►
From YouTube: Rug Life: Using Blockchain Analytics to Detect Illicit Activity, Track Stolen Funds, and Stay Safe
Description
Visit the https://archive.devcon.org/ to gain access to the entire library of Devcon talks with the ease of filtering, playlists, personalized suggestions, decentralized access on Swarm, IPFS and more.
https://archive.devcon.org/archive/watch/6/rug-life-using-blockchain-analytics-to-detect-illicit-activity-track-stolen-funds-and-stay-safe/
Learn how to use blockchain analytics to identify and protect yourself from the latest rugs, hacks, and scams.
The purpose of this talk is to discuss:
- How to (automatically) identify illicit activity on the blockchain
- Typologies of the latest rugs, hacks, and scams
- Tracing where funds from a latest rug/hack/scam have gone
- How to protect yourself as a dev
Speaker(s): Heidi Wilder
Skill level: Intermediate
Track: Security
Keywords: hack,scam,rug
Follow us: https://twitter.com/efdevcon, https://twitter.com/ethereum
Learn more about devcon: https://www.devcon.org/
Learn more about ethereum: https://ethereum.org/
Devcon is the Ethereum conference for developers, researchers, thinkers, and makers.
Devcon 6 was held in Bogotá, Colombia on Oct 11 - 14, 2022.
Devcon is organized and presented by the Ethereum Foundation, with the support of our sponsors. To find out more, please visit https://ethereum.foundation/
A
A
What
do
you
actually
do
so
quick,
tldr
I
know
we
all
don't
have
time
to
be
sitting
around
a
panel
all
day.
So
if
you've
got
places
to
go,
tldr
is
be
paranoid,
be
paranoid
that
is
literally
the
end
of
this
presentation.
The
rest
of
this
presentation
is
going
to
be
full-on
paranoia
mode,
you're,
going
to
want
to
lock
down
everything,
throw
out
your
computer
and
just
give
up
on
this.
But
if
you
want
to
stick
around
for
the
rest
of
it,
let's
go
for
it.
A
So,
first
and
foremost,
we
need
to
find
what
illicit
actually
is
right.
There
are
a
lot
of
people
who
say:
oh
scammers
are
illicit
dark
markets
are
bad,
beths
are
also
Bad.
True
Traders,
you
know
who
do
Market,
manipulations,
they're,
also
bad,
oh
fact,
entities
more
recently
also
bad,
like
we've
got
a
whole
like
swath
of
different
Terrible
Bad
actors
out
there,
but
today
we're
only
going
to
be
concentrating
on
one
which
is
theft.
I
personally
believe
that
thefts
are
like
the
worst
thing
that
can
happen
with
this
ecosystem
right.
A
First
and
foremost,
you
see
millions
and
millions
of
dollars.
Like
just
last
night,
we
saw
100
million
dollars
being
drained
out
of
mango
Finance
right,
that's
horrible
for
the
entire
ecosystem
doesn't
matter
what
chain
it
happened
on
right.
Not
only
that,
but
it
also
drives
more
regulator.
Scrutiny.
Do
we
really
necessarily
want
that
we
want
to
be
able
to
develop
right?
We
want
to
be
able
to
build
without
having
to
even
consider
things
like
that.
So
this
is
why
we
need
to
start
thinking
about
things
like
how
do
we
prevent
this
kind
of
stuff?
A
Now,
I
don't
want
to
spend
that
long
on
this
I
think
we
need
to
talk
about
different
theft,
typologies
out
there
now
I,
largely
bucket
into
three
different
sort
of
categories.
First
and
foremost,
you
have
the
dev
team
initiated
thefts
right
AKA.
We
all
know
these
rugs
right.
What
does
a
rug
actually
look
like,
first
and
foremost,
you've
got
some
token
dumping.
You've
got
unlimiting
or
even
limiting,
usually
of
functions
as
well
as
cashing
out
of
any
and
all
proceeds
possible
now,
sometimes
with
rugs.
A
What
will
also
happen
is
websites
will
404
and
obviously
social
media
accounts
will
go
totally
dark
now.
The
biggest
bucket,
though,
are
third-party
thefts
right
and
those
I
actually
put
into
two
different
categories.
