Thank you Ajit for the kind intro and I'm Victor Fang. I'm the CEO of Ancient AI and I'm
joining from San Jose, where the company is located. And it's a great honor to be presenting
as a keynote at the DEF CON Blockchain Village here. And today I'm going to talk about this
most recent, very interesting hack, right, on Twitter. We call it the Twitter Tax Day Disaster.
We're going to talk, explain to you the beginning and the end and all the implications to the
industry. So first of all, who am I, right? Like Ajit just said, I presented last year,
but some of you may be not new here. So I founded Ancient AI in 2018 and like some of the folks in
the village, right, I also worked at FireEye Mendiant before and I was very honored to be
recognized as the face of FireEye 2017 to now, actually. Yeah. And I say this year,
they're still using my face to represent the FireEye. It's a great company. I really,
I'm super pleased to see that. And I'm a big AI and machine learning practitioner
since 2007. And one of my work is including how to use machine learning to detect the
PowerShell exploit that is specifically in the APD32. And I actually have a blog on FireEye,
check it out. And also I'm very honored to be able to work with the great engineers and all
that and ship the products, the machine learning powered products to our network, endpoint, email
in various companies. And also when I'm not solving the cybersecurity problems or blockchain
problems, I also play electric guitar, but my teacher told me that I keep my day job yet. So
I need your help to help me successful so I can create music. I can spend more time with music.
So that's myself. And a little bit about my company, Ancient AI. We are an AI powered
blockchain risk and compliance solution company. So the team are mostly from FireEye, Mendiant,
McAfee. Then also my co-founder is coming from the internet industry, Yahoo, Pivotal,
and we are backed by SIG, Cisco HANA, and Amino Capital. We are also part of the Berkeley
Blockchain Accelerator. So yeah, so what's the largest hack in 2020, right? I may ask,
when I ask different person, I'm going to get different answers. Some talk about this March
hack on T-Mobile. Some talk about this Mario hack in April, right? Those are major hacks.
But I think the biggest one, right, at least the one that gets to the mainstream is actually this
text they had. It happened only a few weeks ago, right? July 15, 2020. And this is the screenshot
of those celebrities, hacker, that being hacked. And this is something I'm going to talk about,
drilling into every detail of it. And by the way, we have a contest in progress right now,
right? Thanks for Ajit's help, right? So we're running it right now. We're actually in the
middle of it. And actually some of the people already submitted the answers. Very cool.
And yeah, and then I actually got the honor to be interviewed by the CBS News, right, on this
specific incident, right? And yeah, very great to spend 10 minutes with Len Pease, one of my
favorite news anchor. And okay, let's get down to it, right? So Twitter hack, it's actually the
perfect crime, combining the centralized and decentralized. That's why I found it super
intriguing. And if you step back and look at all this, right? We are actually at the boundary of
two worlds, right? Centralized, those internet and banks and all that, right? And then decentralized,
which is a lot of people here are big fans of blockchain, which is designed to be centralized.
And the difference right now as of 2020, right? The centralized world, right? It's well studied,
plenty of tools and all that, right? And then the decentralized world, right? In contrast,
less study and lack of tools. So when the incident like that happened, right? People
focus a lot on those internet, how they're hacking and all that, right? But fewer people
actually focusing on what's happening on the blockchain. And that's actually the problem
we're trying to solve also. And for this Twitter hack, right? We call it a Nigerian Prince
scam 2.0, right? And yeah, so for those of you, I still remember those in the 1990s,
those famous scam, right? You get emails or a letter, right? Saying, Hey, I'm Prince
of Nigeria, right? And then I'm showing money. If you mail, send me a thousand dollars, I can
send you $2,000 back in a few weeks, right? It's actually exactly what happened. The same tactic,
right? And it's actually combining the cybersecurity hack, right? So they're social
engineers and it's, which is a takeover into the Twitter main tool, right? It's a very typical
insider spam, right? And as an outsider, the end user is literally very little you can do.
