Stephen: Have you ever wondered what really happened with the Buy Bit hack or why there's still so many hacks and exploits and DeFi? Well, we talked to the CEO and Co-founder of Blockaid. We have Ido in the building and he is gonna talk all about cybersecurity crypto Web3. We talk about agentic AI payments. The concerns with stablecoins.

They just dropped a report with Dynamic and others, so they have a lot to talk about stablecoins and what's happening in industry, including regulations and what companies and blockchain exchanges and crypto exchanges can do to better protect their honey bot of crypto. This is a fun episode with Ido.

He gives us all the lay of the lamb on what really happens with these hacks, and we're so excited to have Blockaid on the podcast. More excited to have them in the ecosystem. We even talk about how they can prevent maybe losses from pig butchering. Extremely exciting episode. I know you'll enjoy this one.

Stephen: This is your host, Stephen Sargeant Around The Coin Podcast. We finally have a Web3 security, my Love crypto compliance blockchain investigation type episode. Here we have the CEO and co-founder of Blockaid Ido. You guys just raised a ton do, and we're gonna get into that, but I wanna talk to you a little bit about your background.

Why don't you give us the, you know, elevator pitch. You're in New York, you're in that elevator, and someone says, you know, what's your background? What do you say to them?

Ido: I say, uh, I'm Ido, I'm one of the co-founders and CEO at Blockaid. Um, my background's in traditional cybersecurity. I spent a little over six years in these kind of like Israeli cyber intelligence units, and over the past three years or so, um, been working on Blockaid, uh, building, uh, tech to help prevent, uh, various different threats, uh, in crypto, um, targeting some of the biggest companies in the space.

Stephen: Now, you know, we've had so many episodes with cybersecurity folks, many coming out of Israel unit 8,200. Is that kind of the expected path when you go into like the intelligence of Thera Israeli government, that there's like a clear path for building your own cybersecurity firm?

Ido: I think, you know, uh, obviously there's like incredible talent that comes from like cybersecurity and so there it's just like a great, like founder market fit. Um. That's not to go and say that like all the companies there are, like incredibly successful or anything like that. But, um, but you do have this like melting pot of incredible talent, um, that, uh, has to go through incredibly hard challenges and I think that's a good formula generally for, for, for founding company.

Stephen: Now I've been in blockchain investigation since 2018. Cybersecurity has never been sexy in the industry or talked about. What made you decide to transition from maybe more traditional cybersecurity to go into Web3? Cybersecurity. At the time, it didn't seem that popular with the actual people using the, the, the protocols, much less, you know, regulators or governments.

What made you decide to be very early in the space when it came to cybersecurity?

Ido: So, so I think, you know, I, um. I cut my teeth kind of on, on finding vulnerabilities in cryptographic implementations. And so I've, I've, like, loved cryptography, not necessarily, you know, uh, like more traditional cryptography for, for years and years since I can remember. And then, you know, it was introduced to the space from team, from like team members that worked with me in, in these kind of cyber intelligence units.

And ultimately, you know, through, through getting introduced with them, you know, fell in love with the tag, fell in love with the space, you know, saw a ton of parallels to kind of like early internet, um, uh, infrastructure. And, and I, I don't know if you know this, but when you serve in like these cyber intelligence units, you, you, you work on like these air gap networks and so seeing kind of the, the inefficiencies of kind of working on.

An internet, right? And then coming to like, you know, this air gap network and then kind of drawing those parallels to, you know, having this maybe inefficient like traditional banking system. Uh, and then. You know, drawing those parallels to what it could look like, I think was like really, really appealing to me.

And then, you know, just became a user. Uh, and then I think in like 21, um, you know, like DeFi summer and all these different things, right? Like being a user in the space, seeing like the massive amounts of money that were deployed into some of these things. Uh, and that, and watching that grow, and then also understanding like how, like how severely, you know, unsecure, like some of these infra like piece of infrastructure are.

I was just like. There's no way, uh, something real can exist here unless it's secure. Uh, and so, you know, that was like the impetus for starting Blockaid. It just like has to be a reality if the space has to grow.

Stephen: Now, by that time, 2022 especially, the market had, you know, definitely cooled off from DeFi Summer. But there was already a lot of blockchain analytics, intelligence companies. The chain analysis were already huge, yet even market surveillance and things like Solidus Labs. Uh, not to mention cybersecurity companies in Web3.

How Born and Hacken, what did you and your founding team feel that was missing? Was it more on like, Hey, the DeFi space is not covered all that well? There's not a holistic view of things that can be done without being hired by the company. 'cause I feel like Blockaid is being used can be used even without these companies specifically hiring you just by the nature of your, uh, ability to track some of these trends.

Ido: Yeah. So I think like, you know, um, when we looked at the space, I think, you know, one, there were like some of these incredible companies, you know, you mentioned a few of them that were focused primarily on like, you know, tracking and tracing incidents after the hack happens, right? Um, and so, you know, obviously they were successful, um, but we felt like they were, like, if we drew parallels, like again, like traditional cybersecurity.

They were more so, you know, incident response, uh, pieces of software that enabled you to, you know, understand what's going on after something happens. Um. And then I think when we draw the parallels to, you know, some of the auditors that you mentioned in the space, again, these were like, you know, services companies almost like, and you have this in traditional cybersecurity as well, uh, that come in and kind of try to prevent these things from happening in the first place as well.

Um, but there wasn't any, any kind of software that looked at proactively preventing these kinds of hacks from happening that teams could deploy and, and work with them to kind of, you know, streamline and prevent these things from happening. All outright. And so I think that was like the impetus for it, right?

And the question is like, you know, where to build first, what to do, how to, how to go about, you know, uh, tackling the market in different ways. Um, but, but that's, that's, uh, that's generally kind of what, what we, uh, what we sought out to do.

Stephen: And now we're going into 2025. Why do you think, you know, before we get into the in intricacies of what Blockaid does so well? Why do you think institutions, users are still losing money? Has, you know, us as a society not held these protocols accountable for proper cybersecurity beforehand, proper security measures, audits, pen testing, like why are we still losing money, especially with so many options, including block eight.

Ido: So I, I think like one thing that like, um, we need to understand is that it's incredibly hard to do cybersecurity, right? Um, like even outside of crypto, again, it's like incredibly hard to go and do these things, you know, it's, just think about, think about it logically, right? It's much, much easier to attack, right?

You can put all of your time and attention on one specific point and push as hard as you possibly can versus like defense, right? Which is like, you have to, you have to be perfect all the time, everywhere, all at once, right? And so, you know, I think. Cybersecurity is like a massive, um, a massive, massive, massive point of, you know, um, friction for company or like point of, of, of, of loss for companies outside of crypto generally.