First
and
foremost,
you've
got
hacks
right
third
parties
hack
into
places
all
the
time
right.
For
example,
let's
think
of
these
different
Sexes
that
have
been
hacked
in
the
past
couple
of
months
right
and
also
you've
got
another
thing
called
Market
manipulation,
as
we
all
know
like
with
mid
what
happened
with
mango
last
night.
A
Now,
what
exactly
do
we
Define
as
a
hack?
Well,
a
hack
is
very
similar
actually
to
a
rug
right.
The
only
different
friends,
I
would
say,
In,
This,
Very,
generalized
sort
of
rule
of
thumb
is
that
with
a
hack,
you
usually
don't
have
the
website
of
the
team.
The
social
I
don't
know
it
is
not
working
this
video
of
the
team
also
going
down.
A
So
you
don't
have
that
actually
happen
with
a
hack
now,
but
what
you
do
see
is
obviously
the
cashing
out
and
of
proceeds
extremely
extremely
rapidly
and
obviously
The
Dumping
of
funds.
Now,
in
terms
of
Market
manipulation,
what
usually
happens
there
is
a
is
usually
a
flash
loan
will
be
taken
out
nine
times
out
of
ten,
and
what
will
happen
is
there's.
A
certain
pool
is
manipulated
right
where
one
token's
price
is
arbitrarily
pushed
up.
A
I
actually
want
to
go
into
detection
methods
like
how
do
we
actually
detect
this
kind
of
stuff?
How
do
we
find
this
stuff
right,
and
so
there
are
a
lot
of
ways
to
do.
Detection
Forda
just
did
an
amazing
presentation
on
how
they
go
about
doing
detection,
but
for
as
a
protocol.
What
you
want
to
do
is
you
want
to
actually
just
set
up
alerting
for
large
flows
of
funds.
That's
actually
something
that
the
Florida
does.
Another
thing
you
can
do
as
well
is
use
various
different
platforms
that
have
listed
on
here.
A
To
actually
start,
you
know,
alerting
you
for
when
sort
of
any
sort
of
strange
activity
happens.
Finally,
another
thing
you
might
consider
doing
is
following
a
whole
bunch
of
Auditors
online,
because
chances
are
on
Twitter.
The
Auditors
will
alert
you
probably
before
you
know.
You
know
even
your
most
Avid
Twitter
followers
alert
you
of
something
strange
happening
now.
Unfortunately,
this
is
all
fine
and
great,
but
once
a
transaction
is
broadcast
to
the
blockchain
you're
screwed
right
you're
done
for
so
this
is
great.
A
We
can
detect
this
all
day
every
day,
but
we
need
to
actually
prevent
this
stuff
right,
and
so
what
we
need
to
actually
do
is
we
need
to
start
detecting
this
sort
of
weird
kind
of
activity
before
any
money
starts
to
move
right,
and
so,
if
you're
a
Dev,
there
are
a
couple
things
you
can
do.
First
off,
you
want
to
constantly
audit
right
your
debits
and
credits
and
I
know
this
sounds
super
effing.
A
Oh
I
just
got
one
out
again.
I
know
it
sounds
super
boring,
but,
for
example,
Nomad
they
would
have
been
able
to
detect
some
strange
stuff
happening,
going
all
the
way
back
to
July
and
they
could
have
probably
prevented
what
then
ended
up
happening
at
the
beginning
of
August.
Now
another
thing
you
might
want
to
do
too
is
Monitor
who's
transacting
with
your
contract.
What
are
they
actually
doing
with
their
funds?
A
Right
and
finally,
another
thing
too,
is
you
want
to
be
monitoring
your
site's
back
end,
but
also
your
site's
front
end,
for
example,
seller
Bridge,
that's
actually
how
they
were
exploited.
More
recently,
right
is
their
front.
End
was
attacked
now
this
is
all
great,
but
if
you're
an
investor
right,
this
means
nothing
to
you
like
you're,
not
going
to
be
debiting
and
crediting
a
particular
like
protocols,
smart
contracts,
that's
not
your
job
right.
So
what
should
you
be
doing?
