Daria Volkova (00:00)
Hi everyone and welcome to the Decentralized Voices Podcast. My name is Daria and today I'm joined by Daniel Luca, tech partner at Eden Block VC and contributor to the Code Is Law movie.
Daniel Luca (00:12)
Hey, Daria. I'm actually very happy and a fan of your podcast, so happy to be here with you.
Daria Volkova (00:18)
Today we will discuss a documentary that exposes a series of massive crypto heists and the hackers who claim they broke no laws. The film premiered during EthCC this July and will be released to a wider audience on October 21st. In this episode, Daniel will uncover the secrets behind the film,
its meaning for crypto culture and the ethical discourse surrounding hackers. Stay with us for the full episode and don't forget to share it with your friends.
Daniel, please share a bit about your background and how did you join the movie as a contributor.
Daniel Luca (01:02)
I've always been a developer. Since I was really, really young, I started writing code. And I was always passionate about interacting with computers. I also liked physics. But with computers, it was a lot more direct, a lot more immediate, the feedback and what I was building. I started learning lots of programming languages. And I kind of started working in the field to kind of
speed through what I've done. I've built a few companies in Romania. I've met some of the Ethereum co-founders pretty early on. And then I started collaborating with Consensys. And that's how I got into Ethereum and crypto. I was a long time, some might say OG, but I'm not as OG as some of the others people, some of the others, especially
part of the documentary and the original DAO, but I was there to see lots of things happening. I wanted to go into security because I was always passionate about security, but it was kind of difficult to switch from hacker to security auditor.
But because Web3 was so open, I started to find bugs and report them to projects. And that's how I was invited to be an auditor with the Consensys Security Arm. It was really fun. We were writing best practices. We were building open source tools. And we were doing lots and lots of security audits.
After leaving Consensys Security, I started doing this on my own. I worked with a few projects. And that's where I met some of the people who are involved in the documentary.
Daria Volkova (02:45)
Compared to many other people, you're like true OG, but in a good way. And you saw a lot of things in the industry. That's impressive, really.
Daniel Luca (02:55)
I've gone through a few cycles already. Yeah. So it's like you have the meme with a, with a person who is about to get hanged. It's like first time. Yeah. I've been here a few times.
Daria Volkova (03:05)
How has your early experience as a developer shaped the way you now evaluate security risks with assessing projects for investment?
Daniel Luca (03:15)
In the beginning, I was like a developer like many, many others, mostly coming from the web world. So nobody was a blockchain developer because blockchain literally did not exist before that. I was writing a lot of JavaScript and then I started to write Go and Rust and you have kind of different principles when you do that. The thing is I was
very, very afraid to launch my first smart contract that I was the only one that was about to use it and it shouldn't even have a lot of funds. But I kind of understood from the beginning the risks and the problems that might appear with smart contracts. And honestly, I kind of overblown those because there weren't so much in, at least in my case.
But I did want to be very, very careful about how to do it. So I wrote my first smart contract. I sent it to a few people to review it. I got a few changes, a few more tests and updates, and then I launched it. I kind of felt like more eyes and more people and lots of time does help with that. But when I started working in security and actually doing work for
Daria Volkova (04:18)
Mm-hmm.
Daniel Luca (04:22)
real companies and real projects, we started to develop a real good methodology. So we had some steps that we would go through, lots of tools that we were building. We were also building things like symbolic execution, you kind of play with the state of the smart contract in a more flexible way.
⁓ Some people might know about formal verification. It's an even better way to verify that something works really well. And you also have to define the attack surface, understand who are the actors, what they can do, who do you trust, who you should trust or should never trust. And there is all these other very practical...
Daria Volkova (05:00)
Mm-hmm.
Daniel Luca (05:05)
attack vectors where you have things like front running. So you're going to send a transaction, but someone else can send it the same transaction or a similar one before you and can change the state of the contract before yours hit. like it's, it's one thing to kind of do security in theory, in practice, it's a lot more messy.
Daria Volkova (05:13)
Yeah.
You described now the flow, the principles, and I understand that it's like 100 % about practice and you can't learn about security and all risks without facing these risks and without facing all these challenges and exploring by your own how it could work.
Can you please share what do you like about the blockchain field?
Daniel Luca (05:49)
I've always been interested in new technologies. Even when I was doing web, it was kind of new. I've always been not following the normal paths. For example, I'm a university dropout and I did that when it wasn't very popular. I used to go to the olympiad, physics, informatics, computer science.
when you drop out after doing all that, it's kind of weird. So I had to be very careful about what my decisions are and if I do have a right path to this. I realized that following my instinct and going to interesting technologies is a good pathway for me because it kind of keeps me happy.
I discovered AI and blockchain around 2015-2016. I didn't know exactly how to contribute to AI back then, but it felt like nobody knew what's happening in the blockchain space. So I had a fighting chance. So I chose blockchain. It was very interesting.
Daria Volkova (06:46)
Mm-hmm.
Daniel Luca (06:54)
There was literally nobody that knew too much compared to how much I knew. So that's how I chose blockchain. It was very interesting technology and there was something to do there and I could have an impact.
Daria Volkova (07:08)
Yeah, it's really great and I wish more people joined blockchain and crypto because of this genuine interest to the field and to technologies. So let's talk more about the movie - Code is Law.
Give a short overview of the movie.
