1
00:00:00,700 --> 00:00:04,320
Thank you Ajit for the kind intro and I'm Victor Fang.

2
00:00:04,320 --> 00:00:10,980
I'm the CEO of Ancient AI and I'm joining from San Jose, where the company is located.

3
00:00:11,020 --> 00:00:17,220
And it's a great honor to be presenting as a keynote at the DEF CON Blockchain Village here.

4
00:00:17,220 --> 00:00:23,300
And today I'm going to talk about this most recent, very interesting hack, right, on Twitter.

5
00:00:23,380 --> 00:00:28,100
We call it the Twitter Tax Day Disaster.

6
00:00:28,100 --> 00:00:34,680
We're going to talk, explain to you the beginning and the end and all the implications to the industry.

7
00:00:37,970 --> 00:00:39,710
So first of all, who am I, right?

8
00:00:39,710 --> 00:00:44,370
Like Ajit just said, I presented last year, but some of you may be not new here.

9
00:00:44,370 --> 00:01:00,750
So I founded Ancient AI in 2018 and like some of the folks in the village, right, I also worked at FireEye Mendiant before and I was very honored to be recognized as the face of FireEye 2017 to now, actually.

10
00:01:00,750 --> 00:01:01,050
Yeah.

11
00:01:01,050 --> 00:01:05,170
And I say this year, they're still using my face to represent the FireEye.

12
00:01:05,170 --> 00:01:06,150
It's a great company.

13
00:01:06,150 --> 00:01:10,730
I really, I'm super pleased to see that.

14
00:01:10,730 --> 00:01:16,750
And I'm a big AI and machine learning practitioner since 2007.

15
00:01:16,750 --> 00:01:26,550
And one of my work is including how to use machine learning to detect the PowerShell exploit that is specifically in the APD32.

16
00:01:26,610 --> 00:01:29,490
And I actually have a blog on FireEye, check it out.

17
00:01:29,490 --> 00:01:42,570
And also I'm very honored to be able to work with the great engineers and all that and ship the products, the machine learning powered products to our network, endpoint, email in various companies.

18
00:01:42,730 --> 00:01:53,250
And also when I'm not solving the cybersecurity problems or blockchain problems, I also play electric guitar, but my teacher told me that I keep my day job yet.

19
00:01:53,250 --> 00:01:57,410
So I need your help to help me successful so I can create music.

20
00:01:57,410 --> 00:01:59,530
I can spend more time with music.

21
00:01:59,650 --> 00:02:00,950
So that's myself.

22
00:02:01,230 --> 00:02:03,410
And a little bit about my company, Ancient AI.

23
00:02:03,410 --> 00:02:07,370
We are an AI powered blockchain risk and compliance solution company.

24
00:02:07,370 --> 00:02:11,170
So the team are mostly from FireEye, Mendiant, McAfee.

25
00:02:11,690 --> 00:02:22,190
Then also my co-founder is coming from the internet industry, Yahoo, Pivotal, and we are backed by SIG, Cisco HANA, and Amino Capital.

26
00:02:22,190 --> 00:02:25,390
We are also part of the Berkeley Blockchain Accelerator.

27
00:02:25,910 --> 00:02:29,690
So yeah, so what's the largest hack in 2020, right?

28
00:02:29,690 --> 00:02:32,910
I may ask, when I ask different person, I'm going to get different answers.

29
00:02:32,910 --> 00:02:35,890
Some talk about this March hack on T-Mobile.

30
00:02:35,890 --> 00:02:39,070
Some talk about this Mario hack in April, right?

31
00:02:39,070 --> 00:02:40,410
Those are major hacks.

32
00:02:40,410 --> 00:02:46,790
But I think the biggest one, right, at least the one that gets to the mainstream is actually this text they had.

33
00:02:46,810 --> 00:02:48,930
It happened only a few weeks ago, right?

34
00:02:49,030 --> 00:02:50,970
July 15, 2020.

35
00:02:51,110 --> 00:02:56,270
And this is the screenshot of those celebrities, hacker, that being hacked.

36
00:02:56,430 --> 00:03:01,530
And this is something I'm going to talk about, drilling into every detail of it.

37
00:03:01,970 --> 00:03:05,250
And by the way, we have a contest in progress right now, right?

38
00:03:05,250 --> 00:03:07,230
Thanks for Ajit's help, right?

39
00:03:07,230 --> 00:03:08,770
So we're running it right now.

40
00:03:08,770 --> 00:03:10,030
We're actually in the middle of it.

41
00:03:10,030 --> 00:03:14,230
And actually some of the people already submitted the answers.

42
00:03:14,430 --> 00:03:15,230
Very cool.

43
00:03:15,230 --> 00:03:25,790
And yeah, and then I actually got the honor to be interviewed by the CBS News, right, on this specific incident, right?

44
00:03:25,790 --> 00:03:33,850
And yeah, very great to spend 10 minutes with Len Pease, one of my favorite news anchor.

45
00:03:34,730 --> 00:03:36,390
And okay, let's get down to it, right?

46
00:03:36,390 --> 00:03:43,430
So Twitter hack, it's actually the perfect crime, combining the centralized and decentralized.

47
00:03:43,430 --> 00:03:47,790
That's why I found it super intriguing.

48
00:03:48,370 --> 00:03:51,530
And if you step back and look at all this, right?

49
00:03:51,690 --> 00:03:56,210
We are actually at the boundary of two worlds, right?

50
00:03:56,630 --> 00:03:59,610
Centralized, those internet and banks and all that, right?

51
00:03:59,610 --> 00:04:06,990
And then decentralized, which is a lot of people here are big fans of blockchain, which is designed to be centralized.

52
00:04:06,990 --> 00:04:09,990
And the difference right now as of 2020, right?

53
00:04:11,150 --> 00:04:12,950
The centralized world, right?

54
00:04:12,950 --> 00:04:15,490
It's well studied, plenty of tools and all that, right?

55
00:04:15,490 --> 00:04:18,150
And then the decentralized world, right?

56
00:04:18,150 --> 00:04:21,410
In contrast, less study and lack of tools.

57
00:04:21,410 --> 00:04:23,850
So when the incident like that happened, right?

