#12 The Context: A Bridge (Hack) Too Far

Mar 31, 2022

Hi, I hope you’ve had a good week. Ukraine is lower on our radar this week, although check out the reading section for an interesting dive into how sanctions evasion via crypto works, and how it is being monitored. Elsewhere: some unnerving aspects of recent scams, the unlikely role of blockchain in cross-border interbank payments, and how taxation may be a key driver in taking crypto mainstream.

As usual, a disclaimer: This newsletter collates the main themes and headlines of the week in DeFi/crypto/metaverse/web3/NFT land and offers some context. It’s aimed at anyone who wants to keep an eye on the space but isn’t following it too closely, or is on the hunt for story ideas and angles. It’s put together by a team at YAP, and doesn’t contain any promotion of our clients (if one is mentioned, we’ll flag that).

Your feedback is as always welcome. Ping us at thecontext@yapglobal.com

[tl;dr]

Scams new and old A “GDP-sized” hack of the home of Axie Infinity has again highlighted the vulnerability of bridges between blockchains, while ApeCoin highlights another weak link: users' love of airdrops, which can leave wallets vulnerable to hacks. And some news about old hacks to remind us that all that's changing is the sophistication of hacks, not their size.
The banking industry is toying with a central bank digital currency to make interbank settlements easier. It’s not how some countries are viewing CBDCs, but it does promise a real-world use for blockchain, which has to be good for broader understand and adoption.
Taxation is another vector for change: while some city governments see crypto as a way to raise funds, national governments and international organisations are primarily thinking of crypto as something they need to monitor better for two things: to protect citizens from scams, and as something to tax.

[Crypto’s security challenge]

As DeFi gets more creative in its financial instruments, so there will be appetite to figure out how to game the system, or even hack it. Last week we mentioned that someone had borrowed 5 Bored Apes to claim $1.1 million of APE tokens. Is that considered a hack, an attack on the system or simply smart arbitrage? we asked. Since then a definite scam has led to the loss of a similar amount; this time a Twitter scammer used verified accounts to make a fake ApeCoin airdrop, according to Decrypt. Among the victims were apparently a couple of journalists: Gavin Quinn, a sports journalist, and Todd Wasserman, a freelancer who three years ago wrote for the New York Times about his cardiac arrest. More worrying, perhaps, were that a former DoD cybersecurity expert had his wallet exploited -- without ever clicking on the malicious link that led to other Twitter accounts being hacked.
But the main worry is about the security of bridges -- which allow tokens designed for one blockchain to be used on another. Bloomberg's Olga Kharif explores how bridge hacks have stolen $1 billion in little over a year, using data from Chainalysis. Axie Infinity parent Sky Mavis has said it is ‘fully committed’ to reimbursing players after hackers stole about $600 million from the game via a bridge. Binance, the exchange, suspended deposits and withdrawals on Axie Infinity’s Ronin Network.
Old fashioned Ponzi: Described in some media as the world's biggest crypto scam to date, India's $3.8B GainBitcoin scam is slowly moving to a conclusion. GainBitcoin was a typical Ponzi scheme, according to a paper (PDF) by the Indian Institute of Corporate Affairs, or IICA. The scam ran from 2015 and 2018, allegedly cheating some 8,000 investors, acquiring 82,132 bitcoin (worth US$3.9 billion). India's Supreme Court has ordered the brother of the late Amit Bhardwaj, alleged mastermind of the scam, to cooperate with the authorities by providing the keys to a Bitcoin wallet. If the numbers are correct, GainBitcoin would be bigger than the Bitconnect ICO ($3.45 billion) though smaller than OneCoin, the pseudo-crypto Ponzi scheme which U.S. prosecutors allege brought in some US$4 billion.
And talking of ancient history, Forkast reported that **Mt. Gox** may return Bitcoin worth over $6 billion, based on an interview with Mark Karpeles, the original Japanese suspect for the crime. The headline is a bit of a misnomer: yes, customers may be (partially) reimbursed using coin that has been recovered, but that's not really news. More interesting is Karpeles' experience in the Japanese criminal system -- and his new venture, a rating agency for cryptocurrency exchanges around the world, of course called UNGOX. NFTs will grant former Gox customers free access.

