Unchained

Traders tried to lose money fast to earn PAPER. Now the token may never be transferable, and one tracker shows staking revenue fell 93% in a day.

========================================================

Thank you to our sponsor!

Put your crypto to work with Nexo: earn daily interest or borrow funds against your assets on one platform trusted by more than 10 million clients.

Find out more at ⁠⁠⁠https://unchainedcrypto.com/go/nexo-podcast-sn⁠⁠⁠.

Geo-restrictions, eligibility and terms apply.

========================================================

Quick favor: We're deciding what Unchained does next; new shows, stream times, what's worth paying for.⁠⁠⁠⁠⁠⁠⁠⁠⁠ Our listener survey⁠⁠⁠⁠⁠⁠⁠⁠⁠ takes five minutes, it's anonymous, and I read the write-in answers myself. Everyone who takes it can enter a drawing for a free year of Unchained Premium or Bits + Bips Premium. Open through Sunday, October 18.

— Laura

========================================================

PaperTrade drew $140 million in pre-deposits and for one day flipped Nasdaq's daily notional volume by letting traders take up to 1,000x leverage against the house, with a PAPER token as the rebate for losing. Then the team announced it no longer plans to make PAPER transferable.

Jason Pagoulatos, Head of Markets at Delphi Research, joins Laura Shin to unpack how the protocol works and why the reversal landed so badly. He walks through the house pool that pays winners from losers' margin, the launch-day trader who pushed ETH around on Hyperliquid to move PaperTrade's price feed, and why a transferable PAPER would invite a larger attack.

Pagoulatos says the team's reasoning holds up but calls the change a bait and switch for everyone who deposited under the original rules. With one tracker showing staking revenue down 93% in a day, the conversation ends on what makes any token worth holding: a business that would work without it.

Host:

⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Laura Shin⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, Host / Unchained

Guest:

⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Jason Pagoulatos - Head of Markets at Delphi Research

Timestamps

🎬 00:00 Intro

⚡ 02:01 What PaperTrade is and why it briefly flipped Nasdaq's daily volume

🎰 06:46 How PaperTrade's house pool pays winners and mints PAPER for losers

🚀 10:32 Launch week: $140M in pre-deposits and a price-feed play on day one

💰 15:12 Nexo: Generate daily interest on your crypto or borrow funds against your assets at https://unchainedcrypto.com/go/nexo-podcast-yt

🔒 15:59 Why promise transferability if the risk was already in the docs?

🔄 17:31 Why PaperTrade shelved plans to make PAPER transferable

📉 24:07 Is PaperTrade over after a 93% one-day drop in staking revenue?

🧱 27:52 Why Jason says tokens should be judged like equity in a real business
Learn more about your ad choices. Visit megaphone.fm/adchoices

A certificate authority's private key was the number 4 for over a year. Kain, Taylor, and Austin on why the internet's trust schemes are cracking.

========================================================

Thank you to our sponsor!

Put your crypto to work with Nexo: earn daily interest or borrow funds against your assets on one platform trusted by more than 10 million clients.

Find out more at⁠ Nexo⁠.

Geo-restrictions, eligibility and terms apply.

========================================================

Quick favor: We’re deciding what Unchained does next; new shows, stream times, what’s worth paying for.

⁠⁠⁠⁠Our listener survey⁠⁠⁠⁠ takes five minutes, it’s anonymous, and I read the write-in answers myself. Everyone who takes it can enter a drawing for a free year of Unchained Premium or Bits + Bips Premium. Open through Sunday, October 18.

— Laura

========================================================

For more than a year, the private key behind signatures from a certificate authority trusted across the internet was the number 4.

Taylor Monahan walks Kain Warwick and Austin Griffith through how eMudhra passed two audits with eight weak keys, and why revoking them now runs on an email thread between Google, Mozilla, and Apple. Kain argues it fits a pattern: schemes that assumed nobody would bother trying, now facing AI agents that never stop.

