430: How AI Is Supercharging Crypto Hacks , And What Founders Must Do Now with Guest Speaker Peiyu Wang from CertiK

EPISODE DESCRIPTION  I sat down with Peiyu from CertiK at Korea Blockchain Week in Seoul for a deep dive into the evolving world of Web3 security. We talk about how AI is shrinking the attack lifecycle from months to days, why getting audited still doesn't guarantee you're safe, and how attackers are now conducting in-person social engineering campaigns that play out over six months before striking. Peiyu breaks down the biggest hacks of the year, explains the difference between custodial and non-custodial risk, and gives founders practical advice on how to build with security from day one. If you're building in Web3 or investing in protocols, this one is essential listening. DISCLAIMER Nothing mentioned in this podcast is investment advice and please do your own research. It would mean a lot if you can leave a review of this podcast on Apple Podcasts or Spotify and share this podcast with a friend.  Be a guest on the podcast or contact us - https://www.web3pod.xyz/  CONNECT  CertiK Website: https://www.certik.com/ CertiK Twitter/X: https://x.com/CertiK CertiK LinkedIn: https://www.linkedin.com/company/certik/home/ Peiyu LinkedIn: https://www.linkedin.com/in/p3iyuwang/?isSelfProfile=false Web3 with Sam Kamani: https://www.web3pod.xyz/  KEY POINTS WITH TIMESTAMPS  • [00:00] AI is compressing the attack lifecycle , finding zero-day vulnerabilities that once took a month now takes a day or two • [00:24] The Drup protocol attack involved an attacker meeting the victim in person at a crypto conference and spending six months building trust before deploying malware • [01:01] Sam interviews Peiyu from CertiK live at Korea Blockchain Week in Seoul • [02:16] Institutional financial companies are increasingly focused on digital assets , stablecoins, tokenization , and security is their top priority • [03:25] The three biggest hacks of the year: a $300M+ infrastructure exploit, the CollabDAO bridge attack, and the Drup social engineering incident • [05:12] Social engineering is rising fast , fake Zoom links, Telegram impersonation, and phishing attacks are becoming standard attack vectors • [07:05] Defense-in-depth is critical: EDR software, strong monitoring, and a SOC team can stop attackers even after initial compromise • [09:47] Getting audited isn't enough , auditor quality, scope limitations, and ignoring off-chain components leave major gaps • [12:20] CertiK reviews the full architecture even when only part of the system is in scope and recommends penetration testing for off-chain components • [13:03] Manual audits, formal verification, static analysis, and AI are complementary , not replacements for each other • [14:15] CertiK has built an AI Auditor tool that is publicly usable and can catch most issues a human auditor would find • [16:14] April saw more than 30 hack incidents with only three hack-free days , AI is directly driving this surge • [17:35] The best defense against AI-powered attacks is using AI on the defense side too , AI-empowered security engineers and agent SOC monitoring • [18:28] Custodial vs non-custodial risk explained , hardware wallets from reputable providers, and understanding multi-sig, MPC, and HSM-based custody options • [21:17] Founders should adopt a secure-by-design mindset , hire security engineers early and engage a security firm at the architecture stage before writing code • [22:47] CertiK's biggest challenge is keeping pace with new technology , every new protocol or EIP needs to be understood and threat-modeled before they can secure it