Daniel Luca (07:24)
So the movie explores two very important hacks in blockchain and they both happened in Ethereum. It's kind of a coincidence, know, Ethereum being the first application platform, there's a lot of firsts happening in Ethereum. First, it explores The DAO hack, which a lot of people are familiar with.
But not a lot of people have the insights and had the access to the people who were in the trenches, writing the code, in the war rooms, being affected, or actually the founders of the project. So it's quite a interesting window into those lives, into their perspectives, into what happened there with a firsthand experience.
The second part, it kind of continues with the Indexed Finance hack. The Indexed Finance hack is very interesting because it wasn't such a high impact hack, but it was the first hack where we found the person behind the hack. And that was very unique back then. We didn't really think this was possible or possible so early.
Daria Volkova (08:28)
Mm-hmm.
Daniel Luca (08:35)
But through a series of mistakes that the hacker did, we were able to track them. And the crazy thing is we tracked him, we contacted him, we told him like he can take some reward and return the rest of the funds. Or we start legal action against him and he chose to flee the country.
Daria Volkova (08:52)
Mm-hmm.
Daniel Luca (08:59)
and keep all of the funds, which is even crazier.
Daria Volkova (09:00)
Mm-hmm.
Daniel Luca (09:03)
I'm not sure if he was actually 18 when it happened, like very smart dude. But very arrogant. I'm sure he didn't really know what the impact of his decision through like for the rest of his life, what that actually means.
So kind of that's the big part of the hack. Another interesting thing is like while we were ⁓ filming the video, the movie. Another hack happened, but that's something that people have to uncover by watching the movie. I'm not going to spoil that part.
Daria Volkova (09:33)
Yeah, yeah, for sure, for sure. Can you share about James (the movie director) a bit?
Daniel Luca (09:38)
James Craig contacted me on August 30. This was like 2023. And he sent me a really long message that he wants to talk about people who were connected to the Indexed Finance because he's a movie maker, he wants to do something. I was extremely skeptical in the beginning. We had a few
chats, I asked for some documentaries he made. I wanted to see exactly how he makes documentaries because 2023 was the time where Netflix was starting to create lots of documentaries and they were all too hyped and I didn't want...
Daria Volkova (10:14)
Yeah, high
level without any depth.
Daniel Luca (10:17)
And they didn't have great research and it felt like the people didn't really understand the technologies or the people involved there. I spent a lot of time with him. We had lots of conversations and eventually I understood that he's actually the real deal and he wants to do this right. And he's not going to present us in a light that
we're all the scammers. He is actually going to present the people and the good things that are actually happening here. Because if you look at the media, you're only going to see the highlights where people do bad stuff, because that's what gets attention. That's how it started. And then we just kept collaborating and I wanted to contribute more and more because it felt like he was...
Daria Volkova (10:53)
Mm-hmm.
Daniel Luca (11:02)
fighting a good fight and it was not easy. He was coming out from the outside of Web3 so I just kind of started helping him with lots of things. He's a really good dude and he's actually gearing up to make another movie soon.
Daria Volkova (11:15)
Nice, a small teaser! How do you see your role in shaping the conversation around Code Is Law?
Daniel Luca (11:21)
In the movie, I'm also interviewed there and I try to present my own perspective. But he also went into like philosophical questions are like, is justice still relevant or are we going to do our own justice now?
It's a very difficult question because I think both will exist in the future and both have to exist. I think code will define laws, but it's a different set of law. When I started to understand that smart contracts are smart contracts, it's not just two random associations of words, it's smart contracts. We have the law contracts and we have smart contracts, which are like code.
Daria Volkova (11:50)
Mm-hmm.
Yeah,
Daniel Luca (12:03)
contracts with,
Daria Volkova (12:04)
yeah, that makes sense.
Daniel Luca (12:06)
with law contracts, you kind of define what you wish to happen and how you wish the people to interact with smart contracts. It's kind of different. You only allow what you want to happen and nothing else. So that means that people cannot behave badly. And then you have to go after them and sue them because they did the wrong thing.
Daria Volkova (12:13)
Mm-hmm.
Mm-hmm.
Daniel Luca (12:29)
With smart contracts, you should not be allowed to do those actions. So it's a very different perspective. And I think both are very important. Now, the thing is, law sometimes fails and code sometimes fails. And I think both are needed because of that. So from a kind of an ethical, moral perspective, I think
both need to exist, kind of need to meet and learn to coexist because right now they live in completely separate worlds.
Daria Volkova (12:52)
Mm-hmm.
I like your perspective about contracts and you sign in any case you sign something but in smart contracts you allow to do something without any rules.
Daniel Luca (13:07)
That's right. We also sign signatures. We sign transactions. So it's also a signature that we create. So yeah, it's good. The parallel or the metaphor continues.
Daria Volkova (13:19)
You mentioned that James reached out to you with the proposal about movie and the movie features intimate interviews with very popular crypto and blockchain figures like Griff, Christoph, and Lefteris, and you, of course. So how did James build this trust with you and others to make this so deep and so interesting for viewers?
Daniel Luca (13:43)
I think it was really important to build the right connections so you would have the right information from the right people. With me, he spent a few months trying to convince me that he's the real deal. With the others, it kind of becomes easier once you convince one person that person will vouch for you. So I know Griff was another person he contacted and Griff is a really
kind worm person, very nice, very happy all the time. I'm not sure how he does it, but you see him in the movie during the dowel hack and he's the most positive person while 150 millions are being drained. I have no idea how he does it. And like you kind of build up trusts moving from one to another. And it's just easier. think another
important part is you need enough time to pass from the event to be ready to tell the story. And with The DAO and with the Indexed Finance, a couple of years passed and the scars were not so deep anymore.
