A Hacker's Guide to Blockchain, Smart Contracts, and NFTs

The talk opens with the speaker's take on Facebook renaming itself Meta and pushing into the metaverse, arguing that security teams will soon need to understand blockchain whether they like it or not. It then describes distributed ledgers as replicated, tamper-evident databases and runs the CIA triad against them. Confidentiality is presented as weak on public chains, where balances and transactions can be inspected, while integrity and non-repudiation are seen as strong points. Availability is tied to gas fees, which can make transactions expensive or impractical when a network is congested.

The middle section covers smart contracts as code stored on-chain, usually written in Solidity and called through web3 libraries that work much like a payment API integration. The speaker points to the application binary interface as an attack surface that automated bots scan for misconfigurations, and gives the example of a ticket sale contract with no purchase limit. NFTs are described as ownership records that can pay creators royalties on resale, with speculation about future uses for credentials and logs.

The closing part focuses on threats and defenses. Quantum computing is raised as a possible future risk to private keys, while phishing and social engineering are described as common against wallet holders. A seed phrase is shown to grant full control of a browser-based hot wallet, and the speaker contrasts it with hardware cold wallets. Organizations accepting crypto are urged to plan custody, access control and staff departures before they start taking payments.