A
Well,
one
thing
you
can
do
is
make
sure
you
know
what
contracts
you're
actually
interacting
with
right,
so
when
you're
on
metamask-
and
you
are
trying
to
do
a
transaction
before
you-
click
that
button
make
sure
that
the
contract
is
indeed
the
contract,
you
want
to
be
transacting
with
finally
or
next
rather
revoke
cash.
So,
for
example,
when
you
interact
with
a
contract
right,
you
before
you
interact
with
that
thing
to
send
your
tokens
anywhere.
A
You
have
to
allow
those
tokens
to
be
moved
right
now
when
you
allow
those
tokens
to
be
moved
with
that
contract
you're,
granting
that
contract
license
to
move
them.
You
want
to
revoke
those
every
once
in
a
while,
because
chances
are
those
contracts
you
interacted
with
back
in
2021
or
even
2020.
They
might
not
even
exist
anymore
right.
You
don't
want
to
have
anything
to
do
with
them
right
so
revoke.
A
Now,
I
want
to
get
to
the
most
fun
part
of
this
presentation,
which
is
actually
tracking
the
funds.
So
let's
say
your
Project's
wrecked
right
like
suddenly,
all
the
funds
have
been
siphoned
off
or,
let's
say,
you're
an
investor
and
you
invest
actually
in
a
project
and
oh
damn,
their
money
is
all
gone.
What
happens
like
can
I
even
do
anything
right,
so
I'm
not
going
to
be
boring.
You
guys
with
many
more
bullet
points
on
slides.
Don't
worry!
A
This
is
the
last
one,
but
first
and
foremost
you
want
to
learn
how
to
read
etherscan
right,
there's
no
point
in
like
pretending
to
track
funds.
If
you
can't
re-eat
their
skin
right
and
I
know,
etherscan
is
painful.
To
read
as
arvestgan
is
is
snow
Trace
all
the
other
ones
are,
but
it's
super
super
important
to
learn
how
to
read
a
block
Explorer.
A
Another
thing,
too,
is
once
you
learn
how
to
read
a
block:
Explorer
you're,
going
to
be
much
more
Savvy
with
blockchain
analytics
tools
like
Dune
and
bloxy,
and
whatnot
and
they're
going
to
be
able
to
help
you
track
on
those
funds
further.
Now
there
are
a
whole
bunch
of
other
tools
out
there
that
I
haven't
listed
on
this
slide,
but
yeah
these,
at
least
at
the
very
least,
are
free
and
open
source.
A
Now.
Another
thing
you
can
also
do
as
well
is
leverage
Twitter
investigators,
but
I
say
that
with
a
massive
caveat,
so
there
are
a
lot
of
really
amazing.
Twitter
investigators
out
there
right
and
I
think
we
probably
all
know
their
names
right,
but
there
are
also
some
overzealous
researchers
as
well,
and
I
saw
this.
A
In
fact,
actually
last
night,
with
a
mango
exploit,
there
were
several
people
who
called
out
several
different
addresses,
but
were
indeed
not
related
to
the
mango
Finance
exploit
so
yeah,
it's
kind
of
frustrating
at
times
for
people
like
me
when
I'm
going
through
this
and
I
get
pings
from
all
sorts
of
people
about
things,
so
yeah
leverage
them,
but
do
it
cautiously?
The
biggest
point
on
here,
though,
that
I
want
to
make
is,
if
you
do
have
a
project
that
gets
hacked
right
or,
if
you're
part
of
a
project
that
gets
hacked.
A
This
is
regardless
of
whether
or
not
you're
us-based,
because
chances
are,
you
probably
have
an
investor
somewhere
in
there
in
your
project,
who
might
be
us-based,
so
I
would
go
ahead
and
file
it
with
them
as
well
as
obviously
whoever
your
local
law
enforcement
is
now.
The
next
biggest
point
on
here
is:
if
you
are
a
Dev
and
your
guys's
project
gets
hacked,
you
want
to
communicate,
communicate,
communicate
because
the
worst
thing
is
you're
silent
right
and
then
all
of
your
investors
are
sitting
there
like
what
the
hell
is
going
on.
A
Oh
my
God,
oh
my
God,
oh
my
God
and
then
immediately
the
flood
starts
and
immediately
people
are
like.