Okay. And the second part is a financial scam. Once they get a hold of your account, right?
They actually launched a Bitcoin as a scam using Bitcoin, right? It's actually this Nigerian Prince
scam. It's a very famous scam called an advance fee scam, right? And then they leverage those
money laundering as we're going to get into details. The timeline, right? Let's look at it,
right? There's actually 10 plus Twitter accounts being hacked, right? In only three hours,
right? And we summarize it in this nice timeline, right? There's actually three waves,
right? The first wave are actually a blockchain industry, right? Finance, Coinbase, and all those
celebrities, right? In this blockchain industry, right? And then the second wave starting from 1pm
in the middle, right? Elon Musk, Bill Gates, and then Apple and Uber, right? Roughly. They are all
in the high tech industry. Then the third wave, the politicians, right? Obama, Joe Biden, and
King Wes and all that, right? And they are the third wave being hacked before the show is over.
And it's funny to mention that Elon Musk got hacked twice in this wave also. If we look at it,
right? It's getting more interesting, right? So the hacker posts the Bitcoin address in Twitter,
right? And people start sending money to it, right? And then if you look at this chart,
we generate it using our CISO tool, right? You can clearly see that within the 24 hours,
right? There's a lot of money movement on the blockchain, right? This is what I say.
This is the dark side of the decentralized world, right? Not a lot of people are aware of it
because of the lack of tools, right? And then this is exactly what we're trying to help, right?
Within 24 hours, actually, the hacker receives those money and starts doing the money laundering,
right? And within 24 hours, they wire into six different wallets. We actually have a full
detail blocks in our media, okay? And it's funny to mention that there's actually still... we're
able to recognize three... there's three victims coming from a known exchanges, right? Are sending
money to it, right? And then if we look at a longer time horizon, right? Five days. And then
actually, as we predicted on day one, right? The hacker starts to run through the mixers,
right? The tumblers, right? To start the money laundering process, right? Those are the hops
and splits and jumps, as you can see, right? They actually eventually get into this wasabi mixer.
I will spend more time on it later. And there's a quick update, right? I mean, a few days ago,
right? You guys are probably already aware of it, right? So those three Twitter hackers are arrested.
One of them, I think it's confirmed to be in Florida. Two of them are actually the UK cities
and all that. There's a wire article on that, right? And yeah, let's... I mean, let's... this
is like a typical Mendian exercise, right? Let's try to attribute this hacker, right? So we actually
in day one, right? We launched this block, one of the most in-depth block, right? Investigation
reporting industry. So the first one is like, we correlate with some of our threat intel, right?
We find out this thing is actually correlated to crypto4health.com, right? And the right-hand side,
yeah, this is the first time you guys are seeing it, but internally, we actually analyze more than
just blockchain, right? We also analyze the domain registrations and all that in our threat intel
database. So we knew that this was actually a US-based server, right? And then we also say,
they will predict... they will start a Bitcoin mixer, money laundering, right? This is like
how we found the ransomware, right? The WarnerCrypt and all that, right? Back in a few years ago.
And then we also say, hey, it's a coordinate crypt, as you can see, right? That timeline is
structured in three ways and all that. It's well-planned. It's not a random keep doing the
random hacking, right? It's coordinate crypt, but it's less sophisticated than those hacking
campaigns I have done with DeWitt before, right? At FireEye Mendiance and all that. Those APT
hackers are more sophisticated than these guys. And then one thing we did miss, one prediction we
did wrong is actually we told the media, hey, be patient. It may take a few months to arrest them,
but actually the law enforcement were able to caught those guys in two weeks, right?
And there's a question that I got asked often, right? So why the hackers only make
$100,000, right? You think about it. Those most powerful people in the US,
right? Their Twitter account got hacked. Why they only make 100K? Why the hacker only make 100K?
That's nothing. But okay, if you remember that timeline, right? It's actually the shows only
last for three hours, no more than that, right? And then if you divide it by three,
that's actually still $36,000 per hour, pretty decent profit that they make, right?
