Hey, folks, we're recording at chain linksmark On and joining me today is Jacques Bouchang, who is the CEO of Halburn. Jack, great to have you.
Thanks for having me, Jack.
I know of Halburn, but for the folks who don't know, tell us about what Halburn does.
So we are a cyber security company fully dedicated to the WHIPS three and financial services space. We have been established in twenty nineteen, so we have been here for six years now, sure, and we provide the professional services security services to our customers, which are small Web three but also large banks like UBS.
Ority Security and custody is such a big pillar in the crypto industry, so what you're doing is so critical for this infrastructure of the market. So are you you mentioned like some of the banks you're working with. Are you also working with crypto exchanges?
We do work with entire I would say ecosystem of Web three and financial services. So we are essentially at the intersection of on chain and off chain cyber security services. You know a lot of those hacks which are happening on chain, our lateral move coming from off chain. That's why you need that competence when you speak with a provider of cyber security. We are also at the intersection of trap FI and DeFi. So that's why we are uniquely positioned in that landscape.
And I'm assuming you work with many different multiple blockchains and projects we do.
We do cover We work with a lot of layer one, layer two as well. We do a lot of secure by design where we try to shift cybersecurity left. So it's not an after thought, but it's really from the beginning, at the inception of a project. We love to be involved because that's the only way to have something very robust in terms of cyber security.
Sure, so tell us a bit about how you're monitoring blockchain transactions and monitoring transactions on exchanges. You have a software setup and you plug into those respective sources.
You ask a very interesting question. We don't, unlike in the traditional cyber security space, we're monitoring because when you monitor or you can still do what we call you can intervene. You can do incident response on chain. If something is happening, your money is gone. Yeah, so there is no such a thing as an instrumental monitoring. You can do forensic after the fact. So we prefer to do what I call preventive cyber security, Okay, to avoid that the bad guy can settle on your smart contract
or on your chain. So that's a big thing.
So that definitely makes sense. So you're preventive, you're getting ahead of those things happening. Are you using I'm assuming you have human beings monitoring things that are using AI to monitor as well.
So we are using So it's mainly the skills of our people, but it's a combination. It's a man machine partnership. So we use plenty of AI tools, plenty of automation. At the end of the day, what makes the difference of the skills of our team?
Oh? Absolutely. And in regards to what trends you're seeing and security, what are some of the common threats that have appeared over the past year or so.
Yeah, So you know, we publish almost a monthly report. We call that the Top DeFi hack okay, yeah, and voints, and we try to track every hack above one million dollars. And just to give you one number, for instance, in May of this year, the total Top Defive HACT was two hundred and thirty six million dollars.
Yeah.
In in July it was one hundred and twelve million dollars. So what we are observing is that the hacks are still massive on DeFi. So now fast forward ward, imagine now the banks doing plenty of things on chain, they'd better be safe.
Yeah. Do you feel most of the security vulnerabilities come from a human element or a code element or both.
So the weak link will always be the human.
Human That's yeah, that's that's the absolute rule of some And one of the massive hacks that happened in the beginning of the year was because of.
An insider of thread, so inside of shread a Hogue developer in that case, Hogue developer or a key thread. When you are working in web three and when you have this big total value look on chain, they can go away with the money. So still still people. But of course you need to have a waterproof or bullet proof software and this is those kind of what I call continuous implementation, continuous and follow up of the software.
Cyber security and reducing the vulnerability is a key element of our work.
That definitely makes sense. And you know, and do you feel your job is going to get a lot harder with the rise of AI, different AI agents where bad actors could potentially users. AI agents attack different blockchains.
So you're asking your question is about the weapon and the shield. AI is both weapon and shield. So I don't think it makes our work harder. It makes our work even more tech enabled. Sure, that's a big difference, right, So we need to have and we do have at alborne AI in every corner of what we do for the smart contract review, for the code assessment, but also then for creating the right reporting and so on and
so forth. So we are we have a continuous utilization of AI modules and we are using a lot of AI orchestration. But at the end of the day, as I said, it is the shield part.
Part.
Adversaries are using the weapons part of of course, with deep fakes or with spare fishing, which are even more convincing.
Yeah, it is getting much more sophisticated the threats. So let's say your team is working with a bunch of crypto exchanges and traify institutions. When you identify a vulnerability, how fast you get the information out to these folks saying hey, we recognize something's wrong with this blockchain, watch out.
Yeah, so we need to move as fast as possible. Right, We discovered altogether multiple zero days, you know, zero days you need to act immediately. So we have a lot of critical vulnerability that we discover and we make that available immediately to the customer so that they can remedy. And when we do that, we give them advises how to remedy, and AI is used also in that phase to define the best possible remedy given the context and the environment of the client.
Got it. Is it too early to think that quantum might be an issue now or in the coming year.
Yeah, of course, everybody's talking about it. Yeah, body's talking about the fact that it will break our essay, it will bake break encryption. Yeah, let's see.
Still too early, let's see. But at the same time, like you said, it's like with AI, it's the shield and the threat, right because you can use quantum computer, but you can use.
Quantum computer to encrypt at a level that nobody will be able to crack that code.
Yeah. Yeah, absolutely. I'd love to get your thoughts on what's happening in the broader crypto industry. We see that there's a race for chokenization. We're putting real world assets on chain. What are your thoughts on that and that market growing?
