Speaker 1: Hey, folks, we're recording at chain linksmark On and joining
Speaker 1: me today is Jacques Bouchang, who is the CEO of Halburn. Jack,
Speaker 1: great to have you.
Speaker 2: Thanks for having me, Jack.
Speaker 1: I know of Halburn, but for the folks who don't know,
Speaker 1: tell us about what Halburn does.
Speaker 2: So we are a cyber security company fully dedicated to
Speaker 2: the WHIPS three and financial services space. We have been
Speaker 2: established in twenty nineteen, so we have been here for
Speaker 2: six years now, sure, and we provide the professional services
Speaker 2: security services to our customers, which are small Web three
Speaker 2: but also large banks like UBS.
Speaker 1: Ority Security and custody is such a big pillar in
Speaker 1: the crypto industry, so what you're doing is so critical
Speaker 1: for this infrastructure of the market. So are you you
Speaker 1: mentioned like some of the banks you're working with. Are
Speaker 1: you also working with crypto exchanges?
Speaker 2: We do work with entire I would say ecosystem of
Speaker 2: Web three and financial services. So we are essentially at
Speaker 2: the intersection of on chain and off chain cyber security services.
Speaker 2: You know a lot of those hacks which are happening
Speaker 2: on chain, our lateral move coming from off chain. That's
Speaker 2: why you need that competence when you speak with a
Speaker 2: provider of cyber security. We are also at the intersection
Speaker 2: of trap FI and DeFi. So that's why we are
Speaker 2: uniquely positioned in that landscape.
Speaker 1: And I'm assuming you work with many different multiple blockchains
Speaker 1: and projects we do.
Speaker 2: We do cover We work with a lot of layer one,
Speaker 2: layer two as well. We do a lot of secure
Speaker 2: by design where we try to shift cybersecurity left. So
Speaker 2: it's not an after thought, but it's really from the beginning,
Speaker 2: at the inception of a project. We love to be
Speaker 2: involved because that's the only way to have something very
Speaker 2: robust in terms of cyber security.
Speaker 1: Sure, so tell us a bit about how you're monitoring
Speaker 1: blockchain transactions and monitoring transactions on exchanges. You have a
Speaker 1: software setup and you plug into those respective sources.
Speaker 2: You ask a very interesting question. We don't, unlike in
Speaker 2: the traditional cyber security space, we're monitoring because when you
Speaker 2: monitor or you can still do what we call you
Speaker 2: can intervene. You can do incident response on chain. If
Speaker 2: something is happening, your money is gone. Yeah, so there
Speaker 2: is no such a thing as an instrumental monitoring. You
Speaker 2: can do forensic after the fact. So we prefer to
Speaker 2: do what I call preventive cyber security, Okay, to avoid
Speaker 2: that the bad guy can settle on your smart contract
Speaker 2: or on your chain. So that's a big thing.
Speaker 1: So that definitely makes sense. So you're preventive, you're getting
Speaker 1: ahead of those things happening. Are you using I'm assuming
Speaker 1: you have human beings monitoring things that are using AI
Speaker 1: to monitor as well.
Speaker 2: So we are using So it's mainly the skills of
Speaker 2: our people, but it's a combination. It's a man machine partnership.
Speaker 2: So we use plenty of AI tools, plenty of automation.
Speaker 2: At the end of the day, what makes the difference
Speaker 2: of the skills of our team?
Speaker 1: Oh? Absolutely. And in regards to what trends you're seeing
Speaker 1: and security, what are some of the common threats that
Speaker 1: have appeared over the past year or so.
Speaker 2: Yeah, So you know, we publish almost a monthly report.
Speaker 2: We call that the Top DeFi hack okay, yeah, and voints,
Speaker 2: and we try to track every hack above one million dollars.
Speaker 2: And just to give you one number, for instance, in
Speaker 2: May of this year, the total Top Defive HACT was
Speaker 2: two hundred and thirty six million dollars.
Speaker 1: Yeah.