The hosts also cover two remote code execution bugs in PHP, Austin's $1 test that drew three competing theft transactions the moment it landed, papertrade's 1,000x leverage launch and its lose-to-earn token, and why DeepSeek keeps getting cheaper even as DHS bans it for government use. They close on Anthropic, and Kain's case that any frontier lab that turns cash-flow positive would be worth "infinity," a prospect he calls petrifying.

Hosts:

⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Kain Warwick⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ - Host of Uneasy Money and Founder of Infinex and Synthetix

⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Taylor Monahan⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ - Co-host of Uneasy Money and Security Expert

⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Austin Griffith⁠⁠⁠⁠⁠ - Co-host of Uneasy Money and Builder Enablement at Ethereum Foundation

Timestamps

🎬 00:00 Intro

🌐 02:07 Why a burst of unrelated internet-breaking bugs landed in the same 48 hours

🔑 05:13 How a certificate authority's private key turned out to be the number 4

📧 17:47 Why revoking bad certificates runs on a literal email thread

🤖 22:52 Kain on why schemes built on human laziness are unraveling against AI

🐘 25:34 PHP to shell: two remote code execution bugs in the language behind the web

🛡️ 33:21 How Cloudflare is shielding unpatched PHP admin panels during the rollout

🎣 36:04 Austin's $1 test: how fast bots drained a weak Ethereum private key

💼 37:44 Nexo: Generate daily interest on your crypto or borrow funds against your assets at https://unchainedcrypto.com/go/nexo-podcast-yt

🪣 38:25 papertrade's 1,000x 'bucket shop' and the token you earn by losing

📚 48:55 The mechanism design lessons hidden under DeFi Summer's degeneracy

🐋 52:35 How DeepSeek keeps getting smarter while Kain's API bill fell to $3 a month

🏛️ 57:06 Why DHS banned DeepSeek and why Austin says local models are the safer bet

♾️ 01:05:13 Why Kain says Anthropic gives off SBF vibes and could be 'worth infinity'

🎯 01:14:23 The drained-key update: bots grabbed 10-digit keys, but 12 digits held
Learn more about your ad choices. Visit megaphone.fm/adchoices

Justin Drake says crypto should brace for AI breaking elliptic curves before Q-Day. Project Eleven's Alex Pruden and Conor Deegan weigh in on what's actually at risk.

========================================================

Thank you to our sponsor!

Put your crypto to work with Nexo: earn daily interest or borrow funds against your assets on one platform trusted by more than 10 million clients.

Find out more at ⁠⁠https://unchainedcrypto.com/go/nexo-podcast-sn⁠⁠.

Geo-restrictions, eligibility and terms apply.

========================================================

Quick favor: We're deciding what Unchained does next; new shows, stream times, what's worth paying for.⁠⁠⁠⁠⁠⁠⁠⁠ Our listener survey⁠⁠⁠⁠⁠⁠⁠⁠ takes five minutes, it's anonymous, and I read the write-in answers myself. Everyone who takes it can enter a drawing for a free year of Unchained Premium or Bits + Bips Premium. Open through Sunday, October 18.

— Laura

========================================================

Ethereum researcher Justin Drake set off a debate across crypto by urging chains to plan for "bunker mode," a controlled migration of assets to addresses whose public keys stay hidden behind a hash. His concern is not only quantum computers, but AI getting good enough at math to break elliptic curves first.

Alex Pruden, co-founder and CEO of Project Eleven, and Conor Deegan, its CTO, join Laura Shin to sort out what is at risk. They cover how ECDSA works, why Conor says no scheme in production is broken yet even though Hawk and McEliece fell to AI attacks, why Coinbase's Yehuda Lindell notes hash functions have broken more often than curves, and why NIST still favors lattices.

Alex updates his Q-Day window to 2030 at the earliest and 2033 to 2035 as more likely than not. Both argue the post-quantum and post-AI migrations are the same work, and the chains most at risk may be those doing nothing.