58
00:04:23,850 --> 00:04:28,670
People focus a lot on those internet, how they're hacking and all that, right?

59
00:04:28,670 --> 00:04:32,970
But fewer people actually focusing on what's happening on the blockchain.

60
00:04:32,970 --> 00:04:36,170
And that's actually the problem we're trying to solve also.

61
00:04:37,270 --> 00:04:39,510
And for this Twitter hack, right?

62
00:04:39,990 --> 00:04:44,410
We call it a Nigerian Prince scam 2.0, right?

63
00:04:44,410 --> 00:04:50,810
And yeah, so for those of you, I still remember those in the 1990s, those famous scam, right?

64
00:04:50,810 --> 00:04:52,630
You get emails or a letter, right?

65
00:04:52,630 --> 00:04:55,970
Saying, Hey, I'm Prince of Nigeria, right?

66
00:04:55,970 --> 00:04:58,350
And then I'm showing money.

67
00:04:58,530 --> 00:05:04,850
If you mail, send me a thousand dollars, I can send you $2,000 back in a few weeks, right?

68
00:05:04,850 --> 00:05:06,650
It's actually exactly what happened.

69
00:05:06,710 --> 00:05:08,390
The same tactic, right?

70
00:05:08,850 --> 00:05:11,430
And it's actually combining the cybersecurity hack, right?

71
00:05:11,430 --> 00:05:17,270
So they're social engineers and it's, which is a takeover into the Twitter main tool, right?

72
00:05:17,270 --> 00:05:19,410
It's a very typical insider spam, right?

73
00:05:19,410 --> 00:05:23,810
And as an outsider, the end user is literally very little you can do.

74
00:05:23,810 --> 00:05:24,390
Okay.

75
00:05:24,410 --> 00:05:26,610
And the second part is a financial scam.

76
00:05:26,690 --> 00:05:28,530
Once they get a hold of your account, right?

77
00:05:28,530 --> 00:05:33,390
They actually launched a Bitcoin as a scam using Bitcoin, right?

78
00:05:33,390 --> 00:05:35,970
It's actually this Nigerian Prince scam.

79
00:05:35,970 --> 00:05:39,530
It's a very famous scam called an advance fee scam, right?

80
00:05:39,530 --> 00:05:44,230
And then they leverage those money laundering as we're going to get into details.

81
00:05:44,830 --> 00:05:45,710
The timeline, right?

82
00:05:45,710 --> 00:05:47,030
Let's look at it, right?

83
00:05:47,030 --> 00:05:50,890
There's actually 10 plus Twitter accounts being hacked, right?

84
00:05:50,890 --> 00:05:52,730
In only three hours, right?

85
00:05:52,730 --> 00:05:56,350
And we summarize it in this nice timeline, right?

86
00:05:56,350 --> 00:05:58,250
There's actually three waves, right?

87
00:05:58,250 --> 00:06:02,170
The first wave are actually a blockchain industry, right?

88
00:06:02,310 --> 00:06:06,150
Finance, Coinbase, and all those celebrities, right?

89
00:06:06,150 --> 00:06:08,090
In this blockchain industry, right?

90
00:06:08,090 --> 00:06:11,590
And then the second wave starting from 1pm in the middle, right?

91
00:06:11,630 --> 00:06:14,770
Elon Musk, Bill Gates, and then Apple and Uber, right?

92
00:06:14,770 --> 00:06:15,310
Roughly.

93
00:06:15,310 --> 00:06:17,530
They are all in the high tech industry.

94
00:06:17,530 --> 00:06:20,250
Then the third wave, the politicians, right?

95
00:06:20,570 --> 00:06:24,670
Obama, Joe Biden, and King Wes and all that, right?

96
00:06:24,670 --> 00:06:28,170
And they are the third wave being hacked before the show is over.

97
00:06:28,170 --> 00:06:32,450
And it's funny to mention that Elon Musk got hacked twice in this wave also.

98
00:06:33,570 --> 00:06:34,910
If we look at it, right?

99
00:06:34,910 --> 00:06:36,430
It's getting more interesting, right?

100
00:06:36,430 --> 00:06:39,590
So the hacker posts the Bitcoin address in Twitter, right?

101
00:06:39,590 --> 00:06:41,430
And people start sending money to it, right?

102
00:06:41,430 --> 00:06:45,510
And then if you look at this chart, we generate it using our CISO tool, right?

103
00:06:45,870 --> 00:06:48,890
You can clearly see that within the 24 hours, right?

104
00:06:48,890 --> 00:06:50,970
There's a lot of money movement on the blockchain, right?

105
00:06:50,970 --> 00:06:52,110
This is what I say.

106
00:06:52,110 --> 00:06:57,410
This is the dark side of the decentralized world, right?

107
00:06:57,410 --> 00:07:01,170
Not a lot of people are aware of it because of the lack of tools, right?

108
00:07:01,450 --> 00:07:03,590
And then this is exactly what we're trying to help, right?

109
00:07:03,910 --> 00:07:11,750
Within 24 hours, actually, the hacker receives those money and starts doing the money laundering, right?

110
00:07:11,750 --> 00:07:15,230
And within 24 hours, they wire into six different wallets.

111
00:07:15,230 --> 00:07:19,190
We actually have a full detail blocks in our media, okay?

112
00:07:19,190 --> 00:07:30,670
And it's funny to mention that there's actually still... we're able to recognize three... there's three victims coming from a known exchanges, right?

113
00:07:30,670 --> 00:07:33,150
Are sending money to it, right?

114
00:07:34,790 --> 00:07:39,190
And then if we look at a longer time horizon, right?

115
00:07:39,190 --> 00:07:39,990
Five days.

116
00:07:39,990 --> 00:07:43,350
And then actually, as we predicted on day one, right?

117
00:07:43,350 --> 00:07:47,350
The hacker starts to run through the mixers, right?

118
00:07:47,350 --> 00:07:48,810
The tumblers, right?

119
00:07:49,010 --> 00:07:51,210
To start the money laundering process, right?

120
00:07:51,210 --> 00:07:54,310
Those are the hops and splits and jumps, as you can see, right?