Speaker 2: In in July it was one hundred and twelve million dollars.
Speaker 2: So what we are observing is that the hacks are
Speaker 2: still massive on DeFi. So now fast forward ward, imagine
Speaker 2: now the banks doing plenty of things on chain, they'd
Speaker 2: better be safe.
Speaker 1: Yeah. Do you feel most of the security vulnerabilities come
Speaker 1: from a human element or a code element or both.
Speaker 2: So the weak link will always be the human.
Speaker 3: Human That's yeah, that's that's the absolute rule of some
Speaker 3: And one of the massive hacks that happened in the
Speaker 3: beginning of the year was because of.
Speaker 2: An insider of thread, so inside of shread a Hogue
Speaker 2: developer in that case, Hogue developer or a key thread.
Speaker 2: When you are working in web three and when you
Speaker 2: have this big total value look on chain, they can
Speaker 2: go away with the money. So still still people. But
Speaker 2: of course you need to have a waterproof or bullet
Speaker 2: proof software and this is those kind of what I
Speaker 2: call continuous implementation, continuous and follow up of the software.
Speaker 2: Cyber security and reducing the vulnerability is a key element
Speaker 2: of our work.
Speaker 1: That definitely makes sense. And you know, and do you
Speaker 1: feel your job is going to get a lot harder
Speaker 1: with the rise of AI, different AI agents where bad
Speaker 1: actors could potentially users. AI agents attack different blockchains.
Speaker 2: So you're asking your question is about the weapon and
Speaker 2: the shield. AI is both weapon and shield. So I
Speaker 2: don't think it makes our work harder. It makes our
Speaker 2: work even more tech enabled. Sure, that's a big difference, right,
Speaker 2: So we need to have and we do have at
Speaker 2: alborne AI in every corner of what we do for
Speaker 2: the smart contract review, for the code assessment, but also
Speaker 2: then for creating the right reporting and so on and
Speaker 2: so forth. So we are we have a continuous utilization
Speaker 2: of AI modules and we are using a lot of
Speaker 2: AI orchestration. But at the end of the day, as
Speaker 2: I said, it is the shield part.
Speaker 1: Part.
Speaker 2: Adversaries are using the weapons part of of course, with
Speaker 2: deep fakes or with spare fishing, which are even more convincing.
Speaker 1: Yeah, it is getting much more sophisticated the threats. So
Speaker 1: let's say your team is working with a bunch of
Speaker 1: crypto exchanges and traify institutions. When you identify a vulnerability,
Speaker 1: how fast you get the information out to these folks
Speaker 1: saying hey, we recognize something's wrong with this blockchain, watch out.
Speaker 2: Yeah, so we need to move as fast as possible. Right,
Speaker 2: We discovered altogether multiple zero days, you know, zero days
Speaker 2: you need to act immediately. So we have a lot
Speaker 2: of critical vulnerability that we discover and we make that
Speaker 2: available immediately to the customer so that they can remedy.
Speaker 2: And when we do that, we give them advises how
Speaker 2: to remedy, and AI is used also in that phase
Speaker 2: to define the best possible remedy given the context and
Speaker 2: the environment of the client.
Speaker 1: Got it. Is it too early to think that quantum
Speaker 1: might be an issue now or in the coming year.
Speaker 2: Yeah, of course, everybody's talking about it. Yeah, body's talking
Speaker 2: about the fact that it will break our essay, it
Speaker 2: will bake break encryption. Yeah, let's see.
Speaker 1: Still too early, let's see. But at the same time,
Speaker 1: like you said, it's like with AI, it's the shield
Speaker 1: and the threat, right because you can use quantum computer,
Speaker 1: but you can use.
Speaker 2: Quantum computer to encrypt at a level that nobody will
Speaker 2: be able to crack that code.
Speaker 1: Yeah. Yeah, absolutely. I'd love to get your thoughts on
Speaker 1: what's happening in the broader crypto industry. We see that
Speaker 1: there's a race for chokenization. We're putting real world assets
Speaker 1: on chain. What are your thoughts on that and that
Speaker 1: market growing?