So I think thanks to the Twitter team, right? The compromised celebrities and everyone that
alerted this hack, right? Including those people that forwarded our research report and some other
companies report, right? This is actually the awareness where we can help bring more transparency,
bring more light into this dark world. As my interview to Inverse, right? One of the
New York based media, right? Humans are always the weakest link, as you can see again here,
right? The threat vector is, again, is getting the human, getting the internal infrastructure
and then compromise the entire Twitter admin tool, right? And this is exactly why our company,
so we can act faster and be more preventive.
Oh, okay. So let's get to the second section here, right? So I want to talk about some cool
technology in the blockchain security and would like to pick this one. I think this is the most
exciting technology advancement, right? SpaceX send us the Dragon Crew, right? They sent two
astronauts to the ISS, super cool. And then look at the Earth, right? From the space,
actually, you cannot see any border, okay? And actually, the human, right, create maps
so we can navigate. This is exactly what nChain AI try to achieve, right? We create blockchain
maps for this massive centralized world, so your business can navigate. For example,
we are trying to identify which one are the exchanges, which one is the OTC and miner and
hackers and all that, so we can make transaction more safely, more securely in this decentralized
world. Then look at this world, right? That's $8 billion. Actually, only 1% of the money laundering
are in cryptocurrency based on FATAP. FATAP is the organization defining the anti-money laundering
standards and all that based in Europe, okay? So three typical, three steps, right? In any money
laundering, including this one, okay? Including the Bitcoin and cryptocurrency and all Tether,
stablecoins and all that. Three steps, placement, layering and integration, right? And we have done
some investigation, including this Twitter hack one, right? And then actually, the hackers are
actually, they use this technology, right? This money laundry in cryptocurrency technology being
used by many, many other bad actors, like ransomware, people are selling their breach data
on dark webs and all that. And this is a super challenging task, right? That's why we haven't
seen any company have done that yet, right? One of the challenges is actually we have over 500
million addresses out there in the blockchain world and it's growing like crazy, right? And then
if you make a comparison, right? This is where I live, right? In San Francisco Bay Area, a satellite
map, right? Without putting those landmarks and all that, right? Like what usually you are seeing
the map, right? Or putting the highways or buildings and all that. It's really hard to
figure out what's going on there, right? And then the same thing, right? The Bitcoin UTXO
transaction graph looks like the right hand side, right? And there's a 500 million vertices there.
And it's going to get to billions real quick, right? Because we have many other blockchain
coming up. Exelium is doing pretty well recently and there's other, like for example, those tokens
are running on top of Exelium and all that, right? It's getting more and more challenging.
And our solution to this, right? And I think this is a blockchain mapping is the
best way to do it, right? There's three specific technology feature where a technology problem
is solving, right? One is pseudonymity, right? We're using the threat intel UEBAs and all that.
We try to figure out the behavior of the address. Then the second one we deal with
is the massive data volume, right? We're left with big data cloud and GPU, right? Some of the
models are running on deep learning. Then complex graph transaction relationship, right? That's
where we actually develop AI and UX focused investigation tool that we will talk about.
And actually some people in the room are already using that CISO product, right?
Then our machine learning connect to more than 10 different blockchains, right? And as promised,
I'm going to put one equation here. And this is the only equation in this entire slide, right? So
one of the model is using deep learning, right? To try to figure out exactly the same technology
being used by AlphaGo, AlphaStar, the self-driving car and all that. We're trying to figure out
giving kinds of transactions of an address. Can we figure out the behavior of it, right?
Then yeah, just to make an analogy here, right? 500 million blockchain addresses, right? It's like
what the map is our intelligence we're creating. The bank, right? That on the landmark, right?