Oh
my
God.
The
project
got
rugged
and
then
all
the
rumors,
the
rumor
mill,
begins
right.
So
you
want
to
communicate
as
much
as
possible
as
much
as
you
possibly
can
and
I
know,
you're,
going
to
probably
hire
lawyers
and
whatnot,
but
try
to
communicate
as
best
you
possibly
can
now.
A
I
want
to
get
you
guys
prepared
for
my
favorite
thing,
which
is
story
time,
because
I
want
to
actually
give
you
guys
a
good
case
study,
and
unfortunately,
this
is
not
going
to
be
a
nice
story
time.
This
is
going
to
be
a
nightmare
story
time
we're
going
to
be
talking
about
the
Ronin
theft
that
happened
earlier
this
year.
A
A
First
and
foremost,
what
they
did
with
it
is
they
started,
cashing
it
out
at
various
different
Sexes
now
this
was
also
around
the
same
day
where
the
Ronin
Bridge
came
out
and
they
finally
announced
that
they
had
been
exploited.
And
what
do
you
think
the
attackers
did
they
had
to
immediately
stop
because
the
Sexes
then
caught
on,
like
oh
dear
God,
we're
being
used
to
cash
out
of
these
terrible
proceeds.
A
We
gotta
stop
this
and,
of
course
the
attackers
then
also
pause
too
right
and
then
two
weeks
later
they
start
mixing
funds
through
tornado
cash
right
and
all
of
this
ethos
flows
through
tornado
cash.
Now
one
thing
I
have
to
mention
is
this:
was
a
ton
of
eth
right
I
just
mentioned
it's
173
000
each.
This
is
a
ton
of
money.
A
I
had
never
seen
this
much
money
flow
through
tornado
cash,
so
the
sheer
volume
was
already
unprecedented,
but
the
other
thing
that
was
also
crazy
too
was
these
guys
were
rinsing
and
repeating
the
exact
same
methodology
over
and
over
and
over
again
right.
So
what
they
would
do
is
they
would
mix
the
money
through
tornado
cash
and
then
they
would.
A
They
would
then
swap
it
using
the
same
decks
over
and
over
again
to
Ren
BTC,
which
is
a
Bitcoin
proxy
right
and
then,
after
that,
what
they
would
do
is
they
would
burn
that
brand
BTC
in
exchange
for
Bitcoin,
and
this
happened.
Time
After,
Time,
After
Time
day
after
day
and
I
mean
we're
all
human
right.
A
These
attackers
are
human
right,
and
so
we
like
a
good
pattern,
and
it's
one
thing
that
you'll
notice
in
this
presentation
is
that
patterns
get
repeated
all
the
time
and
that's
the
part
of
doing
and
analytics
and
tracing
funds
right.
Is
you
start
to
notice
these
typologies
over
time
now?
What
happened
with
this
Bitcoin?
This
Bitcoin
was
then
sent
on
to
chipmixer
and
you
guys
might
know
chipmixer
chip
mixer
is
a
Bitcoin
mixing
service.
Now,
when
I
look
at
chip,
mixer
I
think
to
myself,
oh
my
God,
that's
so
2019!
A
No
one
uses
chip
mixer
anymore,
like
there
are
so
many
better
Services
out
there
right
and
of
course
again.
Why
am
I
saying
that
so
2019
right?
Well,
what
I'm,
essentially
saying
by
that
is
there's
no
liquidity
in
there
right.
You
want
a
deep
liquidity
pool
when
you
actually
care
about
privacy
right,
because
you
don't
want
to
be
found
out.
You
don't
want
people
like
me
to
go
looking
for
you
right
and,
of
course,
these
guys
had
a
ton
of
money
that
was
flowing
through
chip
mixer
right.
A
A
This
way,
this
was
only
their
pattern
in
May
and
by
the
way,
we're
going
to
skip
all
of
the
patterns
that
happened
in
June
and
July,
and
we're
gonna
go
straight
to
the
pattern
that
started
in
late
August
and
is
continuing
to
today,
so
some
of
that
Bitcoin
that
they
had
what
they
started
actually
doing
in
this
is
late
August,
beginning
of
September.