Daria Volkova (14:48)
I think that it sounds very vulnerable and deep and the time has passed and now people can talk about this.
Daniel Luca (14:58)
I can't say that. We had our first screener at Cannes during EthCC, which was kind of a... It's insane that you're part of a movie and the first screening is at Cannes. I'm a movie buff. I love movies quite a lot. I met most of the people who are part of the movie there and everybody was feeling still... We're still feeling pain.
Daria Volkova (15:19)
Mm-hmm.
Daniel Luca (15:19)
from those events,
even though so much time has passed. You're good enough to talk about what happened, but it's not easy to completely forget about it or not be affected in any way.
Daria Volkova (15:32)
Yeah, yeah, I was there. I didn't watch the whole movie that time in Cannes, but I was there for a few minutes. I saw Lefteris He was watching the movie very carefully and he was super focused. I didn't know that he was part of the movie and of the story. Now I know this and I understand the
full drama behind. How did the team reconstruct all investigative steps without full war-room transcripts? Where did they find this information from you, from others? How it was?
Daniel Luca (16:07)
I can say a little bit about the DAO hack. I know there were transcripts, part of a Slack group then. In my case, I was that source, with the index finance hack. I was one of the first people who contacted the founder of the project and wanted to help.
So we created a war room and we worked on that and we just tried to understand what happened. I guess that if you have access to the right people, you have first-hand information.
You can provide all of that if you feel like it will help with the story and not do anything else.
It's a lot of like going through logs, going through messages, kind of pinpointing and trying to remember what happened. it's interesting because you memory is such a fickle queen. You think you remember it perfectly, but then you look at the transcripts like, it actually didn't happen exactly this way. But we.
had to relive while we recovered the transcripts. We had to relive through those moments. And actually, remember Lawrence, which kind of stars in the movie. He's also one of the co-founders of Index Finance. He did some reconstructions with a dog, which is not his dog, in a house, which is not his house. It's kind of cool that they went through all that production to recreate the events.
Daria Volkova (17:19)
Mm-hmm.
I'm sure that for our listeners, viewers, and viewers of the movie it would be very interesting to learn how it was and especially knowing many people involved.
Do you think more stories like this need to be told to drive better policy and better tech practices?
Daniel Luca (17:52)
I'm sure more stories need to be told. There are a few reasons for this. We have so many interesting stories that we're not telling. We know them because we're inside, but we can say some interesting stories to the outside. First of all, there's very interesting stories. Second of all is every time a story like this is public, it kind of...
raises your awareness towards your protocol, towards your own security, whatever happens. So it's beneficial for people, for individuals and for companies. And it's also beneficial for the companies who are providing security services because they see an optic in business then. So it's definitely useful. I'm not sure if people are aware, but right now there are a lot of
Daria Volkova (18:31)
Mm-hmm.
Daniel Luca (18:38)
attacks and hacks happening like from physical ones at events like where I wouldn't think this would happen and in parts of the world.
Daria Volkova (18:47)
Yeah, we saw,
we all saw them, unfortunately, yeah.
Daniel Luca (18:51)
Yeah,
I wouldn't have guessed that that was possible and lots and lots of software attacks and not just in blockchain, but also supply chain attacks in JavaScript. And we're going to see others in Python soon. So developers are being attacked right now and it's not easy to protect ourselves because we have to install and we have to work with lots of code and it's very difficult to work in a completely isolated environment.
because you're not really using the resources or your login or credentials the right way. especially if you're working with AI, you need access to video cards, you need access to GPUs. You cannot completely isolate and not give the program access to anything. So I feel like developers are the most vulnerable right now and something needs to happen. Now...
I know that James is working on a movie about North Korean hackers and he's working with lots of very good people from the web3 security space. So that's going to be very fun. I don't think it's going to be as maybe not as intense as this one, especially not for me, but it's going to be a lot more fun movie from what I know.
Daria Volkova (19:55)
Mm-hmm.
I'm curious if he plans to have some interviews with North Korean hackers in general, who will be his guests for interviews?
Daniel Luca (20:17)
This will kind of happen because those hackers are trying to get hired to security companies in Web3. Yes. So that means that they're going to interviews anyway. So we can kind of, you know, prepare those interviews. And I know some people make them do interesting things like draw a character and present that character. And because they're trying to get hired, they're kind of...
Daria Volkova (20:26)
Yeah, too many companies. Yeah, yeah.
Daniel Luca (20:41)
doing anything they're being asked. So it's kind of, that's why it's funny in a way. We'll see how this turns out though.
Daria Volkova (20:49)
Well, I'm looking forward to watching this and yeah, it should be very interesting because
for all hacks happening in the cyber space it's always easy to say, ⁓ the hackers from North Korea. But in general, the hackers are from everywhere and now cyber wars are happening right here and right now and not all of them covered by North Korean hackers.
Daniel Luca (21:18)
Yeah, you're right. Lots of things could happen and could be attributed to North Korea and then we kind of forget about it because we don't have access. So we need to some light in there because it's not fine to be completely in the dark.
