From Hackathon to Hacked: Web3's Security Journey

## Overview

Nathan Hamiel, Senior Director of Research at Kudelski Security and Black Hat Review Board member (specifically leading the AI, Machine Learning, and Data Science track), examines the ongoing security challenges facing the Web3 ecosystem. Hamiel’s team—consisting largely of cryptographers initially working on advanced technologies like threshold cryptography and zero-knowledge proofs funded by blockchain firms—eventually established a dedicated practice helping blockchain companies secure their software.

From this four-and-a-half-year engagement, Hamiel approaches Web3 with a neutral security mindset: vulnerable technology does not benefit the world, and security professionals must help innovators build robust systems rather than remaining on the sidelines. Rather than viewing Web3 as purely a smart contract problem, Hamiel frames it as an ecosystem involving both novel and traditional technologies that must navigate compounding security challenges.

---

## Emerging Technology and the Fallacy of Exceptionalism

A central theme of the talk is that emerging technologies routinely claim exceptionalism—the misguided belief that because a technology is brand new, existing security playbooks must be discarded and written from scratch. Historically, this assumption is false.

Hamiel explains that emerging technologies almost always combine traditional infrastructure and established tech stacks with a layer of new technology. In doing so, developers trade a set of known issues and complexities for unknown issues and complexities. Security failures consistently occur precisely at the intersection where these unknown complexities emerge and interact with traditional systems.

---

## Losses, Illicit Finance, and Anonymity

The scale of financial compromise across Web3 and decentralized finance (DeFi) has escalated rapidly: - **Financial Impact**: In 2021 alone, $2.2 billion was stolen from DeFi, alongside billions of dollars flowing through illicit transactions. - **Regulatory Pressures & Mixers**: Illicit proceeds frequently route through cryptocurrency mixers for anonymization, prompting actions such as the U.S. government sanctioning a cryptocurrency mixer. - **The Paradox of Anonymity**: While pseudonymous identity serves legitimate protective purposes—especially when individuals act as their own banks and public identity could lead to targeted physical coercion or theft—it also enables malicious exploitation. Hamiel cites incidents such as the Nomad bridge exploit, where pseudonymous community members actively participated in draining funds. Failure by the community to self-police such behavior invites aggressive government regulation. - **Market Volatility**: The ecosystem also witnessed a top-10 cryptocurrency project collapse despite widespread expectations that it was the "next big thing."

---

## Expansion of Traditional Attack Vectors

While industry discussions often fixate solely on smart contract vulnerabilities, Web3 projects increasingly fall victim to traditional attack vectors: - **Communication & Social Channels**: Compromises of project Discord servers have become frequent attack paths. - **Supply Chain & Third-Party Compromises**: Hamiel highlights the breach at Customer.io, where attackers gained unauthorized access and pushed malicious notifications directly to a crypto project’s customer base.

As Web3 applications scale in user adoption and popularity, traditional supply chain, service provider, and credential compromises will continue to threaten the ecosystem alongside protocol-level vulnerabilities.