our industry to have three players competing with each other, improving their methodologies and datasets, and doing good things for the industry.

Hodl Up: There's nothing better for this industry than healthy competition, because you push each other. If I'm not mistaken, you've also done quite a lot of investigating and whistleblowing on different scandals in this industry. What's a normal day in your office when there's a red alert, when some scandal has just broken on crypto Twitter? What's the process?

Dyma: To be honest, it's just a normal day. We have a process for who does what. In crypto there are too many scandals and too much drama. So no free drinks for the team working.

Hodl Up: No free drinks to cheer them up?

Dyma: No, no free drinks.

Hodl Up: I was hoping for some free stuff, man. Okay, to wrap it up, I really want to know where you see the industry. Both you and we have quite a lot of complaints about the industry right now, but where do you see it in 5 to 10 years? This isn't a job interview, by the way. Do you think crypto has a better future, and not a dystopian one?

Dyma: I'm sure it has a better future. I'm personally really excited about RWAs. I think they can actually remove the intermediaries between off-chain businesses and retail investors, and really improve people's lives. But again, you need to build the trust layer there. We still haven't built the trust layer for crypto projects, and RWAs are even more complicated, because there are a lot of other factors to assess in deciding whether an opportunity will be successful or not. But I'm sure that in 5 to 10 years we'll manage it.

Hodl Up: Well, thank you so much, Dyma. It was a pleasure, and it's very refreshing to know there are people like you continuously trying to make this industry more transparent and protect users, because that's what this is all about: getting rid of scammers and removing the misconceptions people have about crypto. My parents still think crypto is a Ponzi scheme. So collectively we have to work together to change those perceptions, and make Hacken the WHOOP of crypto, right?

Dyma: Thank you.