Daria Volkova (21:32)
What message do you want developers, auditors, and founders to take from stories like this depicted in the film?
Daniel Luca (21:40)
People need to be aware of security. We kind of realized that as developers, we probably need upgradable contracts or at least modular contracts, like very good ways of upgrading at least parts of the contract. If you do that, you need a multi-seeker, you need a DAO to do it, which creates other problems because we have the coordination problem now. But never ignore security. And maybe a more...
Up to date, modern advice, don't vibe your smart contracts. They look good. The code looks really good. It looks professional, but when you start to go into it, there's always problems. So never vibe your smart contracts. But it is happening right now and we will see this more and more.
Daria Volkova (22:11)
Mm-hmm.
Mm-hmm.
And from the VC perspective, how do you see the balance between decentralization, permissionless, innovation and legal accountability? What's your advice?
Daniel Luca (22:36)
This is, I feel like this is a bit of a more serious question. I feel like most of it is more like a convergence. It's not really a battle between all these forces. So they need to find a way to understand each other first because at the moment there's, it's not, there's a lack of understanding. I have to be honest and I don't understand laws pretty well, but I understand code pretty well.
And when you have a lack of understanding, you might have ignorance, which turns into, the others don't know what they're doing, or they don't really understand us. But when you put people at the same table from different fields and you let them talk and understand each other, they realize that the other side is much better prepared than they usually assume.
It's great to see legal and coders be connected to be together and have a conversation. But I do think there is a place for both powers because I do think that smart contracts can handle part of it and law can handle other parts.
Daria Volkova (23:27)
together.
Daniel Luca (23:42)
Law can handle fraud, issues of intent, things like that, and code can handle mechanism design and how you expect the protocol to be used. I think they should work in unison. As a VC, we're always looking to push the boundaries of permissionless innovation. Recently, we're looking a lot more into AI and not just any kind of AI, but decentralized AI.
Daria Volkova (23:54)
Mm-hmm.
Daniel Luca (24:09)
We feel like there's a lot of potential here and blockchain has been great about kind of coordinating and pulling people together towards a common goal. And AI is a very interesting technology that does benefit from a lot of people contributing with data, with interactions, with compute. And these two technologies, I think work very, very well together.
Daria Volkova (24:28)
Mm-hmm.
Daniel Luca (24:34)
So if you're going to start your own protocol, it's fine to have it maybe a bit more centralized in the beginning if you have a plan to decentralize parts of it. Maybe you don't need to decentralize all of it. The risks are real, but we're moving in the right direction. I'm very helpful.
Daria Volkova (24:53)
That sounds optimistic. And I have the last question for you. Can decentralized systems scale sustainably without creating new systemic risks?
Daniel Luca (25:03)
This is probably the hairiest question. It's one of the toughest ones because we kind of see lots of risks and lots of hacks around. However, this space is not going away. It's only growing. So this tells me that it's very resilient to external forces and to...
Daria Volkova (25:17)
Mm-hmm.
Daniel Luca (25:24)
forces who are trying to destroy it or exploit it. That means that you have all these projects who are trying to exist, live and evolve in this space and the ones that can, will, and you will have others kind of mutate their version and create new ones and exist in the future and probably become better or not.
Good ones keep living, the bad ones disappear. And it's just kind of the nature of an open ecosystem. We don't need to impose rules on it. We kind of create a space where it can flourish and evolve. And it does this by itself then. So I think, yes, we can create systems, but things will fail along the way.
Daria Volkova (25:54)
Mm-hmm. Mm-hmm.
Daniel Luca (26:08)
That's fine because we kind of have to know what doesn't work. And it's very difficult to know what doesn't work without trying it.
Daria Volkova (26:16)
Yeah, I agree with you and I can add that if we see these risks, if we understand them, we can grow and prevent and develop and solve problems when they appear and then move forward instead of ⁓ building the system in vacuum without microbes and live in this
white room and then die after this, because The system and the ecosystem should grow and all these attacks they highlight that the ecosystem is growing and there are a lot of things are interesting enough to be attacked. If you do something
right, someone definitely would like to attack you and it works in any system, not only in the blockchain and crypto.
Daniel Luca (27:05)
That's right. That's right.
It's good to mention this because we see a lot of Twitter drama and like sometimes you really don't understand why people attack you. But if you reframe it this way, it's like you're important enough, you're interesting enough that people want to do something to you.
Daria Volkova (27:20)
Yeah, you attract attention and you're visible enough. If you don't have haters or attackers, probably you're not popular enough and you're doing something wrong.
Okay, thank you! It was a great conversation, it was insightful and I'm sure that many people will love the movie and they will see you, they will see a lot of familiar faces there. The movie goes live on October 21st. Which platforms, Daniel, can you add more details?
Daniel Luca (27:51)
Yeah, I think it's Amazon Prime, Apple, and YouTube movies.
Daria Volkova (27:57)
Yeah, so now you know where to find the movie and there is a dedicated Twitter page, so you can find it also on Twitter and I will leave all the links under this episode, the link to Daniel's profile and you can follow him, ask him questions about security, about venture capital and of course about the Ethereum ecosystem and blockchain in general. So Daniel, thank you very much.
It was a pleasure to have you. So guys, I hope you liked this episode. Give some love to it, share it with your friends and see you next time.
Daniel Luca (28:26)
Thank you for having me, Daria.