[Crypto’s foothold in TradFi]

Banks are slowly grasping the utility of blockchain technology but it’s hardly been transformational. While the interesting stuff is on the other end — crypto players trying to obtain a foothold in TradFi to help users move more seamlessly between fiat and crypto — there are signs within the banking world of adopting some of the underlying technology.

CBDCs: The Bank for International Settlements or BIS, is working with four central banks to develop prototypes for an international settlement platform for central bank digital currencies, or CBDCs. The collaboration, called Project Dunbar, focuses on how a shared platform incorporating several CBDCs could help make cross-border payments "cheaper, faster and safer”, according to The Block. The project report can be found here. What's interesting is that the BIS embraces DeFi concepts such as blockchain and smart contracts in the project -- something that is not necessarily a given in CBDC projects. Indeed the project team worked with Corda, the distributed ledger platform developed by banking consortium R3, and Partior, the Singapore interbank payment system founded last year by JP Morgan, DBS Bank and Temasek, to develop two prototypes, which were “designed meet regulatory requirements around in-country data and is compatible with next-generation crypto primitives such as ZKP (zero-knowledge proof).” It seems plausible that if CBDCs are going to take hold internationally, the onerous, expensive and complex cross-border element of finance would be as good a place as any to kick things off. How 'crypto', or relevant to the world of DeFi, this really is will only be clearer later.
Meanwhile, crypto exchanges are elbowing their way in from the other side. If they can get licenses that allow them to take on some of the functions of traditional banks, they could create better on- and off-ramps to and from fiat for their customers. Kraken Bank, the Wyoming subsidiary of Kraken exchange, has received a routing number from the American Bankers' Association. This brings them closer to being granted the same access to the global payments system (the one the Dunbar project is trying to speed up via a CBDC.) This tweet demonstrates the utility: “When I sent myself a fiat wire from my @KrakenFX account in 2017 my bank closed my checking account after investigation found no way to determine the true original sender was Kraken. Kraken had to route my wire via someone else’s business account in Kentucky. Nightmare over.”

[Regulating Crypto]

Government attitudes are key. And although it may not sound like a good thing, the most likely avenue to understanding and acceptance of crypto is through figuring out how to tax it. At the same time no government, national or local, with an eye on wooing investment and cultivating a modern image wants to be seen as crypto-hostile. So the dance goes on:

Shining cities: Austin mayor embraces Web3 tech and crypto payments***: initiatives include exploring how the second fastest-growing city in Texas could use web3 stuff in 20 fields (smart contracts, supply chain management etc) and also how residents could legally pay bills with crypto. They're not the first to jump aboard, though there seems to be something of a critical mass gathering. Miami and New York have already launched their own city-wide coin projects through something called CityCoins. The idea is for each city to have their own token, which residents (or anyone) can buy. Those tokens will earn Bitcoin and STX (Stacks, part of Blockstack, a layer 2 protocol for Bitcoin) for holders, while the cities themselves will use the funds gained from the sale of tokens to do what cities usually do. The longer term appeal for holders? As more developers and businesses develop apps which use the tokens as rewards, access control, etc, the coins themselves will gain in value.
Backsliding: On the other side of the world, and fence, we have Thailand, whose Security and Exchanges Commission has banned cryptocurrencies for payment and has proposed another rule that would require disclosure of system failure from exchanges. It's that latter point which the government is most concerned about, in particular problems using cryptocurrencies in retail transactions. The Bank of England is also still working on a first regulatory approach to crypto, but has acknowledged that changes in the law would be required, as well as an expansion of, and close coordination between, regulators. Regulation for the sector should be based on "equivalence", meaning that crypto-related financial services that perform a similar function to existing financial services should be subject to the same laws, Reuters quoted the Bank of England as saying. Full statement here: Financial Stability in Focus: Cryptoassets and decentralised finance.
Taxation: The U.S. hopes to raise an additional $11 billion in revenues between 2023 and 2032 by taxing digital assets, according to a new budget proposal from the Biden administration. The new rules target digital assets and derivatives that are determined to have been regularly bought and sold for fiat, have enough volume to generate reliable valuations and have available reliable price quotes, according to CoinDesk. At the same Treasury Secretary Janet Yellen admits skepticism about crypto, but acknowledges there are benefits. And India has ordered a 30% capital gains tax on crypto transactions, as well as a 1% tax deducted at source on buyers and sellers of crypto. The capital gains tax will kick in April 1. Needless to say, there's been an industry uproar. And the Organisation for Economic Cooperation and Development, or **OECD,** has proposed some rules for member jurisdictions to use to collect and exchange information on crypto transactions. This is the first of three such rules proposed by the OECD. The proposed rules "would require certain intermediaries (including crypto-asset brokers, dealers, and exchange service providers) that reside, are organized, are managed, or that have a regular place of business in a particular jurisdiction to abide by certain due diligence and reporting requirements in that jurisdiction," according to TL Fahring, who wrote an analysis for Freeman Law. (A good guide to crypto and the law can be found on the company's website.)

[Tidbits]

Bear markets: Is the bear market over? And are those in and outside DeFi taking crypto more seriously? David Hoffman of the Bankless newsletter sees a shift, where “TradFi market analysts (are) increasingly tapped into the crypto markets too. People who usually talk only TradeFi now have their attention on the crypto.” Not only that, but that last bear market, "it took people 3 years to realize that crypto wasn’t dead yet. This time, it seems that it just took 3 months for people to realize that Q1 2022 was a huge buying opportunity.”
A few deals: A16z, FTX and Sequoia led a $135M round for LayerZero, valuing the blockchain interoperability protocol at $1 billion. Helium has changed its name to Nova Labs, and has announced a $200M round on a $1.2B valuation. Helium is a blockchain-based peer-to-peer wireless network rewarding anyone to become a network operator with a native token. And Cross River Bank, a NJ-based institution has raised $620 million in total funding, by pursuing a crypto-first strategy, while other banks have steered clear.

[Reading]

Cryptocurrency Brings Millions in Aid to Ukraine, But Could It Also Be Used For Russian Sanctions Evasion? A good dive into what crypto sanction-evasion look like, from Chainalysis, who know about this kind of thing.
Anonymity in Crypto Raises Alarm - The New York Times David Yaffe-Bellany looks at the pluses and minuses over anonymity (well, actually pseudonymity). It's a longer piece, picking up quite a bit of the nuance, and emphasising the damage that can be caused by rug pulls by pseudonymous founders. One key actor in this: the pseudonymous Twitter user zachxbt who has exposed, or doxxed, some of the cases. His motives can be found in his profile: “10x rug pull survivor.”
A feature by Vivienne Walt on Binance founder “C.Z.” Zhao, and how he became a $74 billion man while moving fast and breaking things in crypto. But his vision, especially in the light of the Ukraine invasion and the recent loss of his father to cancer, is perhaps more interesting: “This is the first time in human history that we can collectively agree and maintain a record, and no one person is in charge,” he says. “That has profound implications.”

This newsletter is pulled together by a team led by Jeremy Wagstaff, formerly of the WSJ, BBC and Reuters and Samantha Yap, founder of YAP Global. Other members: Ruby Wu, Roslyn Tear, Rebecca Campbell and Becky Corbel. Many thanks to Joey Woo for production. Any views expressed here are not necessarily those of the writers, YAP Global or its clients.