They
started
splitting
it
out
into
these
weird
increments
of
rounded
five,
six,
seven
and
eight
BTC
right.
They
split
out
all
these
funds.
A
What
do
they
do
with
it
send
directly
to
Ren
mint
some
Ren
VTC
great
right.
This
is
a
very,
very,
very
easy
pattern
to
detect
on
chain
right
and
from
there
what
they
did
was
they
used
the
decks.
They
swapped
it
into
ustt,
and
then
they
got
a
little
confused
Midway.
They
wanted
some
eth
go
back
into
usdt
and
they
ended
up
cashing
it
out
at
otc's
in
butcher.
A
What
they
also
did
is
they
got
lazy
in
between
and
just
cashed
out
directly
from
tether
now,
one
thing
that
you'll
notice
is
that
I
have
usdt
and
eth
written
on
here
right
and
for
those
of
you
that
are
Savvy
you're,
like
hey,
wait,
a
second
Heidi.
What
about
gas
fees
did
you?
Did
you
get
anything
out
of
gas
fees?
Yes
the
gas
fees
actually
originated
from
those
Sexes
right
here
right.
So
it's
a
very
roundabout
pattern
that
we
end
up
seeing.
So
what
also
ended
up
happening
as
well?
A
Is
they
had
this
large
sum
of
Bitcoin
and
they
got
super
super
lazy
and
they
started
just
cashing
it
out
directly
to
Sexes,
and
then
they
decided
to
get
unlazy,
because,
unfortunately,
some
people
found
them
and
they
decided
to
go
back
to
the
ren
BTC
route
and
then
do
the
same
thing
over
and
over
again
right
now,
what
am
I
trying
to
take
away
with
this
case
study?
That
was
a
lot
right.
A
This
was
overwhelming
now
what
I'm
trying
to
help
you
with
this
is
blockchain
analytics
ain't,
easy,
it's
quite
complicated
and
trying
to
recoup
stolen
funds
is
no
joke
right.
It's
not
only
extremely
costly,
it's
very
very,
very
time
consuming
right,
I've
been
tracking
these
guys,
literally
or
Yeah
March
right,
and
not
only
that,
but
the
amount
of
funds
that
you
know
the
whole
like
crypto
Community
has
been
able
to
recoup,
has
been
so
limited
right.
So
you
don't
want
this
to
happen
now.
A
Luckily,
we
do
have
the
transparency
of
the
blockchain
right
now,
which
allows
us
obviously
to
trace
funds
right.
The
fact
that
it's
permanent
it's
immutable
right
and
it's
fully
transparent,
awesome
right,
but
it
doesn't
change
the
fact
that
tracing
this
money
is
a
lot
more
work
down
the
line
than
actually
trying
to
prevent
the
bad
activity.
A
So
on
this
slide,
we've
got
lots
of
different
recommendations
in
terms
of
General,
stuff,
blockchain,
stuff,
social
media,
email,
stuff
and
doing
your
basic
due
diligence,
I.E
d-y-o-r
cool.
We
all
got
our
photos
awesome.
Okay,
worst
case
I
can
share
the
slides
with
you
after
the
fact
now,
I
want
to
share
a
couple
examples
with
you.
Guys
and
I
want
to
share
an
example
of
being
impulsive
and
not
checking
the
contracts
that
you're
interacting
with
before
you
interact
with
them.
A
Now,
back
in
April
board,
API
clubs,
Instagram
was
hacked
I'm
sure
you
guys
remember
this
right,
their
Instagram
was
hacked.
Suddenly
there
was
like
this
announcement
of
like
oh
we're,
giving
away
this
land.
All
you
have
to
do
is
if
you
hold
an
ape,
this
meant
this
Lan
token
and
of
course,
people
fell
for
this
right.
A
Now
these
nfts
were
immediately
sold
for
Ethan
a
whole
bunch
of
different
marketplaces
right
and
then,
after
that,
the
eath
was
cashed
out
a
bunch
of
sexes
immediately
right
really
good.
Then
also
it
was
sent
to
the
Ukrainian
Armed
Forces,
that's
interesting.