Hi everyone and welcome to the Decentralized Voices Podcast. My name is Daria and today I'm joined by Daniel Luca, tech partner at Eden Block VC and contributor to the Code Is Law movie.
Daniel Luca (00:12)
Hey, Daria. I'm actually very happy and a fan of your podcast, so happy to be here with you.
Daria Volkova (00:18)
Today we will discuss a documentary that exposes a series of massive crypto heists and the hackers who claim they broke no laws. The film premiered during EthCC this July and will be released to a wider audience on October 21st. In this episode, Daniel will uncover the secrets behind the film,
its meaning for crypto culture and the ethical discourse surrounding hackers. Stay with us for the full episode and don't forget to share it with your friends.
Daniel, please share a bit about your background and how did you join the movie as a contributor.
Daniel Luca (01:02)
I've always been a developer. Since I was really, really young, I started writing code. And I was always passionate about interacting with computers. I also liked physics. But with computers, it was a lot more direct, a lot more immediate, the feedback and what I was building. I started learning lots of programming languages. And I kind of started working in the field to kind of
speed through what I've done. I've built a few companies in Romania. I've met some of the Ethereum co-founders pretty early on. And then I started collaborating with Consensys. And that's how I got into Ethereum and crypto. I was a long time, some might say OG, but I'm not as OG as some of the others people, some of the others, especially
part of the documentary and the original DAO, but I was there to see lots of things happening. I wanted to go into security because I was always passionate about security, but it was kind of difficult to switch from hacker to security auditor.
But because Web3 was so open, I started to find bugs and report them to projects. And that's how I was invited to be an auditor with the Consensys Security Arm. It was really fun. We were writing best practices. We were building open source tools. And we were doing lots and lots of security audits.
After leaving Consensys Security, I started doing this on my own. I worked with a few projects. And that's where I met some of the people who are involved in the documentary.
Daria Volkova (02:45)
Compared to many other people, you're like true OG, but in a good way. And you saw a lot of things in the industry. That's impressive, really.
Daniel Luca (02:55)
I've gone through a few cycles already. Yeah. So it's like you have the meme with a, with a person who is about to get hanged. It's like first time. Yeah. I've been here a few times.
Daria Volkova (03:05)
How has your early experience as a developer shaped the way you now evaluate security risks with assessing projects for investment?
Daniel Luca (03:15)
In the beginning, I was like a developer like many, many others, mostly coming from the web world. So nobody was a blockchain developer because blockchain literally did not exist before that. I was writing a lot of JavaScript and then I started to write Go and Rust and you have kind of different principles when you do that. The thing is I was
very, very afraid to launch my first smart contract that I was the only one that was about to use it and it shouldn't even have a lot of funds. But I kind of understood from the beginning the risks and the problems that might appear with smart contracts. And honestly, I kind of overblown those because there weren't so much in, at least in my case.
But I did want to be very, very careful about how to do it. So I wrote my first smart contract. I sent it to a few people to review it. I got a few changes, a few more tests and updates, and then I launched it. I kind of felt like more eyes and more people and lots of time does help with that. But when I started working in security and actually doing work for
Daria Volkova (04:18)
Mm-hmm.
Daniel Luca (04:22)
real companies and real projects, we started to develop a real good methodology. So we had some steps that we would go through, lots of tools that we were building. We were also building things like symbolic execution, you kind of play with the state of the smart contract in a more flexible way.
⁓ Some people might know about formal verification. It's an even better way to verify that something works really well. And you also have to define the attack surface, understand who are the actors, what they can do, who do you trust, who you should trust or should never trust. And there is all these other very practical...
Daria Volkova (05:00)
Mm-hmm.
Daniel Luca (05:05)
attack vectors where you have things like front running. So you're going to send a transaction, but someone else can send it the same transaction or a similar one before you and can change the state of the contract before yours hit. like it's, it's one thing to kind of do security in theory, in practice, it's a lot more messy.
Daria Volkova (05:13)
Yeah.
You described now the flow, the principles, and I understand that it's like 100 % about practice and you can't learn about security and all risks without facing these risks and without facing all these challenges and exploring by your own how it could work.
Can you please share what do you like about the blockchain field?
Daniel Luca (05:49)
I've always been interested in new technologies. Even when I was doing web, it was kind of new. I've always been not following the normal paths. For example, I'm a university dropout and I did that when it wasn't very popular. I used to go to the olympiad, physics, informatics, computer science.
when you drop out after doing all that, it's kind of weird. So I had to be very careful about what my decisions are and if I do have a right path to this. I realized that following my instinct and going to interesting technologies is a good pathway for me because it kind of keeps me happy.
I discovered AI and blockchain around 2015-2016. I didn't know exactly how to contribute to AI back then, but it felt like nobody knew what's happening in the blockchain space. So I had a fighting chance. So I chose blockchain. It was very interesting.
Daria Volkova (06:46)
Mm-hmm.
Daniel Luca (06:54)
There was literally nobody that knew too much compared to how much I knew. So that's how I chose blockchain. It was very interesting technology and there was something to do there and I could have an impact.
Daria Volkova (07:08)
Yeah, it's really great and I wish more people joined blockchain and crypto because of this genuine interest to the field and to technologies. So let's talk more about the movie - Code is Law.
Give a short overview of the movie.