Right. Uh, and we should remember that. And even when there's like massive amounts of regulation and you know, when there's, when you, you know, there's a leak of some sort of data, you get fined and all sorts of these different things, right? That's still, it's, it's still, it still happens, right? And so. Now, you know, your question is like, why, why does this keep happening in crypto?

It will always happen in crypto, right? Like there's no, like, like it happens in every other industry, everywhere in the world, right? It'll always continue to happen. I think what's unfortunate is that it happens like all too often and all too frequently. Um, and I also think we need to remember that in crypto, um, like the, the.

The targeting is by oftentimes like state, state sponsored actors, right? That are super, super sophisticated and super, super, uh, talented and can devote tons of resources and the best minds in their respective countries, um, you know, to, to going and kind of performing these, these, these acts. Right? Um, and I also think like regardless of that, crypto is a more attractive place to go and try to, um.

You know, perform different types of, of, uh, of hacking operations or cyber operations for countries or for, you know, groups that are financially motivated, right? In a world where ultimately, okay, I'm gonna hack into some web two application or some traditional organization. Um, you know, and I wanna make money, what do I do, right?

So I have, I have data. I can steal data and kind of sell it. I can monetize, uh, you know, the theft of that data through Ransomwares, um, and then, you know, have them pay me. But ultimately, like, it is, it is a, a long operation that requires, you know, that is illiquid kind of right. By the time you're able to, to go and kind of finally hack into somewhere, something like creating revenue from that is like difficult in crypto.

It's instant. It's like super, super liquidate, lucrative. It's super, super liquid. Um, and so I think that also drives the, the, this kind of like, you know, makes our industry even all that harder to defend against.

Stephen: That's super interesting. Yeah, you raise a great point, right? Even if you do a ransomware, you have to hope that they pay, you still have to, you know, kind of respect the fact that if they do pay, you're supposed to give them their access to their data back. There's a lot of, you know, back and forth, right?

Where law enforcement and others can get involved. Uh, to your point, you, you hack an exchange, you get the private keys. And then your only trouble at that point is to off offboard or off ramp that crypto into cash. And sometimes you don't even need to do that. You can just keep it into crypto and use it as collateral.

Uh, for other things. I'm curious. We had Raz on the chain Analysis podcast last year with Ian Andrews and you know, during the time of the podcast there was actually the huge ledger SDK wallet infrastructure hack. Blockaid was one of the first to report this on Twitter. Can you explain how you're able to identify these types of attacks?

Sometimes before even there's losses involved.

Ido: Yeah, no, it's a great question. So I, I think, you know, today we sit in a lot of places across the stack, right? We sit directly in line, you know, simulating and validating transactions inside of different wallets, uh, and signing infrastructure. We sit passively monitoring kind of different operations on blockchains, working with different protocols to prevent different kind of types of exploits and hacks.

We look at both what we call high value incidents, right? Cases where millions, hundreds of millions of, of dollars worth of assets are at risk, and what we call high volume incidents. Things that you know, are of lower dollar denomination, but happen really, really frequently. Um. And so, you know, when you think about where blocking sits across the stack, we have a ton of signal, um, to everything that's going on all the time, right?

And so specifically, right, the ledger connected attack, um, you know, all of a sudden we start seeing like our systems start seeing right? Malicious transactions coming from otherwise legitimate domains. Right. And then we start, you know, fingerprinting how those transactions look like, understanding that they're all associated with the same kind of group.

Understand that this is all happening all at once. And then, you know, we get these kind of alerts firing off and, and, and a lot of our kind of, you know, machine learning models and kind of heuristics and automations that kind of tie into everything that we do, uh, enable us to go and figure out like, okay, great.

There's like this incident happening, right? And unfolding before our eyes. I think, you know, we had, um, we had seen similar cases, right? There was, uh, there was one a couple, uh, weeks back, um, uh, targeting kind of very popular NPM repositories, uh, if you recall that. Um, and so the cases like these, these forms of like supply chain attacks happen all the time.

Um, and we're able to see a lot of it just because we're deployed at the. Across, um, you know, so many wallets and so many different kind of piece of infrastructure across the space, uh, that enable us to really be the, the first and, and, and the best at kind of uncovering and detecting these kinds of early warning signals, um, very, very, very quickly.

Stephen: How fast is the response? You know, zero shadow, uh, blockchain analytics or intelligence company just came up with an initiative because the instance re responses for some of law enforcement around the world is too delayed to handle some of these attacks that are happening in your point, in real time when you're making these alerts and sending them out to either customers or the industry at large.

Are you seeing the incidents response times closed down? Like we saw the Colonial Pipeline. They didn't realize they lost their funds for, I believe, $600 million for almost a week. Are you seeing these response times now? Are their teams working 24 7 and SEAL teams coordinating to help stop these attacks once, you know, maybe the first transaction is done.

Ido: So, so I think like, you know, um, um, different groups in the industry have been able to kind of, you know, I think honestly make, uh, significant strides forward. Um, I think ultimately you will always be in this position where, you know, I think, uh, you're, you're racing between someone who, who knows something ahead of you.

Um, and so, you know, responding with, with a person in the loop is oftentimes, you know, what will, will is, is, you know, necessary but is always, we're always gonna be racing against, against, right? That, and so I think ultimately with, with a lot of these things in place, we have to have like automation and, and have that ability to kind of proactively prevent these things from happening.

And in some cases, you know, we definitely. Are deployed and have these capabilities of doing so. In other cases, you know, yes, we're like alerting different groups, you know, uh, we work closely with Zero Shadow, with SEAL and others to kind of go in and prevent these things, uh, and respond to them kind of as, as fast as humanly possible.

But it

still

Stephen: And with a.

Ido: humanly possible only right.

Stephen: With a lot of the protocols you work with, what happens, right? Let's just say you identify something, right now there's an alert. Do you have the authority to trigger, to stop the protocol or you know, the kill the, the infamous kill switch that some of these protocols have to stop all transactions until they can figure things out.

Like, can you walk me through an average scenario or Blockaid alerts. Like, talk to me about what the customers see, what their next action usually is. Give us a common scenario so that people are interested in bringing on Blockaid, understands how it works.

Ido: So I think, again, like Blockie does a lot of the space right now. Right? Right. And so, you know. Some of the different attacks you're talking about are, you know, associated with like smart contract infrastructure and in those cases, yes, we have this capability to go and kind of, you know, leverage either a role with special permissions that were granted or things like that to perform a limited operation that, you know, can, can isolate this kind of incident in an automated way.