Maybe
that
tells
us
about
where
the
threat
actor
might
be
we'll
see
in
just
a
second
and
then
we
also
see
that
they're
sending
money
to
a
karting
shop,
so
they're
clearly
buying
fake
IDs
right,
probably
using
those
fake
ID
to
sign
up
for
those
Sexes
interesting
right
now.
A
Remember
how
I
talked
about
those
gas
fees.
Those
are
something
you
want
to
look
at
when
you're,
initially
interacting
with
a
contract
right,
so
you
can
see.
Where
did
they
initial
get?
Will
you
get
their
funds
from
and
if
you
take
a
look
at
that
East
right,
the
original
like
that
paid
those
topped
up
that
address
to
initially
get
those
gas
fees
you'll
actually
find
that
that
address
indeed
also
did
a
whole
bunch
of
different
fishing
and
made
a
ton
of
money
right
great.
What
else
can
we
find
out
about
this
address?
A
One
thing
that
I
found
that
was
really
interesting
with
this
particular
dress.
It
also
cashed
out
a
whole
bunch
of
sexes
as
well
was
that
it
also
sent
money
to
this
very
interesting
social
nft
marketing
page
right.
So,
essentially,
what
you
could
do
is
you
could
pay
this
money
to
Market
your
nft
project
on
various
different
social
media
websites?
A
Interesting
I,
don't
think
that's
Ukrainian
right
there
right
and
my
perspective
actually
is-
is
these
probably
is
guys,
probably
actually
just
donated
to
the
UK
in
armed
forces
in
order
to
pay
probably
throw
people
like
me
off
of
their
tracks
right,
and
so
this
is
one
very,
very
easy
way
to
do
it
because,
as
we
all
know,
that
address
for
the
Ukrainian
Armed
Forces
is
tagged
on
etherscan
right.
So
it's
very
very
obvious.
So
this
is
an
example
of
being
impulsive,
and
this
is
what
you
don't
want
to
do.
So.
A
Take
those
two
minutes
literally
two
minutes
right
and
look
at
that
address
before
you
interact
with
it
right.
Look
at
what
those
other
addresses
that
are
sending
funds
are
actually
doing
right
or
they
actually
like.
Are
they
actually
getting
something
for
it?
Are
they
actually
minting
any
land?
Are
they
getting
nothing
out
of
it
right
now?
I
also
want
to
talk
about
an
example
of
social
engineering.
This
has
nothing
to
do
with
blockchain
analytics
yet,
but
it
will
right
so
here's
a
great
example
from
Poly
play
and
they
were
amazingly
transparent
about
their
exploit.
A
As
you
can
see
here,
the
finance
team
reached
out
to
Poly
play
in
order
to
pretty
much
list
their
token
right
and,
as
you
can
see,
is
this
looks
pretty
you
know,
legit
in
terms
of
a
you
know,
LinkedIn
page
he's
got
like
400
some
odd
followers.
This
seems
like
a
pretty
legit
email
or
whatever
it
is,
but
there
are
a
couple
funky
things
with
it
right.
A
A
So
it's
one
thing
that
you
want
to
kind
of
look
at
right
when
you're
looking
at
people
who
reach
out
to
you
is
verify,
indeed
their
identities
right.
For
example,
if
you
look
up
Teddy
Lynn
right
now
on
LinkedIn
I'm
sure
this
isn't
the
only
Teddy
Lin
of
Finance
you're
gonna
find
right,
and
so
it's
one
thing
that
you're
going
to
want
to
do
you're
going
to
want
to
verify
with
these
teams
before
you
know,
you
start
interacting
with
them
right,
because
the
worst
thing
is.
Is
you
get
down
the
line?
A
They
send
you
over
documents
to
agree
to
you
download
that
document,
and
that
document
includes
a
whole
bunch
of
malicious
code
and
your
whole
project
gets
screwed
over
right
and
what's
interesting
about
this
particular
social
engineering
incident
is
that
Poly
play
ended
up
getting
hacked
right
because
of
all
of
this
and
what
happened?
Well,
if
you
looked
on
chain
you'll
actually
find
that
the
Poly
play
hack
is
related
to
the
bzx
hack.
A
That
happened
back
in
November
and
also
a
link
to
the
mgnr.iohack
as
well,
and
if
you
look
backs
up
what
you'll
end
up
finding
is
all
of
them
fell
for
very
similar
social
engineering
tactics.