Daniel Luca (07:24)
So the movie explores two very important hacks in blockchain and they both happened in Ethereum. It's kind of a coincidence, know, Ethereum being the first application platform, there's a lot of firsts happening in Ethereum. First, it explores The DAO hack, which a lot of people are familiar with.
But not a lot of people have the insights and had the access to the people who were in the trenches, writing the code, in the war rooms, being affected, or actually the founders of the project. So it's quite a interesting window into those lives, into their perspectives, into what happened there with a firsthand experience.
The second part, it kind of continues with the Indexed Finance hack. The Indexed Finance hack is very interesting because it wasn't such a high impact hack, but it was the first hack where we found the person behind the hack. And that was very unique back then. We didn't really think this was possible or possible so early.
Daria Volkova (08:28)
Mm-hmm.
Daniel Luca (08:35)
But through a series of mistakes that the hacker did, we were able to track them. And the crazy thing is we tracked him, we contacted him, we told him like he can take some reward and return the rest of the funds. Or we start legal action against him and he chose to flee the country.
Daria Volkova (08:52)
Mm-hmm.
Daniel Luca (08:59)
and keep all of the funds, which is even crazier.
Daria Volkova (09:00)
Mm-hmm.
Daniel Luca (09:03)
I'm not sure if he was actually 18 when it happened, like very smart dude. But very arrogant. I'm sure he didn't really know what the impact of his decision through like for the rest of his life, what that actually means.
So kind of that's the big part of the hack. Another interesting thing is like while we were ⁓ filming the video, the movie. Another hack happened, but that's something that people have to uncover by watching the movie. I'm not going to spoil that part.
Daria Volkova (09:33)
Yeah, yeah, for sure, for sure. Can you share about James (the movie director) a bit?
Daniel Luca (09:38)
James Craig contacted me on August 30. This was like 2023. And he sent me a really long message that he wants to talk about people who were connected to the Indexed Finance because he's a movie maker, he wants to do something. I was extremely skeptical in the beginning. We had a few
chats, I asked for some documentaries he made. I wanted to see exactly how he makes documentaries because 2023 was the time where Netflix was starting to create lots of documentaries and they were all too hyped and I didn't want...
Daria Volkova (10:14)
Yeah, high
level without any depth.
Daniel Luca (10:17)
And they didn't have great research and it felt like the people didn't really understand the technologies or the people involved there. I spent a lot of time with him. We had lots of conversations and eventually I understood that he's actually the real deal and he wants to do this right. And he's not going to present us in a light that
we're all the scammers. He is actually going to present the people and the good things that are actually happening here. Because if you look at the media, you're only going to see the highlights where people do bad stuff, because that's what gets attention. That's how it started. And then we just kept collaborating and I wanted to contribute more and more because it felt like he was...
Daria Volkova (10:53)
Mm-hmm.
Daniel Luca (11:02)
fighting a good fight and it was not easy. He was coming out from the outside of Web3 so I just kind of started helping him with lots of things. He's a really good dude and he's actually gearing up to make another movie soon.
Daria Volkova (11:15)
Nice, a small teaser! How do you see your role in shaping the conversation around Code Is Law?
Daniel Luca (11:21)
In the movie, I'm also interviewed there and I try to present my own perspective. But he also went into like philosophical questions are like, is justice still relevant or are we going to do our own justice now?
It's a very difficult question because I think both will exist in the future and both have to exist. I think code will define laws, but it's a different set of law. When I started to understand that smart contracts are smart contracts, it's not just two random associations of words, it's smart contracts. We have the law contracts and we have smart contracts, which are like code.
Daria Volkova (11:50)
Mm-hmm.
Yeah,
Daniel Luca (12:03)
contracts with,
Daria Volkova (12:04)
yeah, that makes sense.
Daniel Luca (12:06)
with law contracts, you kind of define what you wish to happen and how you wish the people to interact with smart contracts. It's kind of different. You only allow what you want to happen and nothing else. So that means that people cannot behave badly. And then you have to go after them and sue them because they did the wrong thing.
Daria Volkova (12:13)
Mm-hmm.
Mm-hmm.
Daniel Luca (12:29)
With smart contracts, you should not be allowed to do those actions. So it's a very different perspective. And I think both are very important. Now, the thing is, law sometimes fails and code sometimes fails. And I think both are needed because of that. So from a kind of an ethical, moral perspective, I think
both need to exist, kind of need to meet and learn to coexist because right now they live in completely separate worlds.
Daria Volkova (12:52)
Mm-hmm.
I like your perspective about contracts and you sign in any case you sign something but in smart contracts you allow to do something without any rules.
Daniel Luca (13:07)
That's right. We also sign signatures. We sign transactions. So it's also a signature that we create. So yeah, it's good. The parallel or the metaphor continues.
Daria Volkova (13:19)
You mentioned that James reached out to you with the proposal about movie and the movie features intimate interviews with very popular crypto and blockchain figures like Griff, Christoph, and Lefteris, and you, of course. So how did James build this trust with you and others to make this so deep and so interesting for viewers?
Daniel Luca (13:43)
I think it was really important to build the right connections so you would have the right information from the right people. With me, he spent a few months trying to convince me that he's the real deal. With the others, it kind of becomes easier once you convince one person that person will vouch for you. So I know Griff was another person he contacted and Griff is a really
kind worm person, very nice, very happy all the time. I'm not sure how he does it, but you see him in the movie during the dowel hack and he's the most positive person while 150 millions are being drained. I have no idea how he does it. And like you kind of build up trusts moving from one to another. And it's just easier. think another
important part is you need enough time to pass from the event to be ready to tell the story. And with The DAO and with the Indexed Finance, a couple of years passed and the scars were not so deep anymore.