They are similar to reputable exchanges like Coinbase and all those top exchanges that are
more focusing on compliance and regulation, right? And car accident, right? Those bad incidents and
those are the suspicious actors that we reflect on the right-hand side here. And that's what the
goal we're trying to achieve. We're trying to make it more transparent so we can navigate more
securely and safely. Okay, let's do a little bit of a pop quiz, right? Yeah, who can tell me what
is this? This is one of the typical Bitcoin address, right? What is it? It's hard to see,
all those nonsense letters. Well, and then if you open and putting this address in any of the
blockchain explorers and all that, right? This is what you're going to see, okay? It's a wealthy
and probably still active Bitcoin wallet, right? That's usually this is what you can get, right?
And it started at what? 2017, right? If that's a hint to you. It turns out, okay, it's actually
a WannaCry ransomware. One of the few wallets that they embedded into their ransomware,
right? I think some of you probably are exploring in ransomware and all that. And this is actually
one of the screenshot we get from the FireEye sandbox, right? This is that exact screenshot
what pops up when you got infected by WannaCry. That little address, see that? That's the 12T9
is exactly what the hackers are using for receiving the ransom.
Okay, so we have been building this intelligence database in the last two years, right? And then,
yeah, so when you're plugging, we're trying to tell you, okay, this is actually the ransomware
which even tells you the family, the WannaCry and all that. And most importantly, if you're
running a crypto business, right? We will tell you, hey, do not transact with this guy, right?
Reflect as the highest risk score, 100, right? Do not transact. If you make transaction with this
guy, Boeing Forceman is going to come to you. And they are equipped with threat and intelligence
tool these days. And actually, that's a good thing, right? So, and then, so that's exactly
why we are launching this tool, right? For free, right? We're trying to democratize blockchain
investigation. Other than paying $100,000 to buy some of the expensive commercial tool,
right? We feel like we need to lower the barrier of entry. We need to make this tool more available
to everybody, right? So, we can actually help this industry obtain X. So, by the way, as we're
speaking, right? We actually just launched the second challenge in the same website, right? So,
now you should see the button, right? Being activated. So, the second challenge is the
WannaCry ransomware challenge. Okay. And so, let's drill down a little bit deeper, right?
What is a Bitcoin mixer, right? Maybe, I mean, some of you are already using it or very familiar
with it, right? Basically, as of now, right? It's the most popular Bitcoin mixer in the world,
algorithm, right? There's a paper published a few years ago explaining the details of it,
right? And then we believe that the Twitter hackers are actually using Wasabi, right? It's
hard to tell, right? Because they keep shuffling around the wallets and address and all that. But
then in the mixer, right? But then based on the machine learnings and all that, we can actually
see the similarity of the transactions, right? They're using to the existing behavior training
base we already have. Okay. So, as a human, right? If you're seeing transactions like this,
right? It's very hard to figure out what that is, right? It's just one of the many UTXO transactions,
right? You have some sudden behavior tracing there, right? That's why we can leverage machine
learning. But it's still hard to say because some exchanges, especially the mainstream exchanges,
will use similar technology like this also, right? And by the way, it is a Wasabi transaction,
okay? We have detected over 700,000 of similar transactions like this,
and that's only on the 2020, okay? And out of the 54 million total transactions.
How machine learning detects this, right? So, this is one of... we're going to share with you
some of the best models we built in our auto machine learning pipeline, right? This is the
gradient boosting tree model we built, right? This is just an illustration of it. We have a thousand
trees model, super accurate, that we trained from all this curated transaction data, right?
And for example, on the left-hand side, that's one of the real... that's the Twitter hack transaction,
right? And then some of them are actually... our model predicts as a high probability of being a
because they have those certain characteristics of the Bitcoin mixer,
right? And how machine learning can help, right? We have built thousands of those machine learning
models, right? To specifically detect every behavior. For example, mixer is a big one.
Exchange, hackers, and bots, right? We talked about bots last year, right?
And then there's actually whatever you can find on the internet, the decentralized world,
you can also find the equivalent party, the decentralized world. That's very interesting.