So
this
is
a
common
one
used
by
many
nation
states,
actually
one
in
particular,
and
you
guys
can
guess
who
that
might
be
now.
A
One
thing
we
talked
about
before
is:
what's
the
difference
between
a
hack
and
a
rug
right,
but
I
actually
want
to
about
what
is
the
difference
between
an
actual
Dev
team
cash
out
and
a
rug,
because
a
lot
of
times,
Dev
teams
I
mean
a
lot
of
times.
Dev
teams
need
to
cash
out
of
their
funds
right,
they
make
money,
they
need
to
be
able
to
move
their
money
around
and
do
things
that
maybe
not
not
isn't
crypto
right.
A
How
do
they
actually
do
that
and
I
want
to
give
you
guys
an
example
of
how
legit
team
looks
like
when
they're
Cashing
Out
versus
an
illegit
team,
because
I
think
the
the
comparison
is
quite
Stark.
So
in
this
example,
what
we
have
here
is
we
have
10
ktf,
which
is
a
very
large
nft
project.
They
get
proceeds
right
from
their
nft
sales,
and
you
can
see
that
on
chain
and
all
of
those
are
then
sent
to
the
10K
TF
deployer
address
that
deployer
address
then
sends
on
to
their
gnosis
multisig.
Fine.
A
That
seems
fair
right.
Another
thing
that
we
also
see
too
is
renga
deployer.
They
also
send
funds
onto
our
gnosis
multisig.
So
if
you
weren't
following
projects
which
I
wasn't
I
had
no
idea,
these
projects
were
intertwined
actually
until
I
was
looking
at
their
gnosis
multi-sig
and
actually
found
oh
wow
they're,
clearly
a
part
of
the
same
ecosystem
right
and
if
you
take
a
look
at
their
gnosis
multisig
and
by
the
way
this
is
a
great
practice
right.
You
want
to
see
a
project
using
a
multi-zig
and
keeping
their
funds
locked
up
there.
A
They
sometimes
will
actually
Cash
Out
directly
to
FTX
right,
but
they
do
this
over
time
right,
their
website
is
still
active.
Their
social
media
is
still
active.
These
guys
are
still
clearly
involved
with
the
community
right.
So
nothing
weird
is
going
on
here.
This
is
the
kind
of
activity
you
want
to
be
seeing
when
you're
analyzing
on
chain,
seeing
where
devs
are
cashing
out
at
now.
What
do
you
not
want
to
see?
A
This
is
exactly
what
you
don't
want
to
see
so
I'm
sure
you
guys
heard
about
the
squid
Game
Rug
pull
last
year,
but
essentially
the
squid
team
token
launched
right
on
the
BSC
Network
and
what
effectively
happened
was
you
couldn't
trade
this
squid
token,
so
you
could
only
trade
it.
You
could
only
buy
it
with
BNB
because
it
was
on
the
pan.
It
was
on
pancake
swap,
but
you
couldn't
sell
it
so
effectively.
A
What
happened
was
the
price
was
driven
up
to
like
twenty
five
hundred
dollars
right
and
suddenly
one
day
the
website
404s,
all
social
medias
are
gone.
All
social
medias
are
deleted
right
and
suddenly,
then
the
squid
token
is
swapped
for
B
and
B
and
fully
dumped
right.
Suddenly,
the
squid
token
now
is
valueless.
Now
one
thing
the
devs
did
right
here,
though,
is
they
decided
to
unlimit
that
contract?
A
So
this
suddenly,
you
could
actually
sell
your
squid,
but
of
course
it
was
worthless
so
who
cared
at
that
point
in
time
right
and
so
anyways
you
had
this
B
and
B
right.
These
guys
then
decided
to
rapidly
send
that
BNB
through
tornado
right
and
again,
this
was
a
very
high
volume
going
through
tornado
at
that
point
in
time,
so
it
was
kind
of
traceable.