Right. Again. Oftentimes we try to scope this down in a least privileges way, uh, to make sure that we're only able to kind of really, really do the thing, um, that, uh, that we're, that we're, you know, embedded to do. Um, in other cases, oftentimes we're embedded pre-transaction, right? So we're simulating the transaction before it's actually happening, right?

You know, there's different incidents, you know, like what happened with kiln and Swiss Borg, um, you know, a couple weeks back where, you know, that is a transaction that someone facilitated, right? And so being in a position where you're able to simulate and validate that transaction ahead of time, um, you know, you don't need, you don't need any kind of special privileges.

You just need to kind of be, uh, a point of friction in that operation to go and say, Hey, stop, like, review this for a second. Right?

Stephen: And you know, one of the solutions I see that's particularly interesting, especially, you know, you're based in New York. I'm sure you know there's. The unit there in Manhattan and Brooklyn around the digital asset teams, pig butchering, romance scams are the all time high. But you have a crypto fraud prevention tool, which in effect, you know, makes it difficult for these transactions to even take place.

So versus, you know, trying to recover these funds. Billions of dollars being milked out of, you know, north American and western countries. How are you able to stop the frauds from taking place and, you know, keeping these large sum of funds, sometimes people's life savings from being parted with them.

Ido: Yeah. You know, I think it's a great question, right? Um, so, you know. I think there's like this, um, um, the way that we look at things like generally, right? I talked to you about, you know, we have this ability to detect what we call high value incidents and high, uh, high volume incidents, right? I think this would, we would consider kind of everything to do with pig butchering and fraud.

Generally, that kind of takes place from these exchanges. In what we call this bucket of, you know, um, um, high volume kind of incidents, right? Things that happen all the time. Uh, usually low dollar denomination. Sometimes we see crazy amounts of money that are leaving like individual users in these cases as well, which is like super unfortunate.

And we do a lot to go and kind of build different heuristics and models to ultimately identify these types of transactions before they happen, right? And so. Again, right. Um, um, we use different kinds of probabilistic models. We scan the entire internet. We scrape tens of millions of new websites every single day, uh, in order to kind of, you know, find these different types of sources, um, you know, scraping different social media platforms, uh, and then running different types of on chain heuristics and models to go and say, okay, we understand these patterns even though they've previously been unattributed and unlabeled.

In order to kind of, you know, create these risk signals to potentially prevent, um, our end users and our customers from ultimately, um, you know, uh, interacting with, uh, uh, with these different types of nasty things.

Stephen: And what trends are you seeing or what, like can you put a dollar value to like, Hey, this is what we've seen, this is what we've been able to alert or notify or potentially stop from, you know, these scams from taking place. Is there any kind of trends that you're seeing? Like Bitcoin ATMs I think is a big one in the industry that people are calling out.

Ido: The numbers are huge. Right? And, and I think there's, like, there's, there's, um, the, there's all these different thing things popping up, right? I think like the case with Bitcoin ATMs and social engineering is like really, really interesting because, you know, ultimately, um, when money, you know, the, the points of friction that you have are generally around, um.

You know, various different, um, um, various different like financial institutions that ultimately a user goes in withdraws, cash goes to a Bitcoin ATM, and then just like fires that away, right? We, we see that uptick definitely, definitely, um, come about. It's oftentimes hard because the financial institution that's like, you know, then a user reports their fraud to is like, dude, you took out cash, right?

Like, what, what do you want us to do? Um, and so. Uh, and oftentimes like the victims are, are, are, are, you know, very adamant about wanting to do these things, right? And so then you're, you're, the point of question is like, okay, great. Are the Bitcoin ATMs like liable for facilitating these different kinds of things?

Obviously today they're not, um. And then I think, you know, uh, um, so I think there, there's definitely like, you know, a lot of these different kinds of trends and attackers move like really, really quickly. And by the time, you know, some of the different kind of stop gaps and uh, and precautions that are put in place are there, uh, oftentimes, you know, they, they move away, right?

And so I, but I think this, this ties in highlights like an even bigger trend, which. You know, generally Fraudsters move to the point of least resistance, right? And so you always have to have you asked, right? Like, why do we see all these different hacks? Why does these things happen all the time? Right?

They move to the point of least resistance, right? Wherever there is, there isn't enough kind of friction preventing them from operating. They will just. Be, act right? And, and, and kind of, you know, spread and grow and kind of continue those operations. And so, you know, there's always gonna be this kind of chase and arms race in terms of like, okay, great, we're gonna raise some, some, we're gonna build some kind of infrastructure here that's gonna prevent it and they're gonna move.

Trust me, they'll move and then they'll move again, and then they'll move again. And it'll always be this kind of race. Um, but I think, you know, that's what, that's what makes our job interesting and that's what makes the space kind of interesting. Um, and, uh, um. And the hope is that eventually we make it so difficult that only really the most sophisticated kind of actors are able to continue to operate.

Stephen: Speaking of sophistication, what do you see now? Like, is it more, hey, there's a vulnerability. We've seen it deployed against certain protocols and just not all the protocols have found a, a, a patch work for it and solved, or is it just completely new sophisticated attacks that even from a cybersecurity lens and even, you know, the protocols are putting in the most amount of, you know, compliance and auditing measures?

Have never seen before, which like if you had to give it a weighing, is it absolutely new things are coming out using ai? Or is it kind of like the same old trick, just, uh, to your point, they're just going to places with lower friction.

Ido: You know, I think it's a combination of both, right? It's not like, um, and, and I think generally, like again, when you're focusing and talking about like protocols and different kind of cybersecurity, you know, vulnerabilities associated with them, generally we're talking about things that are happening at the application layer of crypto.

Right. And so these are application level, like logic, like vulnerabilities generally, right? And so as a result of that. I think it's only safe to say that these things are, you know, unique to every application. Now, oftentimes they leverage a lot of the same techniques, right? Um, you know, there's a problem with permissioning, right?

There's a problem with, you know, um, maintain, maintaining, managing liquidity. There's a problem with permissioning around certain, uh, um, uh, you know, certain key and off chain infrastructure. There's all these different things that obviously, you know, when you take them separately, right? Repeat. When you put it all together, it's a specific vulnerability that's enabling a user to kind of, uh, you know, extract value from this kind of application in a really specific way.

And so, and, and, and again, even drawing that parallel to like traditional cybersecurity, right? Application level security is, is a big problem, right? That is, that is, uh, that is harder to solve, right? When you have something that is like more specific to a specific application, um, it's generally harder to solve as opposed to.

Infrastructure level, security misconfigurations or things like that. Um, I hope that answers your question.

Stephen: It, it does it. It actually made me think of another one. Are you surprised by society that we haven't demanded more security from some of these protocols? Like I can imagine, like with a bank, like we'll put our credit card information anywhere because we know we can call the bank and they'll reverse the charges.