Daria Volkova (14:48)
I think that it sounds very vulnerable and deep and the time has passed and now people can talk about this.
Daniel Luca (14:58)
I can't say that. We had our first screener at Cannes during EthCC, which was kind of a... It's insane that you're part of a movie and the first screening is at Cannes. I'm a movie buff. I love movies quite a lot. I met most of the people who are part of the movie there and everybody was feeling still... We're still feeling pain.
Daria Volkova (15:19)
Mm-hmm.
Daniel Luca (15:19)
from those events,
even though so much time has passed. You're good enough to talk about what happened, but it's not easy to completely forget about it or not be affected in any way.
Daria Volkova (15:32)
Yeah, yeah, I was there. I didn't watch the whole movie that time in Cannes, but I was there for a few minutes. I saw Lefteris He was watching the movie very carefully and he was super focused. I didn't know that he was part of the movie and of the story. Now I know this and I understand the
full drama behind. How did the team reconstruct all investigative steps without full war-room transcripts? Where did they find this information from you, from others? How it was?
Daniel Luca (16:07)
I can say a little bit about the DAO hack. I know there were transcripts, part of a Slack group then. In my case, I was that source, with the index finance hack. I was one of the first people who contacted the founder of the project and wanted to help.
So we created a war room and we worked on that and we just tried to understand what happened. I guess that if you have access to the right people, you have first-hand information.
You can provide all of that if you feel like it will help with the story and not do anything else.
It's a lot of like going through logs, going through messages, kind of pinpointing and trying to remember what happened. it's interesting because you memory is such a fickle queen. You think you remember it perfectly, but then you look at the transcripts like, it actually didn't happen exactly this way. But we.
had to relive while we recovered the transcripts. We had to relive through those moments. And actually, remember Lawrence, which kind of stars in the movie. He's also one of the co-founders of Index Finance. He did some reconstructions with a dog, which is not his dog, in a house, which is not his house. It's kind of cool that they went through all that production to recreate the events.
Daria Volkova (17:19)
Mm-hmm.
I'm sure that for our listeners, viewers, and viewers of the movie it would be very interesting to learn how it was and especially knowing many people involved.
Do you think more stories like this need to be told to drive better policy and better tech practices?
Daniel Luca (17:52)
I'm sure more stories need to be told. There are a few reasons for this. We have so many interesting stories that we're not telling. We know them because we're inside, but we can say some interesting stories to the outside. First of all, there's very interesting stories. Second of all is every time a story like this is public, it kind of...
raises your awareness towards your protocol, towards your own security, whatever happens. So it's beneficial for people, for individuals and for companies. And it's also beneficial for the companies who are providing security services because they see an optic in business then. So it's definitely useful. I'm not sure if people are aware, but right now there are a lot of
Daria Volkova (18:31)
Mm-hmm.
Daniel Luca (18:38)
attacks and hacks happening like from physical ones at events like where I wouldn't think this would happen and in parts of the world.
Daria Volkova (18:47)
Yeah, we saw,
we all saw them, unfortunately, yeah.
Daniel Luca (18:51)
Yeah,
I wouldn't have guessed that that was possible and lots and lots of software attacks and not just in blockchain, but also supply chain attacks in JavaScript. And we're going to see others in Python soon. So developers are being attacked right now and it's not easy to protect ourselves because we have to install and we have to work with lots of code and it's very difficult to work in a completely isolated environment.
because you're not really using the resources or your login or credentials the right way. especially if you're working with AI, you need access to video cards, you need access to GPUs. You cannot completely isolate and not give the program access to anything. So I feel like developers are the most vulnerable right now and something needs to happen. Now...
I know that James is working on a movie about North Korean hackers and he's working with lots of very good people from the web3 security space. So that's going to be very fun. I don't think it's going to be as maybe not as intense as this one, especially not for me, but it's going to be a lot more fun movie from what I know.
Daria Volkova (19:55)
Mm-hmm.
I'm curious if he plans to have some interviews with North Korean hackers in general, who will be his guests for interviews?
Daniel Luca (20:17)
This will kind of happen because those hackers are trying to get hired to security companies in Web3. Yes. So that means that they're going to interviews anyway. So we can kind of, you know, prepare those interviews. And I know some people make them do interesting things like draw a character and present that character. And because they're trying to get hired, they're kind of...
Daria Volkova (20:26)
Yeah, too many companies. Yeah, yeah.
Daniel Luca (20:41)
doing anything they're being asked. So it's kind of, that's why it's funny in a way. We'll see how this turns out though.
Daria Volkova (20:49)
Well, I'm looking forward to watching this and yeah, it should be very interesting because
for all hacks happening in the cyber space it's always easy to say, ⁓ the hackers from North Korea. But in general, the hackers are from everywhere and now cyber wars are happening right here and right now and not all of them covered by North Korean hackers.
Daniel Luca (21:18)
Yeah, you're right. Lots of things could happen and could be attributed to North Korea and then we kind of forget about it because we don't have access. So we need to some light in there because it's not fine to be completely in the dark.