Speaker 2: Yeah, so I believe so straight Threet recently published document
Speaker 2: in October, Yeah, which says that currently institutional investor of
Speaker 2: something like close to six percent of their total investment
Speaker 2: which are crypto or digital asset of any form. And
Speaker 2: the fourth is that in three years it will be
Speaker 2: three exact, so more than fifteen persons. So adoption will raise.
Speaker 2: I believe that some class of digital asset for insan
Speaker 2: private equity one will come, will take off much faster
Speaker 2: than the other. But I also believe that the cyber
Speaker 2: security challenge for banks to custody all that will be huge. Yeah.
Speaker 1: That's a great point because one of the things I've
Speaker 1: been thinking about you really have to trust the party
Speaker 1: that's toorgnizing that they actually have the asset in their
Speaker 1: bank or vault.
Speaker 2: Right, there is no CSD, there is no central security
Speaker 2: depository anymore. Yeah, you know, custody today it's an easy
Speaker 2: game for a bank, right, because what is it? It
Speaker 2: is a legal game. Okay, you need it's a pointer
Speaker 2: toward an item which is at the custody at a
Speaker 2: central security depository. In the future, they are fully accountable
Speaker 2: and responsible for the custody of any digital asset. Yeah,
Speaker 2: And it's a new discipline. It's a technical discipline, so
Speaker 2: it's it's not anymore that legal process discipline. It's a
Speaker 2: pure technical discipline. So it's a it's a big it's
Speaker 2: a big it's a big challenge, and banks are moving
Speaker 2: into that direction and we help them, We support them
Speaker 2: making the right assessment of their custody strategy.
Speaker 1: Sure, and on that note, are you working with stable
Speaker 1: coin issuers as well? The stable We got a genius
Speaker 1: Act pass here in the United States. A lot of
Speaker 1: issuers have stable coins, you know, hitting the market now.
Speaker 2: Yeah, absolutely, so we are definitely working with the issue
Speaker 2: of stable coins. So we used to work with Circle,
Speaker 2: with coin Base, with the likes of those guys. We are.
Speaker 2: By the way, in Europe there is also a big
Speaker 2: initiative from nine banks, the consortion of nine banks for Pride,
Speaker 2: the stable coin packed to the euro and one of
Speaker 2: those banks is the key customer of ours. We are
Speaker 2: doing the custody for them, so absolutely we are. We
Speaker 2: are deeply involved. We are about to release the paper
Speaker 2: about the risk framework for stable coin.
Speaker 1: Wow. Yeah, so much security needed for all these different
Speaker 1: types of assets.
Speaker 2: And you are you're hitting a very good point. Custody
Speaker 2: of a bitcoin is not like the custody of a
Speaker 2: stable coin, which is not like the custody of the
Speaker 2: togonized equity. Those are different challenges and everybody needs to
Speaker 2: be ready for those challenges.
Speaker 1: Sure, so tell us about about your road map. I'm
Speaker 1: assuming it involves prepping for all these different types of assets, right,
Speaker 1: I agree.
Speaker 2: So absolutely, so our road map is definitely so. First,
Speaker 2: we see the demand ticking up for large banks for
Speaker 2: everything which is digital assets. So that's clearly the understanding
Speaker 2: this adoption. Right, they are going into that direction, but
Speaker 2: they need to have solid cybersecurity foundations. So that's what
Speaker 2: that's a key road map for us because we need
Speaker 2: to adjust to the customer requirements in that sense. Second,
Speaker 2: we mentioned that we integrate AI too links in every
Speaker 2: step of our value chain. It's really key because as
Speaker 2: I said, it's part of the shield, and we are
Speaker 2: the shield. We are holding the shield, so we need
Speaker 2: to have the AI component. And the third component is
Speaker 2: really to be able because you know what in the future,
Speaker 2: define will be part of the supply chain of those banks. Yes,
Speaker 2: and we are the I would say the in betweener.