121
00:07:54,310 --> 00:07:56,830
They actually eventually get into this wasabi mixer.

122
00:07:56,830 --> 00:07:58,790
I will spend more time on it later.

123
00:07:59,870 --> 00:08:01,390
And there's a quick update, right?

124
00:08:01,390 --> 00:08:02,890
I mean, a few days ago, right?

125
00:08:02,890 --> 00:08:04,630
You guys are probably already aware of it, right?

126
00:08:04,630 --> 00:08:06,890
So those three Twitter hackers are arrested.

127
00:08:06,890 --> 00:08:09,470
One of them, I think it's confirmed to be in Florida.

128
00:08:09,470 --> 00:08:11,630
Two of them are actually the UK cities and all that.

129
00:08:11,630 --> 00:08:13,990
There's a wire article on that, right?

130
00:08:15,230 --> 00:08:20,190
And yeah, let's... I mean, let's... this is like a typical Mendian exercise, right?

131
00:08:20,190 --> 00:08:22,210
Let's try to attribute this hacker, right?

132
00:08:22,210 --> 00:08:24,190
So we actually in day one, right?

133
00:08:24,190 --> 00:08:28,330
We launched this block, one of the most in-depth block, right?

134
00:08:28,530 --> 00:08:30,310
Investigation reporting industry.

135
00:08:30,450 --> 00:08:35,490
So the first one is like, we correlate with some of our threat intel, right?

136
00:08:35,490 --> 00:08:40,730
We find out this thing is actually correlated to crypto4health.com, right?

137
00:08:40,730 --> 00:08:46,990
And the right-hand side, yeah, this is the first time you guys are seeing it, but internally, we actually analyze more than just blockchain, right?

138
00:08:46,990 --> 00:08:51,870
We also analyze the domain registrations and all that in our threat intel database.

139
00:08:51,970 --> 00:08:56,090
So we knew that this was actually a US-based server, right?

140
00:08:56,090 --> 00:09:03,530
And then we also say, they will predict... they will start a Bitcoin mixer, money laundering, right?

141
00:09:03,530 --> 00:09:07,310
This is like how we found the ransomware, right?

142
00:09:07,310 --> 00:09:08,870
The WarnerCrypt and all that, right?

143
00:09:08,870 --> 00:09:09,930
Back in a few years ago.

144
00:09:10,130 --> 00:09:13,670
And then we also say, hey, it's a coordinate crypt, as you can see, right?

145
00:09:13,670 --> 00:09:16,790
That timeline is structured in three ways and all that.

146
00:09:16,790 --> 00:09:17,790
It's well-planned.

147
00:09:17,790 --> 00:09:20,330
It's not a random keep doing the random hacking, right?

148
00:09:20,330 --> 00:09:28,050
It's coordinate crypt, but it's less sophisticated than those hacking campaigns I have done with DeWitt before, right?

149
00:09:28,050 --> 00:09:29,630
At FireEye Mendiance and all that.

150
00:09:29,630 --> 00:09:33,610
Those APT hackers are more sophisticated than these guys.

151
00:09:34,070 --> 00:09:40,250
And then one thing we did miss, one prediction we did wrong is actually we told the media, hey, be patient.

152
00:09:40,250 --> 00:09:48,970
It may take a few months to arrest them, but actually the law enforcement were able to caught those guys in two weeks, right?

153
00:09:50,190 --> 00:09:54,070
And there's a question that I got asked often, right?

154
00:09:54,070 --> 00:09:57,910
So why the hackers only make $100,000, right?

155
00:09:57,910 --> 00:09:58,930
You think about it.

156
00:09:58,930 --> 00:10:01,670
Those most powerful people in the US, right?

157
00:10:01,670 --> 00:10:02,910
Their Twitter account got hacked.

158
00:10:02,910 --> 00:10:04,430
Why they only make 100K?

159
00:10:04,430 --> 00:10:06,270
Why the hacker only make 100K?

160
00:10:06,270 --> 00:10:07,110
That's nothing.

161
00:10:07,490 --> 00:10:10,430
But okay, if you remember that timeline, right?

162
00:10:10,430 --> 00:10:14,710
It's actually the shows only last for three hours, no more than that, right?

163
00:10:14,710 --> 00:10:22,990
And then if you divide it by three, that's actually still $36,000 per hour, pretty decent profit that they make, right?

164
00:10:22,990 --> 00:10:25,390
So I think thanks to the Twitter team, right?

165
00:10:25,390 --> 00:10:29,250
The compromised celebrities and everyone that alerted this hack, right?

166
00:10:29,250 --> 00:10:35,370
Including those people that forwarded our research report and some other companies report, right?

167
00:10:35,370 --> 00:10:44,350
This is actually the awareness where we can help bring more transparency, bring more light into this dark world.

168
00:10:44,910 --> 00:10:47,270
As my interview to Inverse, right?

169
00:10:47,270 --> 00:10:49,990
One of the New York based media, right?

170
00:10:49,990 --> 00:10:53,970
Humans are always the weakest link, as you can see again here, right?

171
00:10:53,970 --> 00:11:03,390
The threat vector is, again, is getting the human, getting the internal infrastructure and then compromise the entire Twitter admin tool, right?

172
00:11:03,390 --> 00:11:13,090
And this is exactly why our company, so we can act faster and be more preventive.

173
00:11:14,130 --> 00:11:15,030
Oh, okay.

174
00:11:15,030 --> 00:11:16,910
So let's get to the second section here, right?

175
00:11:16,910 --> 00:11:21,590
So I want to talk about some cool technology in the blockchain security and would like to pick this one.

176
00:11:21,590 --> 00:11:24,650
I think this is the most exciting technology advancement, right?

177
00:11:24,870 --> 00:11:27,930
SpaceX send us the Dragon Crew, right?

178
00:11:27,930 --> 00:11:32,130
They sent two astronauts to the ISS, super cool.

179
00:11:33,510 --> 00:11:37,530
And then look at the Earth, right?

180
00:11:37,530 --> 00:11:41,890
From the space, actually, you cannot see any border, okay?

181
00:11:42,230 --> 00:11:48,170
And actually, the human, right, create maps so we can navigate.