Host:

⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Laura Shin⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, Host / Unchained

Guests:

⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Alex Pruden - Co-founder and CEO of Project Eleven

Conor Deegan - CTO of Project Eleven

Timestamps

🎬 00:00 Intro

🛡️ 02:20 Why Justin Drake's 'bunker mode' tweet adds AI to quantum as a crypto threat

🔑 06:01 What ECDSA is and why its hidden 'trapdoor' structure worries people about AI

🧮 08:33 Why Conor says no scheme is broken yet, even as two cryptographic schemes fell to AI

🔐 13:06 Matthew Green's encryption warning and why privacy chains like Zcash are exposed

💼 17:20 Nexo: Generate daily interest on your crypto or borrow funds against your assets at https://unchainedcrypto.com/go/nexo-podcast-yt

⚖️ 18:04 Where Conor lands between Yehuda Lindell and Justin Drake on AI breaking curves

🏦 25:53 Can blockchains recover if ECDSA breaks? Alex on the ETH Classic fork precedent

🧩 29:59 Curves, lattices, isogenies, or hashes: why NIST still prefers lattices

📅 48:14 Alex's updated Q-Day window and why Conor says 'A-Day' may already be here

🚨 53:05 Haseeb Qureshi's 'cryptographic wartime' and Balaji's rollback idea

🏗️ 58:41 Strongpoint: Project Eleven's crypto-agile custody and pricing quantum risk
Learn more about your ad choices. Visit megaphone.fm/adchoices

A hidden implant read Ledger seed phrases off the screen and sent them out over an eSIM. Mark Karpelès and SEAL 911's Jonty discuss what that means for self-custody.

========================================================

Thank you to our sponsor!

Put your crypto to work with Nexo: earn daily interest or borrow funds against your assets on one platform trusted by more than 10 million clients.

Find out more at ⁠https://unchainedcrypto.com/go/nexo-podcast-sn⁠.

Geo-restrictions, eligibility and terms apply.

========================================================

Quick favor: We're deciding what Unchained does next; new shows, stream times, what's worth paying for.⁠⁠⁠⁠⁠⁠⁠ Our listener survey⁠⁠⁠⁠⁠⁠⁠ takes five minutes, it's anonymous, and I read the write-in answers myself. Everyone who takes it can enter a drawing for a free year of Unchained Premium or Bits + Bips Premium. Open through Sunday, October 18.

— Laura

========================================================

An estimated $100 million or more has been drained from Ledger hardware wallets sold through CryptoBilis, an authorized reseller in Southeast Asia. The devices carried a hidden implant that reads the seed phrase off the screen and sends it out over an eSIM.

Jonty, founder of Pangolin Intelligence and a SEAL 911 contributor, and Mark Karpelès, CEO of Karpelès Lab, join Laura Shin to trace how the attack was found and how far it may reach.

They cover drains dating back to September 8, a tampered Ledger Flex bought from Metapod at Singapore's airport, the two MediaMarkt devices a buyer in Europe traced to distributor Aqipa, and Tether's $10 million freeze.

Mark argues Ledger's manual sends mixed signals by picturing the device's insides while warning that opening it voids the warranty, then opens a Nano X on camera to show what to look for.

The open question is whether self-custody's best defense against malware has become its newest attack surface.

Host:

⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Laura Shin⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, Host / Unchained

Guests:

⁠⁠⁠⁠⁠⁠⁠⁠⁠Mark Karpelès - CEO of Karpelès Lab Inc.

⁠⁠⁠⁠⁠⁠⁠⁠⁠Jonty - Founder of Pangolin Intelligence and Contributor to SEAL 911

Timestamps

🎬 00:00 Intro

🚨 03:50 How Jonty spotted the Ledger drains through SEAL 911 victim reports

📡 05:52 How the implant reads a 24-word seed phrase and sends it out by eSIM

🛫 11:33 Mark on the spy implant he found in a Ledger Flex bought in Singapore

🕵️ 15:16 CryptoBilis or a distributor? Mark and Jonty on who could be behind it

📣 17:38 Nexo: Generate daily interest on your crypto or borrow against your assets at https://unchainedcrypto.com/go/nexo-podcast-yt

🇪🇺 18:19 MediaMarkt and Aqipa: has the Ledger implant reached Europe?