Can we prevent this, right? I think it's totally feasible if we equip with the right technology,
right? And like Coinbase, right? Coinbase did a great job, incident response, right? And then
as Phil Martin presented to the Forbes, right? So I think, yeah, they were able to block them
when this thing is just starting to happen, right? So thanks for doing that Coinbase, I think. And
more exchanges should follow this pattern, right? Equip with the right technology, the right experts,
block all these bad transactions, protect this entire blockchain ecosystem, right?
Oh, I know some of the other companies, right? They kind of think about privacy in a different
way, right? But our perspective, NCHI's perspective on the privacy on blockchain,
right? Privacy should always be protected as well, okay? But there's a big distinction, right?
Between this NCHI blockchain mapping versus other surveillance, right? We don't call our
surveillance, we are mapping the blockchain world. We only get down to the behavior level,
so that's like, what is it, right? So for example, I'm telling, okay, this address is a bank,
it's a post office, that's it, right? Not to the individual level, that's a huge difference.
We're not trying to breach the customer privacy, we're not trying to identify the individual level,
and public intelligence, all of the intelligence are coming from public resources that we got,
right? Then, don't be evil, right? Never monetize on the customer's privacy data,
right? And focus on malicious addresses for the risk purpose, right? The whole business here,
we're trying to make blockchain more secure to transact, that's on the privacy. And then,
Twitter hack is actually defining a new chapter of the blockchain world in 2020. This is what I
call the end of the beginning, I want to call Winston Churchill, one of my favorite characters,
right? This is the end of the beginning. Why do I say that, right? We are entering a new chapter.
Before this, right? I mean, Bitcoin shows up in 2009, right? And all the way until today.
It's still a great area, especially in the regulatory compliance side, right? A different
country, a different opinion on it, SEC still haven't figured out what really cryptocurrency
is. Is it a security, a currency, or asset, or whatever, a commodity? They haven't figured it
out yet, right? But going forward, right? 2020 and beyond, they are already spending a lot of
effort in defining this, to bring more regulatory compliance, providing guidelines on the VASP,
right? The Virtual Asset Service Provider. For example, FADA, the AML, the company,
at that organization, they're defining the standard for anti-money laundry, right? FADA
and OCC, this is the bank regulator body in US. ISACA and SEC think about that.
Is there a question?
And then the community is going to help more transparency, right? And when I look at this,
this industry, right? The moment it got acquired for blockchain adoption.
Is there a question on the line?
10x growth, right? Only happens when more blockchain adoption to the mainstream. And if we allow those
hackers are using Bitcoin and cryptocurrency, the long-term funding and all that, this industry
is going to fail, or it's going to stay like this, right? So that's why we need to...
I mean, some of you actually doesn't look like working with the government bodies and all that,
but I think this is actually helpful to make this industry grow 10x.
And what's next, right? After this Twitter hack 2020, I think there's three things,
three aspects to it. Awareness. Blockchain needs us to work as a community to fight
all this illicit use of cryptos. The technology side. One of the main reasons that a lot of
exchanges are still accepting those longer bitcoins or cryptocurrency stable coins and all
that, right? It's actually because they lack of the technology, right? And then technology,
as we are showing already, is making it possible to defend against those illicit use of cryptos,
especially with machine learning and AI, right? So we have, like I said, we have almost 800,000
transactions using Wasabi, the mixer, in 2020. Some of them are good, some of them are bad,
but at least we need to picture it. We need to kind of tell you, okay, it's actually a mixer.
And then different countries, different exchanges have different policies against it, right?
Compliance bodies also have different ways of defining it, right? For example, earlier this
year, Binance, they got caught up by the Singapore MAS, right? The Singapore MAS is
their regulatory body, like the SEC, right? Singapore. And then they kind of tell Binance,
hey, you cannot accept mixer if they're coming into exchange, right? Things are still starting
to change, right? So government has also realized that, okay, this cryptocurrency is going to be
getting more and more mainstream, right? How do we make it secure for everybody,
so more people can enjoy this great technology? And on the risk and security side, compliance side,
technology is also a big factor to it, right? It can be applied to preventive or post-incident,
right? Then the third one, regulatory compliance guideline from the public sector, right? FATF,
OCC, SEC, and things like that, and 5AMLB, right? That's from the European side.