182
00:11:48,430 --> 00:11:51,930
This is exactly what nChain AI try to achieve, right?

183
00:11:51,930 --> 00:11:58,910
We create blockchain maps for this massive centralized world, so your business can navigate.

184
00:11:58,910 --> 00:12:12,710
For example, we are trying to identify which one are the exchanges, which one is the OTC and miner and hackers and all that, so we can make transaction more safely, more securely in this decentralized world.

185
00:12:13,590 --> 00:12:17,050
Then look at this world, right?

186
00:12:17,470 --> 00:12:18,970
That's $8 billion.

187
00:12:19,030 --> 00:12:24,670
Actually, only 1% of the money laundering are in cryptocurrency based on FATAP.

188
00:12:24,670 --> 00:12:31,970
FATAP is the organization defining the anti-money laundering standards and all that based in Europe, okay?

189
00:12:31,970 --> 00:12:34,070
So three typical, three steps, right?

190
00:12:34,070 --> 00:12:36,870
In any money laundering, including this one, okay?

191
00:12:36,870 --> 00:12:40,910
Including the Bitcoin and cryptocurrency and all Tether, stablecoins and all that.

192
00:12:40,910 --> 00:12:44,390
Three steps, placement, layering and integration, right?

193
00:12:44,390 --> 00:12:49,070
And we have done some investigation, including this Twitter hack one, right?

194
00:12:49,130 --> 00:12:56,790
And then actually, the hackers are actually, they use this technology, right?

195
00:12:56,790 --> 00:13:09,010
This money laundry in cryptocurrency technology being used by many, many other bad actors, like ransomware, people are selling their breach data on dark webs and all that.

196
00:13:10,270 --> 00:13:12,490
And this is a super challenging task, right?

197
00:13:12,490 --> 00:13:15,550
That's why we haven't seen any company have done that yet, right?

198
00:13:15,550 --> 00:13:23,550
One of the challenges is actually we have over 500 million addresses out there in the blockchain world and it's growing like crazy, right?

199
00:13:23,550 --> 00:13:25,870
And then if you make a comparison, right?

200
00:13:25,870 --> 00:13:27,230
This is where I live, right?

201
00:13:27,230 --> 00:13:29,870
In San Francisco Bay Area, a satellite map, right?

202
00:13:29,870 --> 00:13:34,570
Without putting those landmarks and all that, right?

203
00:13:34,570 --> 00:13:36,630
Like what usually you are seeing the map, right?

204
00:13:36,630 --> 00:13:38,850
Or putting the highways or buildings and all that.

205
00:13:38,850 --> 00:13:41,890
It's really hard to figure out what's going on there, right?

206
00:13:42,030 --> 00:13:43,530
And then the same thing, right?

207
00:13:43,530 --> 00:13:47,590
The Bitcoin UTXO transaction graph looks like the right hand side, right?

208
00:13:47,590 --> 00:13:50,590
And there's a 500 million vertices there.

209
00:13:50,590 --> 00:13:54,510
And it's going to get to billions real quick, right?

210
00:13:54,510 --> 00:13:56,990
Because we have many other blockchain coming up.

211
00:13:56,990 --> 00:14:04,130
Exelium is doing pretty well recently and there's other, like for example, those tokens are running on top of Exelium and all that, right?

212
00:14:04,130 --> 00:14:06,330
It's getting more and more challenging.

213
00:14:07,370 --> 00:14:09,030
And our solution to this, right?

214
00:14:09,030 --> 00:14:13,130
And I think this is a blockchain mapping is the best way to do it, right?

215
00:14:13,130 --> 00:14:19,250
There's three specific technology feature where a technology problem is solving, right?

216
00:14:19,250 --> 00:14:21,230
One is pseudonymity, right?

217
00:14:21,230 --> 00:14:24,030
We're using the threat intel UEBAs and all that.

218
00:14:24,030 --> 00:14:27,510
We try to figure out the behavior of the address.

219
00:14:27,970 --> 00:14:31,370
Then the second one we deal with is the massive data volume, right?

220
00:14:31,370 --> 00:14:34,510
We're left with big data cloud and GPU, right?

221
00:14:34,570 --> 00:14:36,970
Some of the models are running on deep learning.

222
00:14:37,070 --> 00:14:40,850
Then complex graph transaction relationship, right?

223
00:14:40,850 --> 00:14:47,230
That's where we actually develop AI and UX focused investigation tool that we will talk about.

224
00:14:47,230 --> 00:14:51,850
And actually some people in the room are already using that CISO product, right?

225
00:14:52,590 --> 00:14:56,390
Then our machine learning connect to more than 10 different blockchains, right?

226
00:14:56,390 --> 00:14:59,070
And as promised, I'm going to put one equation here.

227
00:14:59,070 --> 00:15:01,830
And this is the only equation in this entire slide, right?

228
00:15:01,830 --> 00:15:04,590
So one of the model is using deep learning, right?

229
00:15:04,590 --> 00:15:11,110
To try to figure out exactly the same technology being used by AlphaGo, AlphaStar, the self-driving car and all that.

230
00:15:11,110 --> 00:15:16,370
We're trying to figure out giving kinds of transactions of an address.

231
00:15:16,370 --> 00:15:20,130
Can we figure out the behavior of it, right?

232
00:15:20,130 --> 00:15:24,030
Then yeah, just to make an analogy here, right?

233
00:15:24,530 --> 00:15:27,190
500 million blockchain addresses, right?

234
00:15:27,190 --> 00:15:30,270
It's like what the map is our intelligence we're creating.

235
00:15:30,270 --> 00:15:31,470
The bank, right?

236
00:15:31,470 --> 00:15:33,470
That on the landmark, right?

237
00:15:33,470 --> 00:15:44,570
They are similar to reputable exchanges like Coinbase and all those top exchanges that are more focusing on compliance and regulation, right?

238
00:15:44,570 --> 00:15:46,210
And car accident, right?

239
00:15:46,210 --> 00:15:53,130
Those bad incidents and those are the suspicious actors that we reflect on the right-hand side here.

240
00:15:53,130 --> 00:15:55,250
And that's what the goal we're trying to achieve.