With a lot of these Web3 protocols, even the ones that are hacked. Somehow the, you know, the protocols are able to make them whole, as you probably know more than me, there's a lot of them that don't come back from these hacks and that money's gone forever. Are you maybe shocked that these users aren't being a little bit more selective of what protocols they go onto?

Like, Hey, if I'm gonna use a protocol, I want something like block A that can detect something happening before you know that transaction's even, uh, facilitated. What are your thoughts on that? Are we being a little too willy-nilly with our crypto?

Ido: so, so I think like, so two things here. One, uh, the first is like, you know, what is, how does the industry look at this? And then maybe two is like, more so regulation related. But, but I think, you know, one. At the end of the day, right, as an industry, we're building financial infrastructure, right? And when we build financial infrastructure, like we as consumers, you know, um.

Obviously, you know, uh, Stephen, you're deep in crypto, but like you can put your non crypto hat on for a second and when you think about, okay, where am I gonna put my money? Generally the major differentiation is like, is trust, right? You know, you use one bank over another, not because, you know, one gives you higher yield generally, right?

Uh, the products are pretty commoditized when, when we think about it, right? Generally, it, it's a matter of trust. Like, will I show up the next day? And will my money be there? And oftentimes, like you think about even like the, the, you know, you know, you have kids or you think about the banking products and the financial products that they're gonna use, they're probably just gonna use the same bank you use, right?

Because like, you know, it, it's like this level of trust, right? This work for my parents, it'll work for me too. It'll, you know, and so on and so forth. And so I actually think that when we think about like financial products and infras and the number one thing that they care about is, is that level of trust, right?

And I think a big part of that level of trust. Is security. Maybe not a hundred percent, but a lot of it is, is that, is that level of security. And so, um, and so ultimately I think cybersecurity is a differentiation for a lot of these products, right? Um, whe whether, you know, it's regulated, whether users think about it, like, you know, um, knowingly or not.

And I think in the industry, right? We, we thought, we talk about ness often, right? Like, how long has it been since the protocol has been hacked? Um, or how, how many days has it existed without it being hacked, right? Um, and I think like literally the ness of a pro, of a protocol or, or a smart contract is its, is its differentiation, right?

Like I think we all trust ave. We all trust Uniswap because these are very Lindsay protocols. Um. And so, uh, and so to maybe the, the first part of your question is like, um, you know, I think already it is like a differentiation, and then I think it's just a matter of like, you know, we as users and how do we internalize that?

You know, you may not think about it as like cybersecurity, but you, you generally think about it as like a brand you can trust.

Stephen: feel we probably in the crypto, and especially in the DeFi space, look at yield a lot differently than we do in the judicial space. I think we're a lot more, we're a lot more risky with yield, I feel in the crypto space

Ido: I feel like we've learned and grown a lot, right? Like, you know, if you don't know where the yield is coming from, right? Uh, is like a saying I hear much more often than I did.

Stephen: If they use the word yield too much in their, in their, in their marketing, and it's not staking, you might be in for a surprise. Now you're working with some of the biggest law and the largest wallet providers. That makes a lot of sense. But you work with the exchanges too. What are the exchanges using in regards to your services?

Like the wallet service providers are a little bit more decentralized. It makes sense that they're going to use a tool like yours, but the exchanges, where are they in, you know, implementing Blockaid?

Ido: Yeah, so I, I think of exchanges as like, these, like massive crypto businesses. They do a lot, right? Like, we think about exchanges as like, great, it's like an on-ramp. And we, and they have an order book, but honestly it's like much more complicated than that, right? Many exchanges have trading desks, many exchanges, you know, have, like, obviously, you know, cus like massive custody businesses, many exchanges, you know, have some form of interaction with like, on chain operations.

Many exchanges have, you know, self custodial offerings and so. The answer is like, generally like what do we do with exchanges? Everything we do with everyone else, um, there's just like these massive like crypto businesses that, that like use us for a bunch of different things. Right. Um, uh, obviously like, without getting into too much specifics of what we can, can and can't share with like specific customers, but like, you know, um, generally they use us for, for everything blocking.

Stephen: And I am curious, you know, when I think of like custodian crypto. And you know, wallets, exchanges, you say they use you in every different part. Where can law enforcement use, because I'm thinking like law enforcement, this would save law enforcement a lot of headache time, resources, and I know it's tough to get government contracts for any organization, but is law enforcement something that is approaching you with like, Hey, we see this rising pig butchering problem.

How can we either mandate or even regulators, like how can they mandate. You know, crypto businesses, blockchain businesses, to utilize tools like blockchain.

Ido: So, yeah, I think, I think it's a great question. And we spend a ton of time in dc I'm actually gonna DC next week. Um, we have, uh, we have uh, uh, a member of the team who's there, who's based there. Um, and so we do a couple things, right? One, we, we spend time with regulators talking about, you know, cybersecurity, um, on both sides of the aisle.

Um. We spent time, you know, with, with the White House that put out kind of a, uh, a, an executive order. This was a, a couple months back, um, talk and, and had, you know, a couple pages focused on cybersecurity and what you could do. This was the first, you know, real kind of beginning of legislative work that you know, isn't focused on kind of, you know.

Tying crypto to the Bank Secrecy Act and other things like that. But rather just talking about, you know, how we can secure this infrastructure in the first place. I think generally right, as like an industry. Um, and you know, you've, you've definitely been like a proponent of this and talking a lot about this.

We focused a lot on what we do after hacks. And we've, and we've, you know, and I think it's so, it's on one hand it's so, it's so awesome to do that because like you can't really do that in any other industry. It's like a feature of, of, of, of blockchains that is like pretty incredible to go and see exactly what's happening.

Um, you know, after these like massive hacks and like watching hundreds of millions of dollars move before you, your eyes, it's like actually pretty like crazy that you can do that. Um. And, and I think we haven't focused enough on how we can build things to prevent these things from happening in the first place.

Right. Um, and, uh, and so I think like spending time with regulators to make them feel like, you know, listen, it's not, crypto is not just about illicit activity and illicit transfers and illicit finance, right? And preventing illicit finance and all these different things. It's like if we prevent the downstream hacks from happening in the first place.

We have a, a much smaller illicit finance problem. Um, and so and so it's talking to 'em about that, educating 'em about that. Um, that's like one part of, part of the work we do. And then two is, you know, obviously. We, whenever some of our customers are involved, whenever folks in the industry are involved, um, that aren't our customers, um, you know, we have a ton of information, a ton of data about these different things that we work with law enforcement to, to provide to them.