Then, yeah, and then so I'm very fascinated by this SpaceX, right? That Dragon Crew, right? So
and then we compared it to this Boeing Starliner on the left-hand side. I call it pre-2020,
but then I decided to put another pre because this is a super vintage. If you look at the
dashboard, man, this is crazy, and how it's going to navigate. There's like hundreds of buttons
out there, right? If you look at our right-hand side, in contrast, right? Yeah, this is actually
the design that SpaceX had, right? So make super sleek, super easy to navigate, right? It's spent
a lot of time on the user experience, the UX side of it, right? To really make it accessible.
And this is also, I feel, is important, right? If very few people can only use very few tools
to get access, to understand what blockchain is, right? And that is a big problem for the industry,
right? Think about it, like the internet, right? We're using internet every day, right?
But on the blockchain side, look at it. How many tools do you use? If the blockchain explorer, yeah,
those are only good, those are like Wireshark, right? But then you have to have something more
accessible, more user-friendly for them. Even to look at those, this blockchain investigation
side of it, right? It can actually help you understand more of what's happening. And I think
that the general public, right, need to have a tool like that. Then, okay, so this is towards
the end of my talk, right? So as I said, right, as of now, we actually just launched the second
set of the challenge, right? Join the contacts right now. It's going to last until tomorrow
night, midnight, right? So you still have plenty of time. This whole challenge, as I promised,
is no code. You don't have to code up anything. The only thing you need is go to the website and
put those address there and then start clicking, start exploring, right? But as you know, as an
analyst, a researcher, you still have to have some expertise in that. But I mean, at the bare
minimum, you don't need any technical skills to be able to enjoy this technology, right? And
that's actually the main thesis when I talk to my team, right? This is one of the design principles
I want the engineer, the designer to build, right? To build into our DNA of the product,
right? And then, so we allocate over a thousand dollars worth of Bitcoin price, right? And so
we're in the middle of it. So the first set of the challenge was the Twitter hack, right? So you
can actually experience, you can be a detective yourself. Open the website, the contacts, right?
And then, yeah, check it out. And then now we are launching a second set of the challenge, which is
the ransomware that I just showed you. So that's the end of my talk. And yeah, so we got about
40 minutes and half an hour, 20 minutes. So Ajit, so we have a Q&A time.
And by the way, this is the website, right? This is the blockchainviz.net contest.
Okay, go ahead. Any questions? How many of you have tried the contest already?
What do you guys think? Any thoughts? Any feedbacks?
Yeah, let's see. Oh,
ah, I see. So there's a streaming on Twitch and also YouTube.
All right, okay. Okay, yeah. Right, right. Yeah, actually I can see that there's already a few
submissions, right? And then, yeah, so some of them already got it right, right? I think, yeah,
the first set of the challenge, right? Yeah, so we do have a pretty intelligent cloud in the room
here. But let's see. We still have, what, how many hours? We have one and a half days, right,
ahead now. So we just launched the second set of the challenge, right? So check it out. And
yeah, it's fun. And there's no any feedback and all that, right? So we're actually
expecting a lot of, we actually saw a lot of traffic going to the website and we'll just
upgrade the server and all that, right? So hopefully we can handle the traffic and all that. And
yeah, so thanks a lot for participating in the contest. And let's see which one's going to be a
winner. And it's fun. And it's fun that you can actually see those, you can become an investigator,
and all this intelligence and all that are already publicly available in the public ledger,
Bitcoin, which is great. We just need a tool to tap into it to make it more accessible.
All right, cool. Thank you, Ajit. Thank you, everyone. Bye-bye.
Thank you, Ajit. Thank you, everyone. Bye-bye.