241
00:15:55,250 --> 00:16:00,990
We're trying to make it more transparent so we can navigate more securely and safely.

242
00:16:01,570 --> 00:16:04,330
Okay, let's do a little bit of a pop quiz, right?

243
00:16:04,370 --> 00:16:06,230
Yeah, who can tell me what is this?

244
00:16:06,230 --> 00:16:09,570
This is one of the typical Bitcoin address, right?

245
00:16:10,050 --> 00:16:10,950
What is it?

246
00:16:11,130 --> 00:16:14,310
It's hard to see, all those nonsense letters.

247
00:16:15,210 --> 00:16:22,630
Well, and then if you open and putting this address in any of the blockchain explorers and all that, right?

248
00:16:22,630 --> 00:16:24,070
This is what you're going to see, okay?

249
00:16:24,070 --> 00:16:27,470
It's a wealthy and probably still active Bitcoin wallet, right?

250
00:16:27,470 --> 00:16:30,030
That's usually this is what you can get, right?

251
00:16:30,470 --> 00:16:32,710
And it started at what?

252
00:16:33,110 --> 00:16:34,230
2017, right?

253
00:16:34,230 --> 00:16:35,770
If that's a hint to you.

254
00:16:36,250 --> 00:16:39,430
It turns out, okay, it's actually a WannaCry ransomware.

255
00:16:39,430 --> 00:16:44,910
One of the few wallets that they embedded into their ransomware, right?

256
00:16:44,910 --> 00:16:50,690
I think some of you probably are exploring in ransomware and all that.

257
00:16:50,690 --> 00:16:54,350
And this is actually one of the screenshot we get from the FireEye sandbox, right?

258
00:16:54,350 --> 00:16:59,270
This is that exact screenshot what pops up when you got infected by WannaCry.

259
00:16:59,670 --> 00:17:00,970
That little address, see that?

260
00:17:00,970 --> 00:17:06,850
That's the 12T9 is exactly what the hackers are using for receiving the ransom.

261
00:17:07,930 --> 00:17:14,090
Okay, so we have been building this intelligence database in the last two years, right?

262
00:17:14,090 --> 00:17:23,730
And then, yeah, so when you're plugging, we're trying to tell you, okay, this is actually the ransomware which even tells you the family, the WannaCry and all that.

263
00:17:23,730 --> 00:17:27,030
And most importantly, if you're running a crypto business, right?

264
00:17:27,030 --> 00:17:30,070
We will tell you, hey, do not transact with this guy, right?

265
00:17:30,070 --> 00:17:33,190
Reflect as the highest risk score, 100, right?

266
00:17:33,190 --> 00:17:33,990
Do not transact.

267
00:17:33,990 --> 00:17:39,730
If you make transaction with this guy, Boeing Forceman is going to come to you.

268
00:17:39,910 --> 00:17:43,730
And they are equipped with threat and intelligence tool these days.

269
00:17:44,690 --> 00:17:46,990
And actually, that's a good thing, right?

270
00:17:46,990 --> 00:17:52,950
So, and then, so that's exactly why we are launching this tool, right?

271
00:17:52,950 --> 00:17:54,150
For free, right?

272
00:17:54,150 --> 00:17:57,450
We're trying to democratize blockchain investigation.

273
00:17:57,470 --> 00:18:02,410
Other than paying $100,000 to buy some of the expensive commercial tool, right?

274
00:18:02,410 --> 00:18:06,090
We feel like we need to lower the barrier of entry.

275
00:18:06,090 --> 00:18:09,650
We need to make this tool more available to everybody, right?

276
00:18:09,650 --> 00:18:14,890
So, we can actually help this industry obtain X.

277
00:18:14,890 --> 00:18:16,810
So, by the way, as we're speaking, right?

278
00:18:16,810 --> 00:18:20,490
We actually just launched the second challenge in the same website, right?

279
00:18:20,490 --> 00:18:23,870
So, now you should see the button, right?

280
00:18:23,870 --> 00:18:25,290
Being activated.

281
00:18:25,590 --> 00:18:29,470
So, the second challenge is the WannaCry ransomware challenge.

282
00:18:31,170 --> 00:18:31,890
Okay.

283
00:18:31,890 --> 00:18:35,430
And so, let's drill down a little bit deeper, right?

284
00:18:35,430 --> 00:18:36,990
What is a Bitcoin mixer, right?

285
00:18:36,990 --> 00:18:41,950
Maybe, I mean, some of you are already using it or very familiar with it, right?

286
00:18:42,110 --> 00:18:44,450
Basically, as of now, right?

287
00:18:44,450 --> 00:18:52,650
It's the most popular Bitcoin mixer in the world, algorithm, right?

288
00:18:52,650 --> 00:18:56,550
There's a paper published a few years ago explaining the details of it, right?

289
00:18:56,770 --> 00:19:00,550
And then we believe that the Twitter hackers are actually using Wasabi, right?

290
00:19:00,550 --> 00:19:01,870
It's hard to tell, right?

291
00:19:01,870 --> 00:19:04,890
Because they keep shuffling around the wallets and address and all that.

292
00:19:04,890 --> 00:19:06,970
But then in the mixer, right?

293
00:19:06,970 --> 00:19:15,590
But then based on the machine learnings and all that, we can actually see the similarity of the transactions, right?

294
00:19:15,590 --> 00:19:20,790
They're using to the existing behavior training base we already have.

295
00:19:22,070 --> 00:19:22,850
Okay.

296
00:19:22,850 --> 00:19:24,290
So, as a human, right?

297
00:19:24,290 --> 00:19:27,310
If you're seeing transactions like this, right?

298
00:19:27,310 --> 00:19:31,030
It's very hard to figure out what that is, right?

299
00:19:31,410 --> 00:19:36,430
It's just one of the many UTXO transactions, right?

300
00:19:36,490 --> 00:19:38,890
You have some sudden behavior tracing there, right?

301
00:19:38,890 --> 00:19:40,490
That's why we can leverage machine learning.

302
00:19:40,490 --> 00:19:48,210
But it's still hard to say because some exchanges, especially the mainstream exchanges, will use similar technology like this also, right?

303
00:19:48,350 --> 00:19:53,210
And by the way, it is a Wasabi transaction, okay?