Um, uh, you know, not even as our customers, but just as like, you know, uh, um, uh, working with them to try to, you know. Stop these things, right? Honestly, I agree with you that many, many times, you know, they're a little bit too late, a little bit too responsive. Not because they're not great, but because they're humans.

Uh, and, and, and these things like happen at the speed of, at the speed of, you know, money moves and crypto at the speed of data.

Stephen: And what's interesting about crypto, you mentioned like what happens after a hack and because crypto addresses are not PII for the most part. Everyone can join in, in protecting their exchange and work together in collaborative. Like if ito's bank account gets hack, like that's where it stops. Nobody can see where the funds are wired to or transferred.

Nobody can investigate. Like we have Twitter, you know, Twitter investigators probably doing some more work than some law enforcement in the us. Uh, just because they have more capacity to do it. They're doing it for front, for the most part, and obviously to share on YouTube. But that, that can't happen in any other, you know, investigation that fall, that you know, the flow of values

Ido: I agree.

Stephen: I find is super.

Ido: I, I agree. It's like, it's like, I think it's like almost like something magical, right? Like, you like viewing like this capabil, like being able to view everything that's happening kind of on chain is like a beautiful thing, right? And, and like a hundred percent right, like banks, right? Everyone has their own ledger.

What is a wire? Well, I, I like, you know, I remove like 10 from your balance and I add 10 to someone else's balance, right? Like no one else can see that except the folks that the wire went through. Not nothing else, right?

Stephen: Barely the sender and receiver can see it. 'cause they always have to get on the phone with the bank and ask what happened to the wire. So we're going into 2026. We're, we're not out of the woods yet. 20, 25. There's still a lot of time. Give us the lay of the land, like what's the three biggest attack vectors.

That, you know, the Web3 community has to start paying more attention to at the end of this year and going into 2026.

Ido: know, I think the number one, um, most obvious one is what we would consider blind signing. Right. It's just, you know, um, it's the easiest thing that you can go and mitigate. Um, it's, uh, um, it's, it's been the largest proponent of, of hacks this year to date. Right? And, uh, um, and it's just, you know, uh, um, and it's like super preventable, right?

It's like, uh, you just go in, if you simulate transactions, if you validate them before execution, if you have, you know, you build out really tight policies around those. You're good. Like these things don't happen anymore. Um, and so I think like things like buy bid, things like what, what happened with Kill and Swiss board and all these different, uh, examples that have taken place like over, um, over the past couple years.

All of these are super, super preventable if we just like focus on blind signing. Um, and so, uh, and so I think that's, you know, obviously the number one, the number one, uh, uh, part of this, right? I think.

Stephen: Can I ask you, I want to interrupt you. How much of that, 'cause I, there's been a lot of mixed stories around buy bit. How much of that is like Web3 versus like web two, infrastructure, sophisticated social engineering, that this happens to happen to a Web3 company?

Ido: so I, I think it didn't just happen to happen, it didn't just happen to happen to Web3 company, right? It happened to open three company because that Web3 company has like, you know. Crypto to steal, right? And so, uh, um, so it's heavily targeted, right? It's not just like how, oh, whoops, I, I like stumbled upon this and this was like the best opportunity i, I could have, right?

Like, no, no, this was super, super targeted. Now. Like, you know, I think one thing that we all forget about is like Web3 security imports, web two security. Like, it's, it's, it's, you have to be like buttoned up across the stack, um, for, for this thing to, to work, right? Um, but I think the difference is like, what are the crown jewels and like, cybersecurity, traditionally we talk about crown jewels generally.

Crown jewels for an organization, arts data, um, arts, data arts production applications. Um. But, but primarily like it's data. Right? And so when you think about like a threat actor that's coming into to, you know, your organization performing some kind of sophisticated attack, what do they wanna steal? Right.

Generally, they're not gonna try to make you wire some money out. 'cause as soon as that happens, you'll see it, you'll call your bank up and you'll, you know, you'll, you'll claw back the wire. They'll try to steal your data. They'll try to, you know, encrypt your data. They'll, they'll try to do all sorts of these different things to either, you know, install ransomware or go and sell, like, you know, records on the internet.

Right. And so, and those are like the chrome jewels there when it comes to like a crypto exchange. When it comes to any crypto business, the crown jewels are very obviously

like crypto.

Stephen: The private

Ido: Right Crip, it's like it's access to the, the funds, whether that's by compromising private keys, whether that's by compromising signing infrastructure, whether that's by, you know, executing some sort of, uh, vulnerability like through smart contracts.

It's, it's, uh, um, it's, it's ultimately, you know, those are the crown jewels and so that's what makes it different, right? It's like, you know, one in one, I steal money in the other, I steal data, or I monetize data in some kind of way. Um, and so, you know, a hundred percent agree that buy bit is a sophisticated web to hack.

Period, full stop. A hundred percent agree. But if you had controls and mitigations around the, around the, the, what we would consider like the crown jewels, that wouldn't matter. Right?

Stephen: Right. I see you're saying the, the attack might have happened on the web two side, but you know, the protection should have been there on the Web3

Ido: Exactly. And if the production was there on the Web3 side, you could, you could do all you want on the web two side. It doesn't matter. Similarly, you know, to how organizations go and say, you know, you can hack all my, you can hack everything all you want, right? But if I have super tight permissions on this like super critical database or on this super critical application, that is like my most important thing in the world, none of it matters.

Hack everything you want, right?

Stephen: Right. What else? What else are you seeing? Uh, like has there been a rise in any sort of activity recently versus before? Like what else are you seeing? Or is it like just a, the same old attack with different year?

Ido: Uh, you know, I think there's obviously like a rise. Uh, you know, I think, um, uh, what we're seeing is, is, you know, um. I is generally that, you know, because of market conditions, folks want to ship more and they wanna ship faster and you know, obviously that, that makes, that leads to more mistakes, right? This is, by the way, true outside of just our industry, we're seeing this kind of, you know.

Across different kinds of AI products or different kind of products, right? The market conditions make it frothy and make people wanna ship as fast as humanly possible. And, uh, um, and things are, you know, half baked. Uh, and so, you know, that leads to, to, to, to security vulnerabilities.

Stephen: I am curious, like I know from a compliance officer angle, they're usually brought in, not usually, but in some projects they're brought in at the end, like legal's brought in at the end versus at the table. You never really hear about the CISO though. Where are they brought in, you know, from like a product design, products ready to ship Are the CSOs at the start of those conversations?

In your experience, I'm assuming you interact with probably a lot of CSOs at these Web3 companies. Where are they brought in? Are they brought in too late or are they brought in at

Ido: It is a good question. I, I, I think people in crypto generally tend to be really, really security forward, right? Um, most developers, most product teams think about security from the get go. Now, if they bring in their security or CISOs or things like that, often, oftentimes, you know, honestly, security is an afterthought.