Speaker 2: We are the glue between because we understand both worlds.
Speaker 1: Yeah, yeah, absolutely with regards to legislation, and here in
Speaker 1: Europe you have a legislation. Here in the United States,
Speaker 1: we're waiting for the clariac. How has legislation helped you
Speaker 1: and your company in Europe? And are you are you
Speaker 1: looking forward to the Claritia getting pass here?
Speaker 2: So, first and foremost, I believe that the Clarity Act
Speaker 2: is an incredible piece of legislation because it allows a
Speaker 2: dynamic transition from a token being considered as equity then
Speaker 2: moving toward the commodity. So they have put a certain
Speaker 2: level of dynamic in their regulation in the US that
Speaker 2: is far superior to what we have in Europe. So
Speaker 2: I think they will be ahead of the pack because
Speaker 2: of that new US regulation, but also for the Genius Act,
Speaker 2: which has also set set up a framework which will
Speaker 2: enable the US to be really leading the pack. So
Speaker 2: I am a little bit concerned about your being lagging
Speaker 2: behind with MICA as opposed to Clarity Act. But to
Speaker 2: your point, yes, in any cases, the two types of
Speaker 2: legislation accelerate the demand, accelerate the appetite of the traditional
Speaker 2: financial institution to go down the road of a digital asset.
Speaker 2: I was speaking to a very large bank yesterday and
Speaker 2: they told me they are about to do the first
Speaker 2: issues of equity on chain. So that would be equity
Speaker 2: for a big corporation, so purely issued on chain. So
Speaker 2: when you go into that space, you'd better have a
Speaker 2: rock solid infrastructure.
Speaker 1: Yes, yes, and I hope that you know what your
Speaker 1: services that you're providing. That folks are starting to think
Speaker 1: about these things and security first, because it would be
Speaker 1: very detrimental to the crypto acid class and industry. Oh yes,
Speaker 1: we had banks or big institutions losing assets.
Speaker 2: Yeah, and that's why I was mentioning or report about
Speaker 2: the major hacks because imagine two hundred and thirty six
Speaker 2: million in May lost without any bank. Can you imagine
Speaker 2: once a bank as is nay as ear name or
Speaker 2: on that list of top acts, what's impact? Yes, So
Speaker 2: that's a key area of concern of mine. Okay, how
Speaker 2: can we make sure that it's so I would say
Speaker 2: robust that such a thing will never happen, right, and
Speaker 2: we hope to be a numbled but a contributor to
Speaker 2: that level of security that is needed.
Speaker 1: Oh absolutely, Jacques, amazing, I love that what you guys
Speaker 1: are doing. Like I said, you're a critical pillar in
Speaker 1: this infrastructure of this market. So looking forward to the
Speaker 1: future updates. Thank you for joining me, Thanks for having me.
Speaker 1: This episode is brought to you by Proppy, which is
Speaker 1: leading the charge in putting real estate on chain. Propy
Speaker 1: is a game changer. You can buy and sell real
Speaker 1: estate with cryptocurrencies using the Property platform, which is powered
Speaker 1: by a blockchain of course, and they have a native
Speaker 1: token call pro and I've been an investor in the
Speaker 1: Propy token since twenty eighteen. So Propy is a licensed
Speaker 1: Web three pioneer operating since twenty seventeen. They have facilitated
Speaker 1: over four billion dollars in transactions. They're putting titles and
Speaker 1: deeds on chain. They use Coinbase for their crypto escro service.
Speaker 1: So this is a great platform. And once again they
Speaker 1: are ahead of the curve when it comes to putting
Speaker 1: real estate on chain. And they just launch a great
Speaker 1: campaign where you can earn some of the Propy tokens
Speaker 1: and it's simply by doing tasks such as sharing their
Speaker 1: vision video, signing up and inviting a friend, and much
Speaker 1: more so. If you'd like to learn more about Propy,
Speaker 1: visit the link in the description