A
Now,
there's
one
thing
to
note
about
privacy
protocols,
privacy
Protocols
are
incredibly
important,
I'm,
not
trying
to
be
a
proponent
here
in
this
presentation
to
say:
oh,
you
know
we
can
demix
everything
you
know
or
whatever,
but
what
I
am
trying
to
say
about
privacy
Protocols
are
that,
unfortunately
illicit
actors,
while
they
do
use
them?
It
is
quite
easily
traceable
to
see
where
they're
moving
funds
to,
because
usually
they
move
a
ton
of
money
at
once,
and
why
do
they
do
that?
Because
they're
paranoid?
A
They
don't
trust
anyone
with
that
money,
but
themselves,
so
the
sooner
they
can
get
that
money
out
the
better
right
privacy
Protocols
are
incredibly
important
and
I
think
we're
going
to
still
continue
seeing
in
the
them
in
the
space.
In
fact,
I've
been
super
excited
to
see
all
the
ZK
Stark
discussion
here
right
but
effectively.
A
So
it
was
super
super
obvious
now,
once
they
had,
this
die
in
this
eath-based
die
what
they
end
up
doing
with
it.
Well,
this
each
base
die,
they
ended
up
swapping
for
ease,
and
then
they
sent
it
through
tornado
one
more
time
on
ethereum
right
and
they
could
not
be
more
paranoid
right
but
of
course,
they're
moving
this
money
through
super
super
fast
again
super
obvious.
Now
one
thing
I've
noticed
actually
about
these
attackers.
More
recently
is,
and
especially
in
the
squid
game
situation.
A
Right,
as
you
guys
remember,
this
particular
rub
was
super
super
known
right.
This
was
all
over
mainstream
media
right,
so
this
guy
was
Super,
Hyper
paranoid
right.
So
what
he
decided
was
this
oh
I'm
just
gonna
sit
on
this
money
for
a
while,
but
he
just
didn't
want
to
sit
on
that
eat.
No,
no,
no!
No!
A
So
it's
one
thing
to
also
think
about
now.
I
want
to
leave
you
guys
with
a
couple
predictions,
because
I
only
have
a
couple
minutes
left
is
and
by
the
way,
I
wrote
this
slide
deck
a
week
ago.
This
was
before
the
BNB
Bridge
attack.
This
was
also
before
mango
Finance,
but
unfortunately
this
is
now
reality.
We
expect
we
see
hacks
and
scams
continue
even
in
the
bear
market
right.
A
D5
protocols,
particularly
those
with
high
tvl
right,
will
continue
to
be
perceived,
unfortunately,
as
honey
pots
right
and
threat
actors,
as
I
was
talking
about
before
they're,
mainly
going
to
continue
sitting
on
funds
right,
that's
actually
what
we're
seeing
with
the
BNB
Bridge
attacker
right
now
he's
just
sitting
on
the
funds.
We
see
that
actually
with
quite
a
few
different
attackers
at
the
moment
right
and
to
possibly
earn
yield
right.
For
example,
if
you
take
a
look
at
mango
Finance
guy,
what
do
you
think
he's
investing
in
right?
A
Now,
I'm
not
going
to
say
you
guys,
look
it
up
anyways
some
quick
break
predictions
right,
first
and
foremost,
be
paranoid
right.
Hopefully
this
has
been
a
lesson
in
paranoia
here
and
you
want
to
protect
yourself
before
something
happens
right.
You
don't
want
stuff
to
be
broadcast
to
the
chain
right.
That
is
the
like.
That
is
the
ultimate
like
thing
that
you
do
not
want
to
have
happen
because
once
it's
broadcast
to
chain,
it's
done
right.
Money
is
gone
right
and,
of
course
you
want
to
do
your
own
research.
That
should
be
obvious
right.
A
Do
not
rely
on
other
randos
to
do
research
for
you
and
just
believe
them,
because
they're
anons
on
Twitter
that
you
know
what
they're
saying
is
correct.
You
want
to
verify
and
last,
but
certainly
not
least,
definitely
learn
how
to
read
a
block.
Explorer
block
explorers
are
extremely
powerful
and
all
of
this
research
I,
actually
mostly
did
using
Dune
analytics
and
just
etherscan
as
well
as
be
a
c
scan
a
couple
others
and
don't
forget
to
set
up
monitoring,
and
that's
all
thanks
guys.