It's always an afterthought. You have to build an application first or understand like what is the thing you want to build, and then you focus on securing it, right? Uh, I think, you know, uh, um, uh, it's always a bandaid, right? It's always, it'll always be a bandaid. It'll always be like the thing that you put on after, right?

To make sure like that, that the thing that is valuable and generates revenue for us, uh, is, uh, is continues to function. It doesn't break on us, right? Um, because, and it makes sense, right? If I was a developer, right? Um. I would focus one on kind of finding a market fit, building what the thing I want to build, and then I would focus on building out all these kind of, you know, bigger security apparatuses after that.

Um, and so, and so generally, I think, you know, in secure, in, in crypto actually, um, it is actually more forward thinking than you would expect. Uh, and folks are kind of brought in earlier. Um, but it's, but your comment on compliance is interesting. Uh, I, I, I would argue that probably in crypto compliance. Is is like, uh, is brought in later than it is in traditional finance,

Stephen: Very rarely. Very rarely they try to avoid it until something's right. I've heard too many stories. I'm curious, I see a lot of compliance, like as you said, when the market gets frothy, lawyers, compliance officers start charging whatever they want in Web3. 'cause there's, you know, not a lot of supply out there.

'cause cybersecurity's not really regulated in the sense for the most part. Now we're seeing things like Dora in the EU where you have to put in certain secur, like you have to use certain vendors that are prioritizing certain things. Do you see there a mar, is there a market for cybersecurity professionals in Web3, et cetera?

Like has this become like the hot demand for per uh, personnel?

Ido: I think, you know, we talk to companies all the time. There's definitely like a market for hiring, you know, uh, uh, folks like that are with a security background expertise, like in, in, uh, uh, in crypto. There's definitely a demand for it. If it's more than compliance officers, gosh, I don't know, man. Um, but I think, uh, I think there's definitely a demand for it.

I think it's definitely, you know. If, if I was, you know, a founder building an application in crypto, it'd be one of my earlier hires, right? Like, uh, you know, you, you have to build the product. You have, you have the product team, you know, maybe you, you, you have like a go to market function, but after that you should probably pretty much like bring on a security, a security professional, and maybe like a general counsel or a compliance officer or something like that, right?

I think those are like the next two logical things for any team building in the space.

Stephen: You mentioned ai, you know, everyone's coming out with stablecoins. The agentic payment race has now started and the utilization of stablecoins for micropayments, especially, we're seeing, you know, autonomous cars. What are some of the concerns you believe, especially with agent ai, uh, especially those that are leveraging crypto payments?

What are your thoughts around where cybersecurity ends or where Blockaid, uh, gets intertwined with this new ecosystem of payments made by robots?

Ido: So I was actually a, a like agentic, uh, payments, uh, skeptic. Uh, if you asked me that like a couple weeks ago. And, and what really kind of like, like, uh, you know, um, agentic payments pilled me, if you will, uh, was the announcement that Cloud Flow made around paper, paper crawl. I don't know if you saw that.

And, and kind of, uh, they're, they're joining kind of X 4 0 2 and, and everything there. I think like that, like that made everything click for me, uh, in a way that it didn't before. Uh, so I'll be honest that I wasn't, I like wasn't, uh, I wasn't on the bandwagon until now. Um, and, and now it makes a ton of sense for me, right?

So like, I think. Again, when we think about cybersecurity and what are the risks are and stuff like that, we have to first think about the use cases. What is actually, like, what will this actually be used for? And I think like, you know, 4 0 2 I think is, is a, is is, is a really clear, clear path to how robots pay each other in an internet native way.

Um, and, and I don't know, like, uh, I can, I can dive into it and explain it if you want a little bit more. Um, but I, I think like, generally, like when you think about the risks there, like what happens there is all of a sudden, okay, great, so, so now I am, you know, this, this piece of software, you know, maybe I'm say agent and I'm crawling the internet and I have to pay sites for the data they provide to me, right?

And so now all of a sudden is, okay, what if I pay you and you, and you screw me over? You don't gimme anything. Right. Um, so does the ai, does the AI agent learn from that? Does it not learn from it? Do other AI agents learn from that thing? Um. Maybe, you know, I paid for it and I got something and it wasn't that great.

Maybe the AI agent, you know, bought that information and then used it in a nefarious way. Maybe they did all sorts of nasty things there, right? So you all of a sudden, you know, start having these like, forms of fraud on either side of these payments, right? Whether that's the merchant that's defrauding an AI agent, or, or whether that's an AI agent, defrauding a merchant in some kind of way.

Uh, now obviously payment still goes through, right? These are atomic, um, you know, uh. Uh, transactions that can be reverted, right? So we don't have kind of the clawback or kind of chargeback risk that we would in like other kinds of, um, payment, uh, uh, rails. But, but we do have, you know, definitely risk, especially on the merchant side, you know, defrauding like these AI agents in all sort of different ways.

And so I think like that's where some of the risk comes in and, uh, and that's where kind of, and, and blocking basically already does that today in self custodial wallets. Um, and so, and so that's kind of where we fit in. I think in the, in the, in, in whatever the world will look like in the, in the ente kind of payment space.

Stephen: You know, you mentioned something in the previous, uh, discussion around like web two infrastructure. And you know how we protect better. Web3, we saw with Coinbase, they basically bribed their, you know, their outsource team to give over data. How do you better protect Web3 infrastructure? You mentioned like that's what we have to do.

Where's the focus there? Is it access? Is it multi sig? Like where would you be focusing if you're a protocol or an exchange on how to better protect yourself from these types of scams that happen off chain? Pretty

Ido: a hundred percent. So I, I think this goes back to like our, our conversation around like, you know, um, um, you know, what are like the, what's the number one issue, right? It's like, and, and so I think like, um, and, and I call that blind signing, but I think another, another way of phrasing it or looking at it is like, okay, so you have, um.

This notion reality of like, okay, is my key secure, are my key secure. Right. And I think generally when we look at all these different hacks, it is not that someone steals a private key, right? But it's, it's rather that they are able to convince that key in some kind of way. Whether that's a human in the loop, whether that's a human in the loop that installs some sort of software that does some sort of thing to sign a transaction that's not supposed to, right.

And so I think generally as an industry, we've become pretty good at. Key security generally, right? It's

storing the actual private key, uh, whether that's through multisig, through MPC solutions, through cold storage, we've become pretty good at that. The risk and level on top of that is key misuse, right?