304
00:19:53,210 --> 00:20:01,290
We have detected over 700,000 of similar transactions like this, and that's only on the 2020, okay?

305
00:20:01,290 --> 00:20:04,370
And out of the 54 million total transactions.

306
00:20:05,970 --> 00:20:08,590
How machine learning detects this, right?

307
00:20:08,630 --> 00:20:14,730
So, this is one of... we're going to share with you some of the best models we built in our auto machine learning pipeline, right?

308
00:20:14,730 --> 00:20:17,270
This is the gradient boosting tree model we built, right?

309
00:20:17,270 --> 00:20:19,070
This is just an illustration of it.

310
00:20:19,070 --> 00:20:25,330
We have a thousand trees model, super accurate, that we trained from all this curated transaction data, right?

311
00:20:25,550 --> 00:20:31,590
And for example, on the left-hand side, that's one of the real... that's the Twitter hack transaction, right?

312
00:20:31,590 --> 00:20:45,230
And then some of them are actually... our model predicts as a high probability of being a because they have those certain characteristics of the Bitcoin mixer, right?

313
00:20:45,230 --> 00:20:47,670
And how machine learning can help, right?

314
00:20:48,390 --> 00:20:52,450
We have built thousands of those machine learning models, right?

315
00:20:52,450 --> 00:20:55,350
To specifically detect every behavior.

316
00:20:55,350 --> 00:20:57,550
For example, mixer is a big one.

317
00:20:57,550 --> 00:21:00,350
Exchange, hackers, and bots, right?

318
00:21:00,350 --> 00:21:02,570
We talked about bots last year, right?

319
00:21:02,570 --> 00:21:11,790
And then there's actually whatever you can find on the internet, the decentralized world, you can also find the equivalent party, the decentralized world.

320
00:21:11,790 --> 00:21:13,250
That's very interesting.

321
00:21:14,390 --> 00:21:16,210
Can we prevent this, right?

322
00:21:16,210 --> 00:21:20,270
I think it's totally feasible if we equip with the right technology, right?

323
00:21:20,270 --> 00:21:21,890
And like Coinbase, right?

324
00:21:21,930 --> 00:21:25,350
Coinbase did a great job, incident response, right?

325
00:21:25,350 --> 00:21:29,790
And then as Phil Martin presented to the Forbes, right?

326
00:21:29,790 --> 00:21:37,410
So I think, yeah, they were able to block them when this thing is just starting to happen, right?

327
00:21:37,550 --> 00:21:39,850
So thanks for doing that Coinbase, I think.

328
00:21:39,850 --> 00:21:43,150
And more exchanges should follow this pattern, right?

329
00:21:43,150 --> 00:21:51,790
Equip with the right technology, the right experts, block all these bad transactions, protect this entire blockchain ecosystem,

330
00:21:55,840 --> 00:21:56,680
right?

331
00:21:56,680 --> 00:21:59,220
Oh, I know some of the other companies, right?

332
00:21:59,220 --> 00:22:04,700
They kind of think about privacy in a different way, right?

333
00:22:04,700 --> 00:22:09,360
But our perspective, NCHI's perspective on the privacy on blockchain, right?

334
00:22:09,360 --> 00:22:13,340
Privacy should always be protected as well, okay?

335
00:22:13,340 --> 00:22:15,560
But there's a big distinction, right?

336
00:22:15,560 --> 00:22:21,520
Between this NCHI blockchain mapping versus other surveillance, right?

337
00:22:21,520 --> 00:22:25,820
We don't call our surveillance, we are mapping the blockchain world.

338
00:22:26,040 --> 00:22:31,180
We only get down to the behavior level, so that's like, what is it, right?

339
00:22:31,180 --> 00:22:37,120
So for example, I'm telling, okay, this address is a bank, it's a post office, that's it, right?

340
00:22:37,120 --> 00:22:40,100
Not to the individual level, that's a huge difference.

341
00:22:40,100 --> 00:22:54,640
We're not trying to breach the customer privacy, we're not trying to identify the individual level, and public intelligence, all of the intelligence are coming from public resources that we got, right?

342
00:22:54,820 --> 00:22:56,300
Then, don't be evil, right?

343
00:22:56,300 --> 00:22:59,700
Never monetize on the customer's privacy data, right?

344
00:22:59,700 --> 00:23:03,400
And focus on malicious addresses for the risk purpose, right?

345
00:23:03,400 --> 00:23:11,640
The whole business here, we're trying to make blockchain more secure to transact, that's on the privacy.

346
00:23:11,640 --> 00:23:22,120
And then, Twitter hack is actually defining a new chapter of the blockchain world in 2020.

347
00:23:22,120 --> 00:23:28,040
This is what I call the end of the beginning, I want to call Winston Churchill, one of my favorite characters, right?

348
00:23:28,340 --> 00:23:30,120
This is the end of the beginning.

349
00:23:30,620 --> 00:23:32,760
Why do I say that, right?

350
00:23:32,880 --> 00:23:35,340
We are entering a new chapter.

351
00:23:35,920 --> 00:23:37,180
Before this, right?

352
00:23:37,180 --> 00:23:41,520
I mean, Bitcoin shows up in 2009, right?

353
00:23:42,000 --> 00:23:44,320
And all the way until today.

354
00:23:44,320 --> 00:23:49,980
It's still a great area, especially in the regulatory compliance side, right?

355
00:23:49,980 --> 00:23:56,080
A different country, a different opinion on it, SEC still haven't figured out what really cryptocurrency is.

356
00:23:56,080 --> 00:24:00,180
Is it a security, a currency, or asset, or whatever, a commodity?

357
00:24:00,600 --> 00:24:02,280
They haven't figured it out yet, right?

358
00:24:02,280 --> 00:24:03,860
But going forward, right?

359
00:24:03,860 --> 00:24:16,240
2020 and beyond, they are already spending a lot of effort in defining this, to bring more regulatory compliance, providing guidelines on the VASP, right?

360
00:24:16,240 --> 00:24:18,540
The Virtual Asset Service Provider.

361
00:24:18,940 --> 00:24:26,580
For example, FADA, the AML, the company, at that organization, they're defining the standard for anti-money laundry, right?