Yeah, so I believe so straight Threet recently published document in October, Yeah, which says that currently institutional investor of something like close to six percent of their total investment which are crypto or digital asset of any form. And the fourth is that in three years it will be three exact, so more than fifteen persons. So adoption will raise. I believe that some class of digital asset for insan private equity one will come, will take off much faster
than the other. But I also believe that the cyber security challenge for banks to custody all that will be huge. Yeah.
That's a great point because one of the things I've been thinking about you really have to trust the party that's toorgnizing that they actually have the asset in their bank or vault.
Right, there is no CSD, there is no central security depository anymore. Yeah, you know, custody today it's an easy game for a bank, right, because what is it? It is a legal game. Okay, you need it's a pointer toward an item which is at the custody at a central security depository. In the future, they are fully accountable and responsible for the custody of any digital asset. Yeah, And it's a new discipline. It's a technical discipline, so
it's it's not anymore that legal process discipline. It's a pure technical discipline. So it's a it's a big it's a big it's a big challenge, and banks are moving into that direction and we help them, We support them making the right assessment of their custody strategy.
Sure, and on that note, are you working with stable coin issuers as well? The stable We got a genius Act pass here in the United States. A lot of issuers have stable coins, you know, hitting the market now.
Yeah, absolutely, so we are definitely working with the issue of stable coins. So we used to work with Circle, with coin Base, with the likes of those guys. We are. By the way, in Europe there is also a big initiative from nine banks, the consortion of nine banks for Pride, the stable coin packed to the euro and one of those banks is the key customer of ours. We are doing the custody for them, so absolutely we are. We
are deeply involved. We are about to release the paper about the risk framework for stable coin.
Wow. Yeah, so much security needed for all these different types of assets.
And you are you're hitting a very good point. Custody of a bitcoin is not like the custody of a stable coin, which is not like the custody of the togonized equity. Those are different challenges and everybody needs to be ready for those challenges.
Sure, so tell us about about your road map. I'm assuming it involves prepping for all these different types of assets, right, I agree.
So absolutely, so our road map is definitely so. First, we see the demand ticking up for large banks for everything which is digital assets. So that's clearly the understanding this adoption. Right, they are going into that direction, but they need to have solid cybersecurity foundations. So that's what that's a key road map for us because we need to adjust to the customer requirements in that sense. Second, we mentioned that we integrate AI too links in every
step of our value chain. It's really key because as I said, it's part of the shield, and we are the shield. We are holding the shield, so we need to have the AI component. And the third component is really to be able because you know what in the future, define will be part of the supply chain of those banks. Yes, and we are the I would say the in betweener. We are the glue between because we understand both worlds.
Yeah, yeah, absolutely with regards to legislation, and here in Europe you have a legislation. Here in the United States, we're waiting for the clariac. How has legislation helped you and your company in Europe? And are you are you looking forward to the Claritia getting pass here?
So, first and foremost, I believe that the Clarity Act is an incredible piece of legislation because it allows a dynamic transition from a token being considered as equity then moving toward the commodity. So they have put a certain level of dynamic in their regulation in the US that is far superior to what we have in Europe. So I think they will be ahead of the pack because of that new US regulation, but also for the Genius Act, which has also set set up a framework which will
enable the US to be really leading the pack. So I am a little bit concerned about your being lagging behind with MICA as opposed to Clarity Act. But to your point, yes, in any cases, the two types of legislation accelerate the demand, accelerate the appetite of the traditional financial institution to go down the road of a digital asset. I was speaking to a very large bank yesterday and they told me they are about to do the first issues of equity on chain. So that would be equity
for a big corporation, so purely issued on chain. So when you go into that space, you'd better have a rock solid infrastructure.
Yes, yes, and I hope that you know what your services that you're providing. That folks are starting to think about these things and security first, because it would be very detrimental to the crypto acid class and industry. Oh yes, we had banks or big institutions losing assets.
Yeah, and that's why I was mentioning or report about the major hacks because imagine two hundred and thirty six million in May lost without any bank. Can you imagine once a bank as is nay as ear name or on that list of top acts, what's impact? Yes, So that's a key area of concern of mine. Okay, how can we make sure that it's so I would say robust that such a thing will never happen, right, and we hope to be a numbled but a contributor to that level of security that is needed.
Oh absolutely, Jacques, amazing, I love that what you guys are doing. Like I said, you're a critical pillar in this infrastructure of this market. So looking forward to the future updates. Thank you for joining me, Thanks for having me. This episode is brought to you by Proppy, which is leading the charge in putting real estate on chain. Propy
is a game changer. You can buy and sell real estate with cryptocurrencies using the Property platform, which is powered by a blockchain of course, and they have a native token call pro and I've been an investor in the Propy token since twenty eighteen. So Propy is a licensed Web three pioneer operating since twenty seventeen. They have facilitated over four billion dollars in transactions. They're putting titles and deeds on chain. They use Coinbase for their crypto escro service.
So this is a great platform. And once again they are ahead of the curve when it comes to putting real estate on chain. And they just launch a great campaign where you can earn some of the Propy tokens and it's simply by doing tasks such as sharing their vision video, signing up and inviting a friend, and much more so. If you'd like to learn more about Propy, visit the link in the description