It's generally like, is that key being used for the thing that it should be? Used for and, and generally I think that's where the number one, like, that's where all the risk is, right? Um, even when you look at like these scams and pig butchering and stuff like that, ultimately it is a user that is misusing their credentials to move money in a way that that shouldn't happen, right?

Because they're being, you know, social engineered or like you're hacking the humans, right? In the case of Vibe It, right, we're hacking some kind of interface that's convincing an, that's convincing us to sign something that we probably shouldn't, right? In the case of, uh, of kiln for example, we're convincing again, some kind of interface to go and kind of through an API to go and kind of, you know, present this kind of transaction in a negative way.

And there's so many more cases like this. Right. And so, uh, uh, and so I think that's, that's probably the number one thing. There's obviously, you know, other risks and areas, right? Um, even in the case of, for what it's worth, like there was a, the hack on GMX, right? That was, you know, an off chain keeper that was able to kind of propose a malicious transaction.

So obviously there is the risk of smart contracts as well, you know, receiving malicious transactions and executing kind of code that they shouldn't, that, that, you know, they were not intended to execute, right? And that is definitely a risk and monitoring for that is definitely a risk and like super top of mind.

But I think the actual larger attack factor today in the space is what we would call key misuse,

Stephen: How confident would you be if you're an average user pressing that connect wallet button? Like on a scale of like one to 10? Because we're seeing a lot of these attacks that have to do with that, you know, the SK SDK, you know, old exploits. Like how confident do you think a consumer should be, 10 being the most confident?

How confident do you think the average user should be in connecting their wallet to anything out there, including purchasing NST, NFTs, you know, signing into a new protocol or a decentralized social media.

Ido: Well, if they're using a wallet that's powered by Blockaid, they should be really confident. Uh, you know, um,

Stephen: Oop.

Ido: there you go.

Stephen: Your company in Dynamic who's, you know, both. Both public key Podcasts alumni, you just launched a 2025 Stablecoin playbook, which provides guidance, you know, for new entrants getting into stablecoins. To your point, when the market's frothy, everyone's trying to get into crypto. Just similar to when everybody in the pandemic had to come online.

You know, that's a scammer's dream where inexperience has to do something in the digital world where they've spent most of their time trying to, you know, find exploits and vulnerabilities. Can you provide maybe some key insights and contributions that you had to the report?

Ido: Yeah, I think generally, you know, we, we, we, we spoke well, one, I, I urge people to read the report. I think it's a really, really great report. Um, I think it's awesome. I think more companies should do stuff like this, you know, highlighting some of the things that they see. I think, you know, for us generally, like some of the things that we kind of talk about a little bit.

Are, you know, the security concerns when it comes to whether being an issuer, a user of stablecoins, uh, a consumer of stablecoins. Um. So I think, you know, whether, you know, either way you kind of flip, uh, uh, the market. There's different kinds of, um, players that do different kinds of things and they have different risks associated with them.

But at the end of the day, it's not too dissimilar than just interacting with crypto generally. Right there, there, there, there is nothing new here. Funda. Um, and so it's the same kind of things, right? It's making sure you know, you have good access control around kind of the smart contracts that you're deploying and monitoring around those functionalities that you're looking at specific in variants that you're building different playbooks and kind of pause functionality that that can be deployed when kind of issuing those that you're protecting, the different kind of contracts, the different kind of wallet addresses that are able to, you know.

Mint more assets, move assets in different ways, control the treasuries in different ways, sign transactions that are risky, uh, and so on and so forth. So it, it's funny, right? Like I think stablecoins change everything, but from a technical perspective, they're, they're more of the same, right? And so, uh, um, and so, you know, obviously we have our stance in terms of like what it is you, as someone kind of, you know, playing in the stable Coin space, can use Blockaid four.

Um, but ultimately when you like double click there, it's a lot of the same.

Stephen: I didn't think about that minting function. You know, if something that gets attacked on the minting, if you can, you know, create something that has a market value and just have an unlimited amount of minting capabilities that could be problemsome. You know, I'm assuming you're foiling a lot of these big scams.

You know, you're protecting the ecosystem that makes you a target, especially when you start thinking about nation state sponsored actors. What is your biggest fear or risk, a Blockaid from like an attacker perspective?

Ido: Yeah. So one we have, uh, we built out like, uh, um, an in-house security team. Um, and, and so, uh, um. And so we take this incredibly seriously, right? Um, some of our backers are some of the best cyber early stage cybersecurity investors. We dog food a lot in the kind of the solutions inside of our portfolio. Um, I think, you know, one level of differentiation that we have across, you know, others in the space is just how seriously we take cybersecurity internally, right?

Um, and so, uh, um, you know, we have, uh, um. We're, we're, you know, we focus on this like all the time, um, you know, and, and, and spend a ton of time thinking about it and, uh, uh, and have, and have folks like full-time that are focused on our internal security.

Stephen: How do you manage the trade off? You know, anytime you go cybersecurity compliance, investigation intelligence. You're always gonna get the privacy, uh, debate and pushback. How do you balance, you know, the need for privacy and decentralization, but also the need to provide, uh, threat visibility Because it's one thing to be libertarian, but it's another thing if you don't have any crypto left in your, you know, wallet.

'cause it was drained. So how, how do you balance both of those ethos in the ecosystem?

Ido: So, you know, I think we are very much like an unop opinionated service provider, right? Like we will do what our customers want us to, right? And if our customers want a really privacy centric solution. We have that we can ship it and we can, and we can enable them to do it. There's, you know, there's trade-offs and we'll tell them what those trade-offs are.

Um, but I think, you know, we, we, we, we don't take kind of a, um, a stance on kinda what we do. I can tell you what most of our customers do, but, um, but if you wanna be kind of super, super privacy conscious, we can deliver that. And if you wanna, you know, uh, be less so, you know, leverage other kinds of analytics and things like that, we can enable that too.

Um, we, we run the full gamut.

Stephen: How do you envision the security landscape looking like in Web3? You know, blockchain, I'd say five to 10 years, but things change so quickly. Even with the change of administration, we've seen the move to digital assets and stablecoins. Would you picture the industry like in the next couple years when it comes to cybersecurity and Web3 converging?

Ido: Right. So, you know, I think the story of cybersecurity and other three convergence has to do with Web3, right? Like, what is the industry of Web3 look like over the next five years is I think the, the better question. And so I think there's, like, I have like a bull case and a bear case, right? The bull case or the bear case is like, I just hope what you know.

Um, some of the, some of the regulation that, that this administration has put forward doesn't get rolled back, you know, by the next administration. Right. So we're like, you know, we're almost, you know, we're almost halfway through. Um, and, uh, um. Yeah, we're almost a year through, so almost a, uh, you know, a fourth of the way through.