362
00:24:26,580 --> 00:24:31,900
FADA and OCC, this is the bank regulator body in US.

363
00:24:31,900 --> 00:24:35,020
ISACA and SEC think about that.

364
00:24:38,300 --> 00:24:40,140
Is there a question?

365
00:24:43,180 --> 00:24:46,920
And then the community is going to help more transparency, right?

366
00:24:46,920 --> 00:24:50,220
And when I look at this, this industry, right?

367
00:24:50,320 --> 00:24:56,840
The moment it got acquired for blockchain adoption.

368
00:25:01,160 --> 00:25:02,760
Is there a question on the line?

369
00:25:06,360 --> 00:25:07,660
10x growth, right?

370
00:25:07,660 --> 00:25:11,360
Only happens when more blockchain adoption to the mainstream.

371
00:25:11,360 --> 00:25:22,340
And if we allow those hackers are using Bitcoin and cryptocurrency, the long-term funding and all that, this industry is going to fail, or it's going to stay like this, right?

372
00:25:22,340 --> 00:25:26,940
So that's why we need to...

373
00:25:28,020 --> 00:25:37,420
I mean, some of you actually doesn't look like working with the government bodies and all that, but I think this is actually helpful to make this industry grow 10x.

374
00:25:39,060 --> 00:25:40,260
And what's next, right?

375
00:25:40,260 --> 00:25:46,280
After this Twitter hack 2020, I think there's three things, three aspects to it.

376
00:25:46,940 --> 00:25:48,120
Awareness.

377
00:25:48,120 --> 00:25:54,620
Blockchain needs us to work as a community to fight all this illicit use of cryptos.

378
00:25:54,840 --> 00:25:56,900
The technology side.

379
00:25:57,380 --> 00:26:07,340
One of the main reasons that a lot of exchanges are still accepting those longer bitcoins or cryptocurrency stable coins and all that, right?

380
00:26:07,340 --> 00:26:10,860
It's actually because they lack of the technology, right?

381
00:26:11,220 --> 00:26:21,300
And then technology, as we are showing already, is making it possible to defend against those illicit use of cryptos, especially with machine learning and AI, right?

382
00:26:21,300 --> 00:26:30,860
So we have, like I said, we have almost 800,000 transactions using Wasabi, the mixer, in 2020.

383
00:26:31,080 --> 00:26:34,200
Some of them are good, some of them are bad, but at least we need to picture it.

384
00:26:34,200 --> 00:26:37,920
We need to kind of tell you, okay, it's actually a mixer.

385
00:26:37,920 --> 00:26:42,300
And then different countries, different exchanges have different policies against it, right?

386
00:26:42,300 --> 00:26:45,880
Compliance bodies also have different ways of defining it, right?

387
00:26:45,880 --> 00:26:55,700
For example, earlier this year, Binance, they got caught up by the Singapore MAS, right?

388
00:26:55,700 --> 00:26:59,300
The Singapore MAS is their regulatory body, like the SEC, right?

389
00:26:59,300 --> 00:26:59,940
Singapore.

390
00:26:59,940 --> 00:27:07,940
And then they kind of tell Binance, hey, you cannot accept mixer if they're coming into exchange, right?

391
00:27:07,940 --> 00:27:10,540
Things are still starting to change, right?

392
00:27:10,540 --> 00:27:18,400
So government has also realized that, okay, this cryptocurrency is going to be getting more and more mainstream, right?

393
00:27:18,400 --> 00:27:24,300
How do we make it secure for everybody, so more people can enjoy this great technology?

394
00:27:24,300 --> 00:27:31,460
And on the risk and security side, compliance side, technology is also a big factor to it, right?

395
00:27:31,460 --> 00:27:35,820
It can be applied to preventive or post-incident, right?

396
00:27:35,960 --> 00:27:40,160
Then the third one, regulatory compliance guideline from the public sector, right?

397
00:27:40,360 --> 00:27:45,060
FATF, OCC, SEC, and things like that, and 5AMLB, right?

398
00:27:45,060 --> 00:27:47,880
That's from the European side.

399
00:27:49,460 --> 00:27:57,460
Then, yeah, and then so I'm very fascinated by this SpaceX, right?

400
00:27:57,460 --> 00:27:59,120
That Dragon Crew, right?

401
00:27:59,120 --> 00:28:03,320
So and then we compared it to this Boeing Starliner on the left-hand side.

402
00:28:03,380 --> 00:28:09,980
I call it pre-2020, but then I decided to put another pre because this is a super vintage.

403
00:28:09,980 --> 00:28:15,680
If you look at the dashboard, man, this is crazy, and how it's going to navigate.

404
00:28:15,680 --> 00:28:18,480
There's like hundreds of buttons out there, right?

405
00:28:18,480 --> 00:28:21,820
If you look at our right-hand side, in contrast, right?

406
00:28:22,200 --> 00:28:26,940
Yeah, this is actually the design that SpaceX had, right?

407
00:28:26,940 --> 00:28:29,940
So make super sleek, super easy to navigate, right?

408
00:28:29,940 --> 00:28:34,100
It's spent a lot of time on the user experience, the UX side of it, right?

409
00:28:34,100 --> 00:28:36,340
To really make it accessible.

410
00:28:36,340 --> 00:28:39,300
And this is also, I feel, is important, right?

411
00:28:40,100 --> 00:28:48,560
If very few people can only use very few tools to get access, to understand what blockchain is, right?

412
00:28:48,560 --> 00:28:51,320
And that is a big problem for the industry, right?

413
00:28:51,320 --> 00:28:53,700
Think about it, like the internet, right?

414
00:28:53,700 --> 00:28:55,680
We're using internet every day, right?

415
00:28:56,360 --> 00:28:58,400
But on the blockchain side, look at it.

416
00:28:58,400 --> 00:28:59,600
How many tools do you use?

417
00:28:59,600 --> 00:29:04,680
If the blockchain explorer, yeah, those are only good, those are like Wireshark, right?

418
00:29:04,680 --> 00:29:10,240
But then you have to have something more accessible, more user-friendly for them.