Daria Volkova (21:32)
What message do you want developers, auditors, and founders to take from stories like this depicted in the film?
Daniel Luca (21:40)
People need to be aware of security. We kind of realized that as developers, we probably need upgradable contracts or at least modular contracts, like very good ways of upgrading at least parts of the contract. If you do that, you need a multi-seeker, you need a DAO to do it, which creates other problems because we have the coordination problem now. But never ignore security. And maybe a more...
Up to date, modern advice, don't vibe your smart contracts. They look good. The code looks really good. It looks professional, but when you start to go into it, there's always problems. So never vibe your smart contracts. But it is happening right now and we will see this more and more.
Daria Volkova (22:11)
Mm-hmm.
Mm-hmm.
And from the VC perspective, how do you see the balance between decentralization, permissionless, innovation and legal accountability? What's your advice?
Daniel Luca (22:36)
This is, I feel like this is a bit of a more serious question. I feel like most of it is more like a convergence. It's not really a battle between all these forces. So they need to find a way to understand each other first because at the moment there's, it's not, there's a lack of understanding. I have to be honest and I don't understand laws pretty well, but I understand code pretty well.
And when you have a lack of understanding, you might have ignorance, which turns into, the others don't know what they're doing, or they don't really understand us. But when you put people at the same table from different fields and you let them talk and understand each other, they realize that the other side is much better prepared than they usually assume.
It's great to see legal and coders be connected to be together and have a conversation. But I do think there is a place for both powers because I do think that smart contracts can handle part of it and law can handle other parts.
Daria Volkova (23:27)
together.
Daniel Luca (23:42)
Law can handle fraud, issues of intent, things like that, and code can handle mechanism design and how you expect the protocol to be used. I think they should work in unison. As a VC, we're always looking to push the boundaries of permissionless innovation. Recently, we're looking a lot more into AI and not just any kind of AI, but decentralized AI.
Daria Volkova (23:54)
Mm-hmm.
Daniel Luca (24:09)
We feel like there's a lot of potential here and blockchain has been great about kind of coordinating and pulling people together towards a common goal. And AI is a very interesting technology that does benefit from a lot of people contributing with data, with interactions, with compute. And these two technologies, I think work very, very well together.
Daria Volkova (24:28)
Mm-hmm.
Daniel Luca (24:34)
So if you're going to start your own protocol, it's fine to have it maybe a bit more centralized in the beginning if you have a plan to decentralize parts of it. Maybe you don't need to decentralize all of it. The risks are real, but we're moving in the right direction. I'm very helpful.
Daria Volkova (24:53)
That sounds optimistic. And I have the last question for you. Can decentralized systems scale sustainably without creating new systemic risks?
Daniel Luca (25:03)
This is probably the hairiest question. It's one of the toughest ones because we kind of see lots of risks and lots of hacks around. However, this space is not going away. It's only growing. So this tells me that it's very resilient to external forces and to...
Daria Volkova (25:17)
Mm-hmm.
Daniel Luca (25:24)
forces who are trying to destroy it or exploit it. That means that you have all these projects who are trying to exist, live and evolve in this space and the ones that can, will, and you will have others kind of mutate their version and create new ones and exist in the future and probably become better or not.
Good ones keep living, the bad ones disappear. And it's just kind of the nature of an open ecosystem. We don't need to impose rules on it. We kind of create a space where it can flourish and evolve. And it does this by itself then. So I think, yes, we can create systems, but things will fail along the way.
Daria Volkova (25:54)
Mm-hmm. Mm-hmm.
Daniel Luca (26:08)
That's fine because we kind of have to know what doesn't work. And it's very difficult to know what doesn't work without trying it.
Daria Volkova (26:16)
Yeah, I agree with you and I can add that if we see these risks, if we understand them, we can grow and prevent and develop and solve problems when they appear and then move forward instead of ⁓ building the system in vacuum without microbes and live in this
white room and then die after this, because The system and the ecosystem should grow and all these attacks they highlight that the ecosystem is growing and there are a lot of things are interesting enough to be attacked. If you do something
right, someone definitely would like to attack you and it works in any system, not only in the blockchain and crypto.
Daniel Luca (27:05)
That's right. That's right.
It's good to mention this because we see a lot of Twitter drama and like sometimes you really don't understand why people attack you. But if you reframe it this way, it's like you're important enough, you're interesting enough that people want to do something to you.
Daria Volkova (27:20)
Yeah, you attract attention and you're visible enough. If you don't have haters or attackers, probably you're not popular enough and you're doing something wrong.
Okay, thank you! It was a great conversation, it was insightful and I'm sure that many people will love the movie and they will see you, they will see a lot of familiar faces there. The movie goes live on October 21st. Which platforms, Daniel, can you add more details?
Daniel Luca (27:51)
Yeah, I think it's Amazon Prime, Apple, and YouTube movies.
Daria Volkova (27:57)
Yeah, so now you know where to find the movie and there is a dedicated Twitter page, so you can find it also on Twitter and I will leave all the links under this episode, the link to Daniel's profile and you can follow him, ask him questions about security, about venture capital and of course about the Ethereum ecosystem and blockchain in general. So Daniel, thank you very much.
It was a pleasure to have you. So guys, I hope you liked this episode. Give some love to it, share it with your friends and see you next time.
Daniel Luca (28:26)
Thank you for having me, Daria.