Um, and so, you know, five years would mean that, you know, we're two years into the next administration. Right. And so I just hope that two years into that we don't, we don't have like a complete rollback of everything. Right. I think that's like the bear case. I just, just like continue in the direction that you're headed.

Right. Um, and then what does that mean for cybersecurity? Y you know, I, I think it means, you know what, what, what you could expect it means, right? It's not gonna be, it's not like nothing crazy is gonna happen. There may be some new regulation in place. There's gonna be like much more usage in crypto. We're gonna have, you know, many more kind of financial institutions leveraging these pieces of infrastructure.

They're gonna be very security minded and conscious about it, and I think that'll make the space grow generally. Um, and, and then, you know, my bull case is, is that, you know. Things, things take off in a way that we, you know, obviously like we could not have expected, right? That every company is, you know, interacting with and leveraging stablecoins and, and, and you know, much, much more to come after that.

And so, um, um, I do think, you know, we're at a point where the genie is a little bit further out of the bottle than, than you can't really, and it's kind of hard to take it back, take it back in. But, you know, I think there's still always that risk that, you know, we get, we get, you know, a lot of the things that, uh, um, that, that were rolled out, rolled back.

Stephen: In just three years, you went to 70 plus employees, I believe you recently just raised $50 million to start this year. A how do you deploy that capital? Maybe give us a little bit of a breakdown of like, what are the engineer roles versus non-engineer roles, and then like from a leadership standpoint, how do you and Ros, like manage, like what used to be like a few people to, like, now you probably have an HR department and you're dealing with, you know, employees and sicknesses and, you know, benefit packages.

How do you, how do you deal with all of that?

Ido: I think, you know, uh, um. At the end of the day, everything we wanna do is kind of continue to deploy security solutions for our customers, right? And as those customers grow, as those needs, you know, uh, um, become bigger there, there's obviously like a lot more like behind the scenes to go and do these things, right?

Our internal security detection broadly across a bunch of different chains, a bunch of different ecosystems, we support a ton of non EVM chains. You know, there, there's like a ton that goes into all these different things. So our engineering function is still like, uh, the overwhelming majority of the folks at the company.

Um, and, uh, um, and then of course, you know, there's, there's, there's a ton of organizations operating in the space. And so we, we have a growing kind of go to market team that kind of works with our customers and, and, and new customers to kind of onboard them, get them set up, um, and make sure they're incredibly successful.

Stephen: Any exciting news, you know, going into the end of 2025 and into 2026 with you and the team?

Ido: You know, I think it's just, uh, um, I think, you know, the, what's exciting for us is like super unfortunate about for the industry, right? There's like these hacks that's like, you know, uh, um, um, that forces us, you know, to build and kind of innovate and kind of new spaces. And so it's always bittersweet, right?

Um. But I think like what's what's, you know, some of the exciting kind of new things that we've, we're super focused on is kind of, you know, um. Um, you know, getting kind of our customers set up with some of our newer product offerings, whether that's kind of our co-signer, which enables teams to go and, and kind of, uh, prevent their, kind of prevent, you know, malicious transactions in a more enterprise use case.

Whether that's kind of our, our monitoring infrastructure, which enables kind of users to, you know, detect these various different types of threats and kind of prevent them from happening across the fraud contract infrastructure. And of course, our fraud solution, which enables kind of, you know, exchanges to, uh, um, or kind of, uh, uh, or different, um.

Uh, pieces of kind of signing infrastructure from, uh, enabling users to sign malicious transactions, uh, more associated with scams and fraud.

Stephen: Are you seeing anything else now that you know, there's so much data coming in, you can see a lot of these addresses interacting with each other and interacting with Ali illicit activity. Uh, a big conversation point is hiring. DPRK, it professionals, unknowing Levi companies. Do you see any of those insights?

Like, do you see any, like, Hey, there's a, there's a, there's a lot of activity here with this protocol. It looks like it might be, you know, they might have to start looking at who did they just hire, or, you know, like, how are you seeing any of that interesting data that might unfold just by the course of your Yeah, no, it's a good question. You know, we, we've, we've, um, you know, it's like an unfortunate, you know, reality, but I think like teams that take, you know, uh, um, they're hiring seriously and, and these precautions, and obviously, you know, with the bull market, you wanna ship really quickly and you want these things to happen.

Ido: You know, uh, um, we meet all of our employees, right? We're in the office all day, right? We have these like, kind of like precautions in place that make it so, like, these things can't happen to us. Um, but we've seen it happen. We've seen it happen even to security teams. We've seen it happen to some of our competitors, uh, that have hired, you know, these, these, uh, um, these DPRK, uh, uh, employees.

It's, it's like pretty crazy.

Stephen: Any of the last words, you know, I usually ask what's one book, maybe podcast or idea that has maybe shaped your thinking? I'm sure there's, you know, a lot of people right now that look up to these successful companies like yours in cybersecurity. Especially if they're going through, you know, maybe the Israeli government.

What are your, you know, was there any one book or podcast you're like, oh, this really changed the way I thought, maybe something on agent to ai.

Ido: Interesting. Um, you know, if, um. It's not a book. One piece of reading that I kind of, uh, did over the past couple weeks, um, was, was kind of look back at like the initial kind of, you know, uh, RFC four HDP that was published, you know, uh, almost 30 odd years ago. And look at the section kind of detailing 4 0 2, uh, we talked about back then.

I think something beautiful, at least in my mind, um, is like how a 30-year-old standard can be relevant today for certain things. Um, and so, and like how, how smart someone must be. Uh, or stupid, someone must be for writing a standard, uh, 30 years ago that is relevant to a use case they might have never imagined existed.

Um, and so I think that was like a really, really insightful, you know, piece of writing to me at least, uh, albeit pretty technical, so maybe

Stephen: Yeah, that's what I was gonna say. I, I read one article, I pressed one link and I was like, I think I know all I need to know about

Ido: there, you.

Stephen: agent ai. I think I'll just stick with, I'll think I'll stick with the chain analysis report. Um, awesome. Where can people find you? You know, where's the best place to reach you?

LinkedIn, Twitter. I'm assuming that you active on I am active on both. Um, do you want me to like, give my Twitter handle? Um,

we are gonna include everything in the show notes, but shout it out, man. It always feels good when people shut it out on the

Ido: I, I my usernames, but on LinkedIn and Twitter is, is Ido, I-D-O-B-N. Uh, you can find me there.

Stephen: Awesome. Thank you. You know, we really appreciate it. This was really, this was a non-technical version, though we didn't use too many acronyms, so I'm really impressed with what we did in this episode.

Ido: I am glad. Thank you, Stephen. Always a pleasure.

Stephen: Thanks.

‍