🛒 27:00 Buying direct vs. through a reseller, and why Vietnam needs resellers

🔐 31:30 Ledger's 'tamper-proof' notice and whether self-custody is dead

🔧 36:45 Mark opens a Nano X on camera to show how to check for an implant

🧊 40:33 Tether's $10M freeze and why Jonty says recovery could take years
Learn more about your ad choices. Visit megaphone.fm/adchoices

A Ledger reseller's devices shipped with a hidden LTE modem inside. Taylor Monahan lays out how it passed the genuine check and why panicking now costs more.

========================================================

Thank you to our sponsor!

Put your crypto to work with Nexo: earn daily interest or borrow funds against your assets on one platform trusted by more than 10 million clients.

Find out more at Nexo.

Geo-restrictions, eligibility and terms apply.

========================================================

Quick favor: We’re deciding what Unchained does next; new shows, stream times, what’s worth paying for.

⁠⁠⁠Our listener survey⁠⁠⁠ takes five minutes, it’s anonymous, and I read the write-in answers myself. Everyone who takes it can enter a drawing for a free year of Unchained Premium or Bits + Bips Premium. Open through Sunday, October 18.

— Laura

========================================================

Genuine Ledger devices sold through the reseller CryptoBilis shipped with an LTE chip and eSIM wired inside, intercepting seed phrases on their way to the screen. The losses are estimated at $70 million to $100 million over roughly four months.

Kain Warwick, Taylor Monahan, and Austin Griffith trace how the implant passed Ledger's genuine check, why panicked users are now losing money to phishing and fake apps, and whether an iPhone or a DIY build makes a better hardware wallet.

They also cover the recording device planted in OpenAI's office, the decade-old XRP infinite mint bug that earned a $250K bounty, and why Taylor finds Google's Chrome payouts and $40K compute bills the more interesting math.

Then StarkNet's talk of becoming an L1 turns into a debate over whether Ethereum will need L2s at all. Kain's answer: the most Ethereum-equivalent chain is Ethereum itself.

Hosts:

⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Kain Warwick⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ - Host of Uneasy Money and Founder of Infinex and Synthetix

⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Taylor Monahan⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ - Co-host of Uneasy Money and Security Expert

⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Austin Griffith⁠⁠⁠⁠ - Co-host of Uneasy Money and Builder Enablement at Ethereum Foundation

Timestamps

🎬 00:00 Intro

🔐 01:32 Why a Ledger reseller became the entry point for a supply chain attack

📡 09:15 Taylor on how the CryptoBilis attack moved past fake devices and scratchers

🧯 19:01 Why Taylor says panicked Ledger owners now face the bigger risk

💸 20:17 Why Austin sees DIY hardware wallets as the future

🕵️ 30:34 How Taylor “demixed” Zcash by following the gas trail

📣 34:52 Nexo: Generate daily interest on your crypto or borrow funds against your assets at https://unchainedcrypto.com/go/nexo-podcast-yt

🎙️ 35:37 What the bug planted in OpenAI's office says about AI espionage

🛠️ 41:42 Austin's homemade Alexa, blood wallet, and AI-run electronics bench

🪙 48:04 Why a decade-old XRP infinite mint bug points to AI-assisted hunting

🧮 51:04 Is $250K enough? Taylor compares the XRP bounty to Google's Chrome payout

⛓️ 01:00:30 StarkNet wants to become an L1: why Kain thinks that's where L2s end up

🏚️ 01:11:03 How MegaETH shows why L2 ecosystems struggle to keep their apps
Learn more about your ad choices. Visit megaphone.fm/adchoices