419
00:29:10,240 --> 00:29:15,980
Even to look at those, this blockchain investigation side of it, right?

420
00:29:16,180 --> 00:29:20,340
It can actually help you understand more of what's happening.

421
00:29:20,340 --> 00:29:26,540
And I think that the general public, right, need to have a tool like that.

422
00:29:27,660 --> 00:29:30,540
Then, okay, so this is towards the end of my talk, right?

423
00:29:30,540 --> 00:29:34,900
So as I said, right, as of now, we actually just launched the second set of the challenge, right?

424
00:29:34,900 --> 00:29:36,080
Join the contacts right now.

425
00:29:36,080 --> 00:29:39,100
It's going to last until tomorrow night, midnight, right?

426
00:29:39,100 --> 00:29:40,840
So you still have plenty of time.

427
00:29:41,140 --> 00:29:44,380
This whole challenge, as I promised, is no code.

428
00:29:44,380 --> 00:29:45,820
You don't have to code up anything.

429
00:29:45,820 --> 00:29:54,200
The only thing you need is go to the website and put those address there and then start clicking, start exploring, right?

430
00:29:54,200 --> 00:29:59,580
But as you know, as an analyst, a researcher, you still have to have some expertise in that.

431
00:29:59,580 --> 00:30:06,160
But I mean, at the bare minimum, you don't need any technical skills to be able to enjoy this technology, right?

432
00:30:06,160 --> 00:30:10,260
And that's actually the main thesis when I talk to my team, right?

433
00:30:10,260 --> 00:30:16,200
This is one of the design principles I want the engineer, the designer to build, right?

434
00:30:16,200 --> 00:30:19,060
To build into our DNA of the product, right?

435
00:30:19,060 --> 00:30:24,340
And then, so we allocate over a thousand dollars worth of Bitcoin price, right?

436
00:30:24,340 --> 00:30:26,360
And so we're in the middle of it.

437
00:30:26,360 --> 00:30:29,740
So the first set of the challenge was the Twitter hack, right?

438
00:30:29,740 --> 00:30:34,740
So you can actually experience, you can be a detective yourself.

439
00:30:35,060 --> 00:30:37,020
Open the website, the contacts, right?

440
00:30:37,020 --> 00:30:38,660
And then, yeah, check it out.

441
00:30:38,660 --> 00:30:45,240
And then now we are launching a second set of the challenge, which is the ransomware that I just showed you.

442
00:30:49,300 --> 00:30:52,300
So that's the end of my talk.

443
00:30:52,300 --> 00:30:58,480
And yeah, so we got about 40 minutes and half an hour, 20 minutes.

444
00:30:58,480 --> 00:31:01,200
So Ajit, so we have a Q&A time.

445
00:31:09,150 --> 00:31:10,970
And by the way, this is the website, right?

446
00:31:10,970 --> 00:31:13,570
This is the blockchainviz.net contest.

447
00:31:16,950 --> 00:31:17,650
Okay, go ahead.

448
00:31:17,650 --> 00:31:18,590
Any questions?

449
00:31:51,070 --> 00:31:55,790
How many of you have tried the contest already?

450
00:31:55,790 --> 00:31:56,930
What do you guys think?

451
00:31:56,930 --> 00:31:58,210
Any thoughts?

452
00:31:58,210 --> 00:31:59,710
Any feedbacks

453
00:32:29,400 --> 00:32:29,980
?

454
00:32:30,260 --> 00:32:32,040
Yeah, let's see.

455
00:32:35,980 --> 00:32:41,480
Oh, ah, I see.

456
00:32:42,680 --> 00:32:45,800
So there's a streaming on Twitch and also YouTube.

457
00:32:50,280 --> 00:32:51,360
All right, okay.

458
00:33:24,260 --> 00:33:25,640
Okay, yeah.

459
00:33:28,040 --> 00:33:29,420
Right, right.

460
00:33:29,420 --> 00:33:32,840
Yeah, actually I can see that there's already a few submissions, right?

461
00:33:32,840 --> 00:33:35,620
And then, yeah, so some of them already got it right, right?

462
00:33:35,620 --> 00:33:37,960
I think, yeah, the first set of the challenge, right?

463
00:33:37,960 --> 00:33:43,480
Yeah, so we do have a pretty intelligent cloud in the room here.

464
00:33:44,640 --> 00:33:45,740
But let's see.

465
00:33:45,740 --> 00:33:48,240
We still have, what, how many hours?

466
00:33:48,240 --> 00:33:50,640
We have one and a half days, right, ahead now.

467
00:33:50,640 --> 00:33:53,360
So we just launched the second set of the challenge, right?

468
00:33:53,360 --> 00:33:54,320
So check it out.

469
00:33:54,320 --> 00:33:56,180
And yeah, it's fun.

470
00:33:56,580 --> 00:33:58,460
And there's no any feedback and all that, right?

471
00:33:58,460 --> 00:34:06,180
So we're actually expecting a lot of, we actually saw a lot of traffic going to the website and we'll just upgrade the server and all that, right?

472
00:34:06,180 --> 00:34:08,780
So hopefully we can handle the traffic and all that.

473
00:34:08,780 --> 00:34:13,380
And yeah, so thanks a lot for participating in the contest.

474
00:34:13,380 --> 00:34:16,080
And let's see which one's going to be a winner .

475
00:34:23,030 --> 00:34:25,010
And it's fun.

476
00:34:25,250 --> 00:34:36,710
And it's fun that you can actually see those, you can become an investigator, and all this intelligence and all that are already publicly available in the public ledger, Bitcoin, which is great.

477
00:34:36,710 --> 00:34:40,170
We just need a tool to tap into it to make it more accessible.

478
00:35:05,440 --> 00:35:06,320
All right, cool.

479
00:35:06,320 --> 00:35:06,860
Thank you, Ajit.

480
00:35:06,860 --> 00:35:08,000
Thank you, everyone.

481
00:35:08,000 --> 00:35:09,000
Bye-bye.

482
00:35:13,420 --> 00:35:14,360
Thank you, Ajit.

483
00:35:14,360 --> 00:35:15,000
Thank you, everyone.

484
00:35:15,000 --> 00:35:15,660
Bye-bye.