“I will say that easily 90% of organizations in this ecosystem don't have someone that really knows operational security in their company. And the worst issue is that many of them think that they are okay, but they are not okay. … If there's one thing they can do without hiring any company, it's at least get an EDR. They say, 'Oh, it's a problem for my privacy.' And in the end, what happens? They get hacked, they have no privacy and no money.”
Unchained · Crypto & Web3 · November 2026
Context
Laura Shin closed by asking what low-hanging fruit the crypto industry is missing, given that North Korea accounts for most of this year's hack losses. Pablo says most crypto security talent comes from smart-contract auditing rather than operational security, and recommends endpoint detection software as the minimum step.
Transcript
…developing personas, exfiltrating funds, laundering funds, where they're physically located, whether they interact with one another is different for each of those different groups. And it's those differences that allow us to cluster these different activities under different umbrellas.
…grade the industry's efforts to prevent these hacks. And do you feel like there's any low-hanging fruit out there that the industry isn't doing that you think it should? Like if you could give like one message to everybody, you know, about how to prevent these kinds of things, what would it be?
Yeah, I have one take. Many people will hate me for this, but I prefer people to hate me for this than to keep on financing North Korea. One problem that this industry has is that, well, it's not a problem. It's a reality is that most security researchers are smart contract security researchers that do not come from traditional cybersecurity. There are coders that then started auditing smart contracts, auditing code, so they do smart contract security. Operational security is a whole different thing. I will say that easily 90% of organizations in this ecosystem don't have someone that really knows operational security in their company. And the worst issue is that many of them. Think that they are okay, but they are not okay. Not okay at all. So, I would say, number one thing, get an operational security, right? I am obviously biased because that's what my company does, but I think that with what's happening in the ecosystem, it's pretty obvious. And then, if there's one thing that they can even do without hiring any company, is at least get an EDR, right? I think that we already talked about this. An EDR is a tool that is more advanced than an antivirus, right? An antivirus just knows: hey, this file, this file, and these…
Yeah, I 100% agree with everything Pablo just said. Absolutely go and buy EDR if you haven't. If you're not using managed devices with EDR right now, like do that. Two things I would add: I think that leaders and security professionals, compliance professionals, and generally your entire org really…
All right, well, you guys, this has been such an amazing interview. Thank you both so much for sharing your insights on Unchained.
Thanks, Laura.
More from Unchained
